Authorised Push Payment Fraud: Why UK Banks Now Share the Losses

Authorised push payment, or APP, fraud begins with a payment that looks legitimate to the bank because the customer approves it. The deception happens before the transfer: a criminal poses as a bank, a government body, a relative, a recruiter or a seller, and persuades the victim to send money to an account controlled by the fraudster.

That distinction has long made APP fraud difficult to address. The customer has authenticated the payment, often using normal security steps, while the fraudster has exploited trust rather than broken into the account. In the UK, reimbursement rules that took effect on 7 October 2024 changed the incentives around those losses, especially for the firms that receive the stolen funds.

A mandatory reimbursement model

The Payment Systems Regulator, or PSR, introduced mandatory reimbursement requirements for eligible APP fraud claims made through the payment systems covered by the regime. In broad terms, payment service providers must reimburse eligible victims up to £85,000. The framework includes conditions and limited exceptions, so it is not a guarantee that every disputed transfer will be repaid. Firms may assess whether a claim falls within scope and whether relevant customer standards were met, with additional protections intended for vulnerable consumers.

Its most consequential feature is the funding model. The cost of reimbursement is shared between the sending firm, where the victim held an account and initiated the payment, and the receiving firm, where the fraud proceeds arrived. This moves the response beyond a question of whether the sending bank warned its customer sufficiently. It also attaches a direct financial consequence to the quality of controls at the destination of the payment.

The policy is designed to encourage both sides of a transaction to prevent fraud and recover funds quickly. It also reflects a practical reality: a sending firm can see an unusual payment pattern, but the receiving firm may have the clearest view of whether an account is being used to collect and move criminal proceeds.

Why mule-account identity checks matter

The receiving account in an APP fraud case is often a mule account. A money mule is a person who allows an account to receive or transfer illicit funds, sometimes knowingly and sometimes after being recruited or manipulated. The account may be opened under a real identity, a stolen identity or a synthetic identity assembled from real and fabricated personal data.

For receiving banks and other payment firms, customer identification is therefore not only a compliance obligation. It is increasingly an economic control. Weaknesses in onboarding can allow mule accounts into the system, while weak monitoring can leave them active long enough to receive multiple victim payments. Under shared reimbursement, those weaknesses can create a share of the loss.

• Identity verification at account opening can help establish whether an applicant is genuine and whether the identity evidence is consistent with the person presenting it.
• Fraud controls also need to detect account behaviour associated with mule activity, such as rapid onward transfers, abrupt changes in use or links to known-risk accounts.
• Information sharing, timely account restrictions and effective recovery processes matter because stolen money can be dispersed across several accounts within minutes.

Identity verification is not a complete answer. A genuine customer can be recruited as a mule, and a correctly verified account can later be taken over. Banks must balance fraud prevention with fair access to payment accounts, avoid treating unusual but lawful activity as proof of wrongdoing, and provide workable routes for customers to challenge restrictions.

Warnings and payment-risk decisions

The UK approach sits alongside controls intended to interrupt a scam before funds leave the victim's account. Confirmation of Payee is the name-checking service used when a customer sets up or changes a payee. It compares the name entered by the payer with information held by the receiving institution and returns a match, close match or no match. A mismatch does not by itself establish fraud, but it can prompt the customer to pause or verify the details independently.

Banks also use transaction risk scoring, meaning automated and human assessments of signals surrounding a payment. Those signals may include an unfamiliar recipient, a large or atypical amount, device or session changes, and patterns associated with scam coercion. Depending on the risk, a firm may show a tailored warning, require additional checks, delay a payment where permitted, or intervene through a fraud specialist.

These systems must be judged on outcomes as well as coverage. Generic warnings can be ignored, and overly aggressive friction can delay legitimate payments or shift burdens onto customers. The shared-liability structure gives firms a stronger reason to improve detection without making an individual control, such as a name check, the sole test of responsibility.

The EU is moving toward payee verification

The European Union is taking a related, though not identical, direction through requirements associated with instant credit transfers. The emerging model requires payment service providers to offer verification of the payee, checking whether the recipient name corresponds with the International Bank Account Number, or IBAN, supplied by the payer. Implementation timing and operational details vary across countries and providers as the rules are phased in.

The comparison should not be overstated. The UK regime combines payee checking with a mandatory APP reimbursement framework and a defined allocation of reimbursement costs. EU payee verification is principally a measure to help a payer detect mismatched beneficiary details before sending funds. Both approaches nevertheless recognise the same problem: payment security depends on the identity and behaviour of the recipient, not only on the payer's authentication.

A shift in accountability

The UK rules do not eliminate APP fraud, and their effects will depend on claims handling, fraud intelligence and consistent implementation across the market. But they change who bears the immediate financial consequences. By requiring sending and receiving firms to share eligible losses, the framework turns mule-account prevention, identity assurance and receiving-side monitoring into central parts of payment-fraud economics.