Topic starter
11/07/2026 8:42 pm
TL;DR: APP fraud is now a top threat to financial institutions because victims willingly authorise transfers through clean-looking accounts, leaving traditional sender-focused checks blind to recipient risk, according to Chainalysis. The control gap is not better fraud suspicion after the fact, but earlier visibility into who receives the money and whether the destination is already part of a scam network.
Editorial analysis by NHI Mgmt Group, based on content published by Chainalysis: “Follow the Fraud: How to Protect Your Customers this Holiday Season”.
By the numbers:
- Around $442 billion was lost to scammers this year, according to Chainalysis.
- 67% believe their financial institutions should reimburse them for money lost in a scam even when they personally authorized the transaction, according to Chainalysis.
- Over $10 billion worth of crypto was lost in 2024 due to reimbursements, operational costs, and more, according to Chainalysis.
Key questions
Q: What breaks when fraud controls only assess the sender in APP scams?
A: Sender-only controls miss the core abuse pattern in APP fraud, which is that the victim authorizes a transfer to a recipient that may look legitimate but is actually risky.
Q: Why does authorised payment fraud create such high operational impact for financial institutions?
A: Authorised payment fraud shifts the burden from prevention to recovery.
Q: What are the signs that recipient-risk controls are too weak?
A: A common sign is heavy reliance on customer authentication, device signals, and sender behaviour while destination accounts are barely scored at all.
Practitioner guidance
- Implement recipient-risk scoring before settlement Evaluate destination accounts for scam indicators, mule behaviour, and network exposure before approving authorised transfers, especially for high-urgency consumer payments.
- Correlate verified accounts with fraud-network signals Treat account verification as one signal only, then combine it with destination reputation, link analysis, and prior scam reports to reduce false trust in clean-looking recipients.
- Align reimbursement and dispute workflows Define who owns APP fraud escalation, evidence capture, and reimbursement decisions so customer-impact handling is consistent when funds have already moved.
Bottom line: APP fraud succeeds because the customer authorises the transfer, which leaves conventional sender-focused controls blind to the real threat.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:12 pm
Recipient-risk blindness is the core control failure in APP fraud. Financial institutions have built mature checks around who sends money, but APP scams exploit the fact that the legitimate customer can still be manipulated into sending funds to a fraudulent destination. The governance gap is not weak authentication alone, but the absence of recipient-side trust decisions. Practitioners should treat destination-account intelligence as a primary fraud control, not a secondary investigation input.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should banks prioritise reimbursement policy or prevention first for APP fraud?
A: Prevention should come first, but reimbursement policy still needs to be defined in parallel. If institutions only debate compensation after losses occur, they miss the real issue, which is whether the payment flow can detect risky recipients before funds move. Mature programmes treat prevention, escalation, and customer remediation as one operating model.
👉 Read our full editorial: APP fraud leaves recipient risk invisible in financial controls