What authorised push payment fraud is

Authorised push payment (APP) fraud is when a scammer tricks you into sending money from your own bank account to an account they control, and your bank treats the transfer as legitimate because you authorised it yourself. The scammer does not hack your account or forge your signature. You initiate the payment—but based on false information the scammer gave you.

The critical difference from other fraud is that you gave the instruction. Your bank processed a real payment to a real account number. From the bank's perspective, nothing went wrong with the transaction itself. This is why APP fraud is so difficult to reverse and why prevention matters more than recovery.

The scammer's goal is to create a false sense of urgency or legitimacy so you move money before you can verify the request. They might impersonate your bank, your employer, a government agency, a solicitor, or someone else you trust. The payment itself looks normal. The deception happened before you pressed send.

Key Takeaways

  • APP fraud happens when you authorise a payment yourself, based on false information from a scammer, so your bank cannot easily reverse it as an error.
  • Common scenarios include fake invoices from suppliers, impersonation of your bank asking you to move money to a "find account", and romance scams where someone builds trust over weeks before asking for money.
  • Once the money reaches the scammer's account, recovery depends on whether the receiving bank will freeze the account and cooperate—which is not may provide and takes time.
  • Banks are now required to warn you if a payment looks unusual, but the warning is your responsibility to act on; the bank is not liable if you ignore it.
  • The best defence is to verify requests through a phone number or website you find yourself, never one the person asking you provided.

How the scammer creates the false request

APP fraud usually starts with impersonation. The scammer contacts you by email, phone, text, or social media and claims to be someone with authority or urgency. They might say your bank account has been compromised and you need to move money to a safe account. They might send an invoice that looks like it came from a company you do business with, but the bank details are theirs. They might pose as a government official, a solicitor handling a property purchase, or a romantic partner.

The scammer's goal is to make the request feel real enough and urgent enough that you do not stop to verify it independently. They may use details they found about you online, or details from a data breach, to sound credible. They might create a fake email address that looks almost identical to a real company's address. They might call you and stay on the line while you log into your banking app, talking you through each step.

What they do not do is access your account themselves. You are the one who logs in, selects the payee, enters the amount, and confirms the payment. From your bank's records, it looks exactly like a normal transaction you initiated.

Why banks struggle to reverse APP fraud

When you report APP fraud, your bank faces a legal and practical problem. You authorised the payment. Your credentials were correct. The transaction went through normal channels. The bank did not make an error—you did, based on deception.

Most bank terms state that the customer is responsible for authorised transactions, even if the customer was deceived. This is different from card fraud or account takeover, where the bank itself failed to protect you. In those cases, the bank is liable. In APP fraud, the liability is murkier because you were the one who moved the money.

Even if your bank wants to help, the money is now in another account, often at another bank. Your bank can ask the receiving bank to freeze the account and return the funds, but the receiving bank is not obligated to comply quickly or at all. If the receiving account belongs to a money mule (someone the scammer hired to receive and move the money), the funds may already be gone. If the account is overseas, recovery becomes even harder.

Common APP fraud scenarios

The most frequent APP fraud involves fake invoices. A scammer sends an email that looks like it came from a supplier or contractor you work with. The email says the bank details have changed and includes new account information—which is actually the scammer's account. You process the payment as normal, and by the time the real supplier asks why they were not paid, the money is gone.

Another common scenario is the bank impersonation call. Someone calls claiming to be from your bank's fraud team. They say suspicious activity has been detected on your account and you need to move your money to a find account when ready. They may stay on the line while you log into your banking app. They may even have details about your account that make them sound legitimate. You move the money to the account number they give you, thinking you are protecting yourself.

Romance scams also use APP fraud as the final step. A scammer builds a relationship with you over weeks or months, gaining your trust. Then they create an emergency—a business problem, a medical bill, a travel cost—and ask you to send money. Because you trust them, you do. By the time you realise the relationship was fake, the money is gone and the account is closed.

Property purchase fraud is another variant. Someone impersonating a solicitor or conveyancer sends you an email with updated bank details for the deposit or completion payment. You send a large sum to what you believe is the law firm's account. The real solicitor only discovers the fraud when they contact you asking why they have not received the funds.

