Topic starter
12/07/2026 12:24 pm
TL;DR: APP fraud reached £583 million in UK losses in 2022, with 77% of fraudulent cases originating online and 17% via SMS or phone calls, according to Prove Identity and UK Finance. The pattern shows that payment controls cannot compensate for weak identity verification and behavioral trust signals.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “Decoding APP Fraud: The Evolution and Eradication Strategies for Authorized Push Payment (APP) Fraud”.
By the numbers:
- APP fraud losses reached £583 million in the UK in 2022.
- APP fraud losses increased 39% from the prior year.
Key questions
Q: What breaks when authorisation can be manipulated in APP fraud?
A: The control assumption breaks at the moment of payment approval.
Q: Why do real-time payments increase APP fraud risk?
A: Real-time payments compress the window between authorisation and settlement, which gives defenders less time to detect manipulation or reverse the transfer.
Q: How should banks reduce APP fraud without making every payment slower?
A: Banks should use adaptive friction, not universal friction.
Practitioner guidance
- Strengthen verification at the point of payment Add step-up checks when payment amount, payee novelty, device risk, or channel anomalies indicate elevated APP fraud risk.
- Bind identity to the device used for authorisation Use device binding and risk-based authentication so a payment request cannot rely on account credentials alone to establish trust.
- Differentiate warnings by transaction risk Replace generic warnings with context-specific alerts before high-risk transfers, because repeated non-specific prompts are ignored.
Bottom line: APP fraud succeeds because fraudsters manipulate the user into approving a legitimate-looking transfer, which turns identity trust into the real control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:37 pm
APP fraud exposes a verification gap, not a payment gap. The article shows that the transaction itself is often technically valid, but the identity and trust decision behind it is corrupted. For identity programmes, that means the decisive control is not simply stronger authentication at login, but stronger assurance at the point of payee approval and transfer authorisation. Practitioners should treat authorisation trust as a governed identity control, not a user education afterthought.
A few things that frame the scale:
- Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.
A question worth separating out:
Q: What is the difference between account access risk and payment authorisation risk?
A: Account access risk is about whether someone can enter or use an account, while payment authorisation risk is about whether a legitimate user can be induced to approve a fraudulent transfer. APP fraud is primarily the second problem. Teams need controls that verify intent and context, not only identity at sign-in.
👉 Read our full editorial: APP fraud exposes the trust gap in digital identity verification