Why does authorised push payment fraud create such a difficult accountability problem for financial institutions?

Why accountability gets so hard once the customer “authorises” the payment

APP fraud sits in a grey zone between consent and coercion. The bank can often show that the payment instruction was valid at the point of execution, yet the customer’s decision was shaped by deception that happened outside the banking channel. That makes the core accountability question less about whether a transfer occurred and more about which control point should have interrupted the scam.

The difficulty is compounded because the fraud path can span multiple actors and multiple moments in time. The customer may be deceived by a criminal impersonation, the bank may miss behavioural or destination-risk signals, and telecom or messaging controls may have failed to block the social-engineering channel. In practice, liability debates become disputes over which party had the best opportunity to detect the scam early enough to matter.

Where fraud patterns are central, investigators often have to separate payment validity from decision validity. A transaction can be technically authorised and still be the product of manipulation, which is why reimbursement rules and conduct standards tend to evolve faster than the underlying payment rails.

Why banks struggle to prove who should have prevented the loss

Accountability is difficult because APP fraud does not map cleanly onto the usual failure models. Traditional unauthorised-payment fraud is easier to analyse because there is a clear access violation. APP fraud instead raises a prevention question: should the institution have detected unusual payee behaviour, stepped up verification, delayed settlement, or warned the customer before the instruction was executed?

That creates a multi-layered evidence problem. A bank may need to demonstrate what it knew about the customer, what the payment looked like in context, what warnings were issued, and whether any intervention would realistically have changed the outcome. At the same time, customers and regulators may argue that scam warnings were inadequate, friction was too low, or scam typologies were too familiar to ignore.

The result is shared blame without a simple fault line. One party may have executed the transfer, another may have influenced the victim, and a third may have supplied the communications path that enabled the deception. Because the loss follows a legitimate-looking instruction, institutions must often judge risk before certainty exists, which is operationally difficult and legally sensitive.

For payment firms, that also means policy design matters as much as incident handling. Reimbursement rules, confirmation workflows, mule-account monitoring, customer warnings, and scam interdiction controls all become part of the accountability story, because each one affects whether a reasonable intervention was available.

Risk and Threat Considerations

APP fraud creates exposure because the scam can look legitimate at the moment of execution, which weakens after-the-fact accountability and makes prevention dependent on early warning signals. The more realistic the social engineering, the more likely it is that the institution will be judged on detection and intervention rather than on the customer’s nominal consent.

Failure mechanism: Criminals manipulate the payer into authorising a transfer to an apparently legitimate beneficiary, then move funds quickly through accounts that are hard to recover before the victim or bank recognises the scam.

Impact: Institutions face reimbursement pressure, dispute complexity, customer harm, and reputational damage, while weak scam controls can also increase losses across recurring fraud typologies.

Practitioner Guidance

What to verify: Treat the central question as “what detection or intervention point was available before execution?” rather than “was the payment technically authorised?” That means reviewing warning content, destination-risk checks, confirmation flows, and whether escalation thresholds were tuned to fraud patterns that are common in real customer journeys.

Decision rule: If the bank can identify a plausible earlier stop point, prioritise control effectiveness and evidence preservation over debating blame in the abstract. If no reasonable intervention existed, the practical focus shifts to reimbursement policy, customer communication, and whether current scam controls are materially underpowered.

Practitioner takeaway: APP fraud is hardest to govern when institutions treat authorisation as the end of the control story, because the real accountability question is whether the payment process could have interrupted deception before money left the account.

Related resources from NHI Mgmt Group

• Why does authorised push payment fraud create a different control problem than account takeover fraud?
• Why does authorized push payment fraud create such difficult recovery and reimbursement decisions?
• How can financial institutions reduce losses from authorized push payment fraud?
• Why does crypto-enabled crime create such a difficult enforcement and fraud problem across borders?