What happens after you report it

When you report APP fraud to your bank, the bank will usually ask for details: when you sent the money, to which account, and what made you think the request was legitimate. The bank will then contact the receiving bank and ask them to freeze the account and preserve evidence.

If the receiving bank complies and the money is still there, recovery is possible. The receiving bank may return the funds to your bank, which then returns them to you. This process typically takes two to eight weeks, though it can take longer if the receiving bank is overseas or if the account holder disputes the freeze.

If the money has already been moved out of the receiving account, recovery becomes much harder. The scammer may have instructed the account holder to send the money elsewhere, or the account holder may have already withdrawn it. At that point, your bank may offer a partial refund under their fraud reimbursement policy, but this is not may provide and depends on the bank's own terms and whether they believe they could have done more to prevent the fraud.

Some banks now offer a "pause" feature that delays outgoing payments by a few hours, giving you time to cancel if you realise you have been scammed. If your bank offers this, using it costs nothing and can be the difference between losing money and stopping the fraud before it completes.

Bank warnings and your responsibility to act on them

Many banks now show warnings when you make an unusual payment—for example, a large transfer to a new payee, or a payment to an account in a different country. The warning might ask you to confirm that you recognise the payee, or it might straightforward flag the transaction as unusual.

These warnings are designed to catch APP fraud, but they only work if you read them and act on them. If you ignore the warning and proceed with the payment, your bank may argue that you had a chance to stop and did not. This affects whether the bank will refund you later.

The law in some countries now requires banks to warn you about unusual payments and to ask you to confirm the payee's name matches the account holder. If the names do not match, the bank should ask you to verify before you proceed. But the bank is not liable if you ignore the warning and send the money anyway.

How to protect yourself from APP fraud

The strongest defence is to verify requests independently before you move money. If someone asks you to send money, do not use the contact details they provided. Instead, find the organisation's official phone number or website yourself and call or visit to confirm the request.

For example, if you receive an email claiming to be from your bank, do not click any links in the email. Open your banking app directly or go to the bank's website by typing the address yourself. Log in and check your account. If there is a message about fraud, it will be there. If there is no message, the email was fake.

If someone claims to be a solicitor or contractor, call the firm's main number (from your records or a directory) and ask to speak to that person. Do not use a phone number from the email or letter they sent you.

Be especially cautious of requests that create urgency: "You must move this money today", "This account will be closed in one hour", "Confirm this when ready or your account will be frozen". Legitimate organisations rarely demand when ready action without giving you time to verify.

If you are buying a property, confirm all payment instructions directly with your solicitor by phone before you send any money. If you receive an email with updated bank details, call your solicitor to verify before you act on it.

Frequently Asked Questions

Can my bank force the receiving bank to give the money back?

Your bank can request that the receiving bank freeze the account and return the funds, but the receiving bank is not legally obligated to comply. If the receiving bank is in a different country, the process is slower and less certain. If the money has already been moved out of the account, recovery is unlikely.

Will my bank refund me if I fall for APP fraud?

This depends on your bank's fraud policy and whether the bank believes it could have prevented the fraud. Some banks refund APP fraud victims automatically. Others refund only if the bank failed to warn you about the unusual payment. Many banks do not refund at all if you ignored a warning. Check your bank's terms or ask them directly.

What if the scammer used my name and details to open the receiving account?

This is identity fraud layered on top of APP fraud. Report it to your bank, the police, and the receiving bank. The receiving bank may close the account and cooperate with the investigation. You may also be may have access to to a refund because the receiving account was opened fraudulently, not legitimately.

How do I know if a payment warning from my bank is real?

If you see a warning in your banking app or on your bank's website after you log in yourself, it is real. If you receive a warning by email, text, or phone call, treat it as suspicious. Scammers sometimes send fake warnings to make you panic and move money. Never click a link in an unsolicited message. Log into your account directly to check.

Can I cancel a payment after I have sent it?

If you realise when ready that you have been scammed, contact your bank right away and ask them to recall the payment. Some banks can stop a payment within minutes of it being sent, especially if it is going to another bank. The sooner you act, the better your chances. After a few hours, most payments cannot be recalled.