Authorized push payment fraud happens when a scammer tricks you into sending money to an account they control, then vanishes
You receive a message, email, or call that appears to come from your bank, a government agency, or a company you trust. The sender creates urgency—a security threat, a tax problem, a payment due when ready. They walk you through sending money via wire transfer, ACH payment, or another method you control. You authorize the transfer yourself. The money reaches an account the scammer has set up, and by the time you realize what happened, the funds are gone or being moved through multiple accounts to hide the trail.
This is authorized push payment (APP) fraud, and it differs from other payment scams because you are the one who actually initiated the transfer. You pushed the money out. That matters legally and practically, because it changes who bears the loss and how fast you can recover it.
Key Takeaways
- Authorized push payment fraud tricks you into sending money yourself, rather than stealing your login credentials or card number.
- The scammer impersonates a trusted entity—your bank, the IRS, a utility company, or your employer—to create false urgency.
- Once the money leaves your account, recovery depends on how quickly you report it and whether the receiving bank can freeze the account before funds are withdrawn.
- Banks have no legal obligation to refund APP fraud in most U.S. states, though some institutions offer voluntary refund programs.
- The best defense is verification: call the organization directly using a number you find yourself, never one provided in the message.
How the scam unfolds: the four common scenarios
Tech support and security threats are the most frequent entry point. You see a pop-up on your computer, receive a call, or get a text claiming your device has been compromised or your account has suspicious activity. The caller or message directs you to a website (which looks real but is fake) or to your actual bank's website, where you log in while the scammer watches via remote access software or social engineering. They then convince you that you need to send money to "find" your account or "verify" your identity. You initiate the transfer from your own banking app.
Tax and government impersonation uses the same urgency. You receive a call claiming to be from the IRS, Social Security Administration, or your state tax authority. They say you owe back taxes, have unpaid fines, or face legal action. They direct you to send money when ready via wire transfer or gift card. Because the call feels official and the threat feels real, you comply.
Invoice and business payment fraud targets small business owners and employees with payment authority. A scammer sends an email that appears to come from your vendor, landlord, or a company you regularly pay. The email requests an urgent wire transfer for an invoice, rent payment, or payroll service. The email address is slightly off—one letter different, a different domain extension—but you do not catch it. You send the money to the account listed.
Romance and relationship scams build trust over weeks or months before requesting money. A scammer creates a fake profile, develops an emotional connection, and eventually asks you to send money for an emergency, travel, or investment. Because you believe you are helping someone you care about, you initiate the transfer yourself.
Why your bank may not refund the money
In the United States, Regulation E (which covers electronic fund transfers) and the Uniform Commercial Code place the burden of loss differently depending on whether you authorized the transaction. If you authorized it—even if you were tricked into doing so—the bank is generally not required to refund you. You, not the bank, made the decision to send the money.
This is different from credit card fraud or unauthorized wire transfers, where the bank may have liability. With APP fraud, you used your own credentials, your own device, and your own judgment to push the money out. The law assumes you are responsible for that decision.
Some banks and credit unions have begun offering voluntary refund programs for APP fraud victims, particularly if the receiving bank is also a participant in the same network. A few states have passed laws requiring banks to refund certain APP fraud losses, but these are exceptions. Before you open an account, you can ask whether the institution has an APP fraud refund policy, but do not assume one exists.
What to do when ready after you realize the fraud
The first 24 hours matter. Money moves fast through the banking system, and the longer you wait, the lower your chances of recovery.
Step 1: Stop and verify. If you are still on a call with someone claiming to be from your bank, hang up. Do not give them any more information. Call your bank directly using the number on your debit card or statement, not a number they provided.
Step 2: Report to your bank when ready. Tell them you sent money to a fraudulent account. Provide the account number, routing number, and amount. Ask them to contact the receiving bank and request a clawback—an attempt to reverse or freeze the transaction. Some banks can do this within hours if the receiving bank cooperates. If the money has already been withdrawn, a clawback will not work, but the receiving bank may still be able to identify the scammer.
Step 3: File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. This creates an official record and helps law enforcement track patterns. You will need the account details, the scammer's contact information, and any messages or recordings you have.
Step 4: File a report with the Federal Trade Commission (FTC) at reportfraud.ftc.gov. Like the IC3 report, this documents the fraud and contributes to aggregate data on scam trends.
Step 5: Check your credit. Request your free credit reports from annualcreditreport.com. If the scammer has your personal information, they may attempt identity theft. Monitoring your credit early can catch unauthorized accounts before they cause serious damage.
