Approval relay fraud is a real-time attack where a victim’s OTP or in-app confirmation is forwarded to the attacker while the victim still believes they are authorising a legitimate action. It defeats the assumption that out-of-band verification proves the other side of the exchange is trusted.
What approval relay fraud means
Approval relay fraud is a real-time social engineering and transaction-redirection attack. The victim still sees a genuine OTP prompt or app approval, but the verification is relayed to an attacker-controlled session that benefits from the victim’s trust.
The key deception is not simply stealing a code. It is preserving the appearance of a normal approval flow while quietly changing the destination, action, or session being authorised. That makes the attack especially effective against users who rely on the presence of a one-time challenge as proof that the request is safe.
Why it works against verification workflows
This fraud exploits a common assumption in authentication design, that an out-of-band or in-app confirmation proves the other side of the exchange is legitimate. In practice, the confirmation only proves that the user responded to a challenge, not that the request itself was trustworthy.
That gap matters most when the approval is used to approve a login, token grant, payment, account change, or sensitive transaction. If the attacker can insert themselves into the interaction in real time, the control may still complete exactly as designed, just on behalf of the wrong party.
Defences such as phishing-resistant authenticators and stronger transaction binding reduce this exposure by making the approval harder to replay, forward, or repurpose. For identity assurance guidance, NIST SP 800-63 Digital Identity Guidelines is the most relevant reference in this set.
Common attack path and trust failure
The attacker typically creates urgency, triggers a legitimate verification event, and then relays the approval in a way that keeps the victim believing the request belongs to them. The trust failure is subtle: the user is not being asked for a secret in the abstract, but is being manipulated into endorsing an active malicious flow.
This is why approval relay fraud often succeeds even when organisations have already removed passwords from the critical step. The control can still fail if the approval experience does not clearly bind the user, the action, and the destination into one verifiable decision.
From a broader defensive perspective, MITRE ATT&CK Enterprise Matrix is useful for mapping the surrounding credential-access and intrusion sequence, while FinCEN is relevant where this pattern is used to facilitate financial fraud and suspicious transfer activity.
Controls that reduce exposure
The strongest controls reduce the chance that a simple approval can authorise the wrong event. That means binding approvals to a specific transaction, showing the user enough context to detect mismatch, and using authenticator methods that resist forwarding or replay.
Organisations should also treat approval flows as part of the broader trust boundary, not as a standalone user-interface problem. Monitoring for unusual enrolment, session changes, repeated prompts, device switching, and anomalous approval timing can help identify abuse before the attacker completes the full sequence.
For a control baseline, NIST SP 800-53 Rev 5 Security and Privacy Controls supports authentication, access control, auditing, and configuration safeguards that help harden approval-dependent workflows.
Risk and Threat Considerations
Approval relay fraud is dangerous because it turns the victim’s trust into the attacker’s authorisation path. The user believes they are approving one action, while the attacker is using that approval to complete a different one in real time.
Failure mechanism: The defence fails when the approval mechanism proves only that a user responded, not that the approval was bound to the correct action, target, or session.
Impact: Attackers can complete logins, approve transactions, or authorise account changes while bypassing the trust that the user believed the verification step created.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines phishing-resistant authenticators and binding of user approval to the right event. |
| Recommendation — Adopt phishing-resistant authenticators and transaction binding for approval flows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers management of authenticators used in approval and verification flows. |
| AU-2 — Event Logging | Supports detection of suspicious approval, login, and transaction events. | |
| Recommendation — Harden authenticator lifecycle and restrict approval reuse paths. Log approval events and correlate them for abnormal relay patterns. | ||
| MITRE ATT&CK | T1110 — Brute Force | Covers repeated credential- and prompt-abuse patterns adjacent to approval fraud. |
| Recommendation — Map suspicious approval sequences to adjacent credential-abuse activity and investigate. | ||
Practitioner Guidance
Why practitioners should care: Approval steps are often treated as the strongest user-facing control, yet this fraud pattern shows that a confirmation can still be misused if the workflow is not tightly bound to the intended action. Design approvals so users can verify the exact transaction, not just the fact that a prompt appeared.
What to watch for: Repeated approvals in short succession, prompts that arrive outside expected user activity, device or session changes during confirmation, and any approval workflow that lacks clear transaction context. Those signals usually point to a process that is easy to relay rather than easy to trust.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org