A scam in which a victim is manipulated into authorising a transfer to an account controlled by the attacker. Because the payment is authorised by the customer, standard fraud controls can miss it unless the detection layer understands behavioural, network, and contextual risk signals.
What Authorized Push Payment Scam Means in Practice
An authorised push payment scam works because the transfer looks legitimate from the payment rail’s point of view. The victim is tricked into approving the payment, so the control problem is not card fraud or account takeover at the bank boundary, it is manipulation at the point of authorisation.
That distinction matters because the scam often bypasses the checks that are tuned for unauthorised activity. Defenders need to treat the customer journey, communications channel, beneficiary profile and payment context as part of the security surface, not just the transaction record.
Why This Scam Is Hard to Stop
APP scams exploit trust, urgency and plausibility. The attacker may impersonate a bank, supplier, law firm, family member or investment contact, then steer the victim toward an apparently routine payment. The transfer can therefore arrive with valid customer intent, even though that intent was induced by deception.
This is why many cases are invisible to simple rule sets. A payment may match the account holder’s normal behaviour on paper while still being fraudulent in substance. Useful detection usually needs behavioural deviation, beneficiary risk, device and network context, and any signals that the payment was prompted by a coercive or deceptive interaction.
Common Scam Patterns and Signals
APP fraud appears in several recurring patterns, including invoice redirection, purchase scams, impersonation scams, romance scams and investment scams. The exact story changes, but the attacker’s objective is the same, to persuade the victim to send money to an account they control.
Signals that often deserve attention include first-time payees, rushed payment deadlines, unusual beneficiary detail changes, payment amounts that do not fit the customer’s history, and contact that moves the victim away from established verification channels. Banks and organisations should also watch for mule-account behaviour, because the receiving account often exists only to receive and forward stolen funds.
Controls That Reduce Exposure
Reducing APP scam exposure depends on adding friction and verification before money leaves the customer’s control. Confirmation of payee, stronger beneficiary checks, payment warnings, step-up verification for risky transfers and rapid scam education all help, but no single control is sufficient on its own.
Prevention is strongest when controls are layered across the payment journey. Strong customer authentication, contextual risk scoring, payee reputation checks and customer-facing scam warnings work best when they are designed to slow down high-risk transfers without blocking ordinary legitimate activity.
Risk and Threat Considerations
APP scams are dangerous because the payment is authorised by the victim, which can push the incident outside the scope of traditional unauthorised-payment fraud controls. That creates a detection gap, and it also increases the chance that the first alert arrives only after the funds have been moved or cashed out.
Failure mechanism: The attacker induces the victim to override normal caution, then uses a legitimate transfer path to move money into an account designed for rapid dispersal or layering.
Impact: The result can be direct financial loss, difficult reimbursement decisions, reputational damage for the receiving institution and a wider fraud chain if mule networks absorb the proceeds.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | APP scams rely on payment accounts and mule accounts that need strong governance. |
| Recommendation — Limit and review account access paths for payment and beneficiary operations. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Scam-facilitating payment accounts and beneficiary accounts require lifecycle control. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Fraud detection depends on reviewing transfer events, warnings and anomaly signals. | |
| Recommendation — Review and govern accounts that can initiate or receive high-risk transfers. Correlate payment activity and alerting to identify suspicious transfer patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Payment authorisation depends on controlled access and trusted approval paths. |
| Recommendation — Use strong access and approval controls for high-risk payment initiation. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Payment and verification flows fail when identity checks cannot establish genuine user intent. |
| Recommendation — Harden payment verification flows so authorisation cannot be trivially manipulated. | ||
Practitioner Guidance
Why practitioners should care: APP fraud is one of the few payment crimes where the main security failure can occur before the transfer, in the human decision to authorise it. That means fraud teams, payments teams and customer-support teams all need a shared view of risk.
What to watch for: The highest-risk cases usually combine a persuasive social story with a payment that is unusual for the customer, time-pressured, and routed to a new or previously unseen beneficiary. Those cases deserve the strongest friction and the fastest post-transaction review.
Practitioner takeaway: The most effective response is to treat authorisation itself as a risk event, not just the transaction outcome.
Related resources from NHI Mgmt Group
- Guide: Authorised Push Payment (APP) Fraud Guide
- What are the signs that a customer may be in the middle of an authorized push payment scam?
- How can financial institutions reduce losses from authorized push payment fraud?
- How should crypto platforms prevent authorized push payment fraud before funds leave the platform?
- Why does holiday shopping activity increase the risk of phishing, scams, and authorized push payment fraud?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org