Recovery timelines and what to expect
If you report the fraud within 24 hours and the receiving bank freezes the account before the scammer withdraws the money, recovery can happen within days. The receiving bank will hold the funds pending investigation, and if they confirm fraud, the money may be returned to your bank, which then credits your account.
If the money has been withdrawn or transferred to another account, recovery becomes much harder. The scammer may have already moved the funds through multiple accounts, sometimes internationally. Law enforcement can investigate, but they prioritize cases involving large amounts or organized rings. A $500 or $1,000 loss, while painful, may not receive active investigation.
If your bank has a voluntary APP fraud refund program, they may cover the loss even if recovery is not possible. This process typically takes two to four weeks. If your bank does not have such a program, you may have no recourse beyond reporting the fraud to law enforcement.
How to recognize and avoid APP fraud before it happens
Verify independently. If someone contacts you claiming to be from your bank, utility company, or government agency, hang up or close the message. Find the organization's phone number yourself—on your statement, on their official website, or in the phone book. Call that number and ask whether the request is legitimate. Real organizations expect this and will not be offended.
Watch for urgency and threats. Scammers create pressure because it short-circuits your judgment. Legitimate organizations give you time to verify and respond. If someone is threatening legal action, account closure, or arrest if you do not act when ready, that is a red flag.
Never send money to verify your identity. Your bank already knows who you are. The IRS does not call people to demand when ready payment. Government agencies send official letters. If you are unsure, ask to receive written documentation before you send anything.
Check sender details carefully. If you receive an email, look at the full email address, not just the display name. Scammers use addresses like "payroll@companyname-find.com" or "irs-verification@taxservice.net" that look close to real but are slightly off. Hover over links before clicking to see where they actually go.
Use multi-factor authentication. If a scammer gains access to your email or banking app, they can change your password and lock you out. Multi-factor authentication (a code sent to your phone, a biometric scan, or a security key) makes this harder. Enable it on your email, banking apps, and any account that holds money or personal information.
Be skeptical of unsolicited contact. If you did not initiate the conversation, assume it may be fraudulent until you verify it. This applies to calls, texts, emails, and social media messages.
What happens to the scammer's account
When you report APP fraud, your bank contacts the receiving bank and provides details about the fraudulent account. The receiving bank freezes the account and begins its own investigation. If the account was opened with false information or stolen identity documents, the bank may close it and report the fraud to law enforcement.
Scammers often use accounts opened in other people's names or accounts at banks with weaker verification processes. Some accounts are opened with real documents but belong to money mules—people who were themselves scammed into allowing their accounts to be used to receive and forward stolen money.
If law enforcement identifies the scammer, they may face wire fraud charges (federal crime), identity theft charges, or money laundering charges. Prosecution depends on the amount, the jurisdiction, and whether the scammer is in the United States or abroad. International cases are much harder to prosecute.
Frequently Asked Questions
Can I get my money back if I authorized the transfer myself?
It depends on your bank and your state. Most banks have no legal obligation to refund APP fraud because you authorized the transaction. However, some banks offer voluntary refund programs, and a few states require refunds in certain situations. Contact your bank when ready and ask whether they have an APP fraud refund policy. Even if they do not, report the fraud so they can attempt a clawback before the money is withdrawn.
How long do I have to report the fraud?
Report it as soon as you realize it—ideally within 24 hours. The faster you report, the better the chance your bank can freeze the receiving account before the scammer withdraws the money. After 24 hours, the window for recovery shrinks significantly. There is no legal important date, but delay reduces your options.
What if the scammer used my name and information to open the account?
That is identity theft on top of APP fraud. Report it to the FTC at identitytheft.gov, which will create an Identity Theft Report. You can use this report to dispute fraudulent accounts, remove inquiries from your credit report, and place a fraud alert. You may also want to place a credit freeze, which prevents new accounts from being opened in your name without your permission.
Can the police help me recover the money?
Police can file a report and investigate if the amount is large or the scammer is part of an organized ring. However, local police often have limited resources for financial crimes. The FBI's IC3 and the FTC track these cases at a national level and may investigate if your case fits a pattern. For smaller amounts, law enforcement may not be able to help recover the money, but reporting still creates an official record.
What if I sent money to a scammer through a gift card?
Gift card fraud is harder to reverse than bank transfers because the scammer can redeem the card when ready. Report it to the gift card company and your bank right away. Some retailers will freeze the card if you report it before the scammer uses it, but once the balance is spent, recovery is unlikely. This is why scammers often request payment via gift card—it is nearly irreversible.