The Fraud that Persuades Victims to Defeat their own Security

Authorised Push Payment (APP) fraud is unlike traditional financial crime because customers unknowingly authorise the transfer themselves, convinced they are acting safely. Criminals increasingly exploit psychology rather than technology, combining impersonation, AI-generated voice cloning and convincing digital identities to create urgency and trust. In the UK, mandatory reimbursement has shifted attention from compensating victims towards preventing fraud before money leaves an account. Meanwhile, the EU is strengthening fraud prevention alongside faster payments and improved payment security. The winners will be institutions that understand behaviour as well as algorithms, embedding intelligent intervention into every payment journey rather than relying solely upon detecting suspicious transactions after the damage is done.

Human Psychology Is Now the Greatest Fraud Vulnerability

Criminals increasingly attack judgement rather than technology because persuading a customer to authorise a payment can bypass controls designed to stop unauthorised access. Urgency, authority and fear are powerful weapons. A convincing “bank officer” warning that savings are under attack can push a worried customer towards action before reflection. UK Finance reported that APP losses rose 19 per cent to £576.4 million in 2025, illustrating how sophisticated social engineering remains a formidable threat.

AI raises the stakes further. Voice cloning and personalised deepfakes can imitate relatives, executives or trusted organisations, while cognitive overload and decision fatigue make carefully engineered deception harder to recognise. The UK Government’s ‘Stop! Think Fraud’ campaign specifically warns that criminals use urgency, trusted identities and AI-generated voices.

Financial institutions therefore need behavioural security design, not another generic fraud leaflet. The FCA has highlighted behavioural biometrics, risk-based payment warnings and manual intervention for high-risk transactions. Such “friction-by-design” can interrupt dangerous momentum. The next step is adaptive warnings triggered by unusual customer behaviour, combined with education that rehearses decisions under pressure rather than simply describing scams.

How AI Is Transforming the Fight Against APP Fraud

Fraud prevention is moving from asking “Was that payment fraudulent?” to predicting “Does this payment look as though it is becoming fraudulent?” Machine-learning models can score transactions in real time, combining payment patterns with device intelligence and behavioural biometrics. The FCA has highlighted firms using behavioural biometrics to establish customers’ normal digital behaviour and identify suspicious deviations.

Signals become more powerful when combined. A new device, unfamiliar payee, atypical transfer and unusual typing behaviour may individually appear harmless, yet together justify intervention. The Payment Systems Regulator has cited services that detect whether a customer may be on the telephone while making a payment and a Pay.UK pilot that produced an average 40 per cent uplift in fraud detection.

The next frontier is collaborative, explainable AI. Privacy-preserving approaches such as federated learning could allow institutions to learn from fraud patterns without pooling raw customer data, while digital identity strengthens verification. AI agents can help investigators prioritise alerts and assemble evidence. Crucially, models require continuous monitoring for drift and changing criminal tactics. Prediction without explainability risks replacing missed fraud with unaccountable decisions.

From Reimbursement to Responsibility

APP fraud is no longer merely a problem for the fraud team. It is becoming a test of governance, customer protection and institutional accountability. In the UK, mandatory reimbursement for eligible APP scams has applied since October 2024, with sending and receiving payment firms generally sharing costs equally. That creates a commercial incentive to prevent fraud at both ends of the transaction.

The EU is moving similarly. The Payment Services Directive 3 (PSD3) and Payment Services Regulation reforms strengthen anti-fraud measures, including payee verification and protection where criminals impersonate payment service providers. The European Banking Authority (EBA) has also argued for stronger safeguards against evolving social-engineering fraud.

Boards therefore need to treat APP fraud as an enterprise risk spanning payments, compliance, cyber security, operational resilience and customer experience. Fraud governance-by-design means building responsibility into products and processes before losses occur. Board dashboards should move beyond losses and reimbursement rates to reveal scam typologies, mule-account exposure, intervention success and customer outcomes. Measurable culture indicators, clear cross-functional ownership and integrated financial-crime frameworks can turn reimbursement from an after-the-event expense into a catalyst for prevention.

The Invisible Criminal Enterprise

APP fraud increasingly resembles an international business ecosystem rather than isolated criminal activity. Organised networks can divide operations between scam designers, social-media recruiters, money-mule controllers and laundering specialists, while cryptocurrencies provide additional routes for moving proceeds across borders. The UK National Crime Agency estimates that 67% of reported UK fraud is cyber-enabled and notes criminals’ growing use of generative AI.

Speed compounds the problem. Money can pass through chains of mule accounts before institutions recognise the original scam. A Europol-linked UK operation found continued reliance on social media for mule recruitment and warned that faster payments allow funds to travel through networks before detection. Across Europe, coordinated action is therefore increasingly essential.

The strategic response must shift from detecting individual suspicious transactions towards disrupting the criminal infrastructure behind them. Network analytics can expose relationships between accounts, devices, beneficiaries and crypto wallets that appear innocent individually. Collaborative intelligence sharing between banks, technology companies and law enforcement can then target recruiters and controllers. Public-private partnerships should attack fraud-as-a-service itself, making criminal networks harder, slower and more expensive to operate.

Winning the Trust Race

Fraud prevention is becoming part of the customer proposition, not simply a compliance cost. In the UK, evidence already links protection with trust. Payment Systems Regulator research found that half of reimbursed APP fraud victims trusted their bank more afterwards, demonstrating the reputational value of responding quickly and fairly.

Trust-by-design goes further. Institutions can combine personalised warnings, intelligent transaction monitoring and carefully targeted friction, intervening when risk is elevated without making every legitimate payment an obstacle course. In the EU, Verification of Payee now enables customers to identify discrepancies between an intended recipient’s name and account details before transferring money. The European Central Bank (ECB) expects this to reduce both fraud and payment errors.

The commercial opportunity is to make security visible, proportionate and reassuring. Banks can measure fraud resilience through prevented losses, intervention success, reimbursement speed, customer confidence and abandonment rates, then report selected trust metrics alongside financial KPIs. Ecosystem partnerships with payment providers, technology platforms and telecommunications companies can strengthen protection further. Institutions that make customers feel secure without making digital banking frustrating can convert fraud resilience into loyalty, reputation and sustainable competitive advantage.

Prevention and Collaboration

APP fraud is forcing banks to rethink prevention. Transaction monitoring is giving way to behavioural intelligence, while responsibility is moving beyond fraud teams towards payments, compliance and customer service. In the UK, reimbursement rules have strengthened incentives for prevention, with the Payment Systems Regulator (PSR) reporting falling claim volumes. Across the EU, Verification of Payee gives customers an additional check before euro transfers, helping reduce fraud and payment errors.

The next leap is collaborative. Banks, technology platforms and law enforcement must share intelligence and disrupt criminal networks before money moves. As AI strengthens attackers and defenders, leaders will understand human behaviour as deeply as financial technology. Ultimately, trust may become the most valuable fraud control of all.

And what about you…?

  • Which behavioural warning signs should financial institutions monitor to recognise when a customer may be acting under pressure, manipulation or deception?
  • Does responsibility for preventing APP fraud sit too heavily with specialist fraud teams, or is it genuinely shared across your organisation?