Authorised Payment Scam

How Authorised Payment Scam Works

An authorised payment scam succeeds by manipulating the payer, not by breaking the payment rails. The victim is persuaded, rushed, or deceived into initiating the transfer themselves, so the payment can look legitimate at the point of authorisation even when the underlying intent is fraudulent.

This makes the scam especially effective in fast payment environments, where the transfer may settle quickly and the psychological pressure to act immediately is high. The scammer’s real control surface is the conversation, email thread, invoice, or impersonation story that convinces the victim to approve the payment.

Why It Is Harder To Stop Than Unauthorised Fraud

Unlike classic account takeover, this pattern does not always depend on stolen login credentials or a compromised banking session. That means many technical fraud controls can be bypassed if they only look for abnormal authentication behaviour or unauthorised access.

The main weakness is that the user’s intent has been compromised before the transaction is submitted. Once the customer authorises the payment, banks and organisations often have less room to block or reverse it, especially when the scam uses a plausible business context such as an invoice, supplier change, property purchase, or urgent refund request.

Common Scam Paths And Deception Signals

Authorised payment scams often begin with impersonation, social engineering, or compromised communications. Common patterns include invoice redirection, executive impersonation, fake supplier changes, investment fraud, purchase scams, and coached customer scams that keep the victim engaged until the transfer is complete.

The deception usually works by creating urgency, authority, or secrecy. Victims may be told the payment is time-sensitive, confidential, or required to “verify” a transaction, which reduces normal checking and increases the chance of an irreversible transfer.

• Unexpected change to payee details or bank account instructions
• Pressure to keep the payment confidential or act immediately
• Requests that bypass normal approval, call-back, or invoice validation steps
• Messages that imitate executives, suppliers, solicitors, or platform support

Prevention, Detection, And Recovery Considerations

Prevention works best when organisations add friction before money leaves the account. Independent verification of payee changes, dual approval for unusual transfers, confirmation through a known-good channel, and tighter review of first-time or out-of-pattern payments all reduce exposure. The NHIMG Authorised Push Payment (APP) Fraud Guide is a useful companion for understanding payment controls and scam handling in the same fraud family.

Detection is partly behavioural and partly process-based: unusual payment urgency, changes to beneficiary details, and deviations from normal approval paths are all warning signs. After a confirmed scam, recovery usually depends on speed, so incident teams should know how to contact the bank, request recall where possible, preserve message evidence, and assess whether the fraud reused compromised email, messaging, or identity channels.

Risk and Threat Considerations

Authorised payment scam is risky because the victim’s own action can defeat controls that would otherwise stop an unauthorised transfer. The loss may be immediate, difficult to reverse, and amplified by the attacker’s use of legitimate-looking business pressure or trusted communication channels.

Failure mechanism: The attacker manipulates the payer into approving a real transfer, so the payment inherits apparent legitimacy and may pass normal bank and approval checks.

Impact: Organisations and individuals can suffer direct financial loss, delayed detection, strained vendor relationships, and follow-on abuse if the scam exposed email, invoice, or approval workflows.

Related resources from NHI Mgmt Group

• What breaks when a peer-to-peer payment scam is authorised by the victim?
• Who is accountable when an authorised fraud payment is not blocked?
• Who should be accountable when authorised push payment scams succeed?
• Why does authorised push payment fraud create a different control problem than account takeover fraud?