The Detection Challenge
Authorised Push Payment (APP) fraud presents a fundamentally different detection challenge to most fraud typologies. Unlike unauthorised fraud — where a criminal exploits stolen credentials to initiate transactions the victim didn't authorise — APP fraud passes through every technical authentication gate successfully. The customer is real. Their credentials are valid. The payment instruction is genuine. The fraud is in the social engineering that preceded it.
This means that traditional fraud detection architectures built around identity verification and credential anomaly detection are largely blind to APP fraud. Effective detection requires a different approach: one that models the purpose and context of the payment, not just its technical legitimacy.
---
The Core Detection Problem: Legitimate Signals, Fraudulent Intent
APP scams work by manipulating the victim's mental model of the transaction. A romance scammer tells the victim they're sending money to a loved one abroad. An investment scammer convinces the victim they're funding a legitimate portfolio. An impersonation fraudster convinces the victim they're protecting their own account. In each case:
- The customer's authentication is valid
- The payment instruction matches the customer's stated intent
- The receiving account may be a newly opened legitimate account (a mule account) that has passed standard KYC
Detection therefore requires signals that operate around the technical transaction: how the customer behaved before initiating the payment, what the payee relationship looks like, and whether the transaction pattern is consistent with the stated purpose.
---
Detection Rule Categories
1. First-Party Payment Behaviour
New payee detection:
The most powerful single predictor of APP fraud is payment to a payee the customer has never transacted with before. First-time payee rules should trigger enhanced friction, not automatic decline. Parameters that increase risk:
- First transaction to this payee account number
- Payee name does not match any known contact in the customer's payment history
- Payee account was opened within the last 90 days (available through Confirmation of Payee in the UK, or similar bank-to-bank data sharing schemes)
Session behaviour anomalies:
How a customer navigates the payment flow prior to initiating a transaction reveals a great deal about the social engineering context. High-risk signals include:
- Unusual session length on the payment screen (lingering, repeated edits, or conversely, unusual speed)
- Session initiated from a device or IP that differs from the customer's established pattern
- Copy-paste of beneficiary account details (suggesting the account number was provided by a third party rather than typed from memory)
- Navigation path that includes unusual searches (e.g. searching for "HMRC payment", "investment transfer", "safe account")
Time and channel:
- Payments initiated outside the customer's established time-of-day patterns, particularly late evening
- Payments initiated via telephone banking or branch after a period of inbound calls from unverified numbers
- Payments to cryptocurrency exchanges or crypto wallets from non-crypto customers (common endpoint for investment and romance scam proceeds)
2. Transaction Characteristics
Amount thresholds by scam type:
Different APP scam typologies cluster in different amount ranges. Investment scams often start with smaller "test" amounts (USD 500-2,000) before escalating to larger transfers. Impersonation scams (police, bank) often trigger single large transfers (GBP 10,000-80,000 in the UK context). Rules calibrated to these distributions are more precise than blanket thresholds.
Round amounts:
Natural payments are rarely round numbers. A payment of exactly USD 50,000 or GBP 25,000 — particularly to a first-time payee — is a statistical outlier that warrants flagging.
Sequential small payments:
Investment scams frequently involve multiple incremental transfers as the victim "tops up" their supposed investment. A sequence of growing payments to the same payee over days or weeks is a high-precision indicator for this typology.
Urgency patterns:
Payments that are initiated rapidly after a customer service call (suggesting the call was used to manipulate the payment) or after an unusual inbound communication are statistically correlated with fraud.
3. Receiving Account (Mule) Signals
Where bank-to-bank data sharing is available (as in the UK through MACS and equivalent schemes), receiving account signals significantly improve detection:
- Account age: mule accounts used in APP fraud are frequently recently opened
- Prior receipt of flagged transfers: accounts that have received payments subsequently reported in SARs by other institutions
- Rapid debit following receipt: funds transiting through the account within hours
- Velocity: multiple inbound transfers from different sources to the same account in a short window
4. Customer Vulnerability Signals
Regulatory frameworks increasingly expect that APP fraud detection accounts for customer vulnerability — both to focus intervention resources and to meet duty-of-care expectations.
Indicators of elevated vulnerability:
- Age (older customers are disproportionately targeted by certain scam types)
- Recent significant life event: bereavement, divorce, job loss — often visible through changed spending patterns
- First large transfer of this type for this customer
- Customers who have previously reported fraud or who are in financial distress (elevated overdraft usage, missed payment patterns)
---
Intervention Design
Detection without effective intervention is insufficient. The goal is not to identify fraud after it happens but to interrupt it before funds leave the institution. Key intervention principles:
Risk-Tiered Friction
High-friction interventions (outbound callback, branch verification, mandatory delay) should be reserved for high-confidence fraud scores and large amounts. Universal friction creates customer friction that drives channel switching and trains customers to dismiss warnings as routine.
Effective friction tiers:
1. Informational warning (low-medium risk): Present a clear scam warning tailored to the apparent typology — "Payments to investment accounts you haven't used before are a common scam." Research consistently shows that tailored warnings outperform generic ones.
2. Confirmation with scam scenario prompts (medium risk): Ask the customer specific questions — "Are you making this payment because someone told you your account is at risk?" or "Has someone recently told you about an investment opportunity?"
3. Outbound callback (high risk): Initiate a proactive call to the customer on their registered number before releasing the payment. Script the conversation around confirming the customer's intent without coaching on how to pass the check.
4. Payment hold and investigation (very high risk): Delay the payment pending compliance review. Applicable in jurisdictions with mandatory reimbursement frameworks where the institution has shared liability.
Cooling-Off Periods
Introducing a mandatory delay for high-risk first-time payee payments — typically 24-48 hours — allows time for social engineering to break down. Victims who have "cooled off" from the emotional urgency induced by scammers frequently recognise the fraud themselves. UK Payment Systems Regulator guidance supports proportionate delay.
Mule Account Freeze Coordination
When a payment is suspected APP fraud, coordinating with the receiving institution to freeze the mule account is the highest-leverage recovery action. UK institutions participate in the Faster Payments Fraud Cycle, which enables same-day notification to the receiving PSP. Similar mechanisms are being developed in the EU under AMLA coordination.
---
Model Calibration Considerations
Machine learning models for APP fraud detection face specific challenges:
Label scarcity: Not all APP fraud is reported. Many victims don't realise they've been scammed for days or weeks, and many don't report to the bank when they do. Ground truth labels are therefore incomplete, requiring careful handling (semi-supervised or positive-unlabelled learning approaches).
Concept drift: Scam typologies evolve rapidly. A model trained on 2024 data may miss the specific patterns of 2026 scam campaigns. Regular retraining cadences (monthly or quarterly) are essential, supplemented by typology intelligence from industry sources.
False positive cost asymmetry: In markets with mandatory reimbursement frameworks, the cost of a missed fraud significantly exceeds the cost of a declined legitimate payment. This asymmetry should be reflected in model threshold calibration — lower precision may be acceptable to improve recall.
---
RiskLex and APP Fraud Intelligence
Staying ahead of APP fraud requires current intelligence on emerging scam campaigns, mule network structures, and regulatory expectations. RiskLex aggregates financial crime intelligence that directly informs fraud detection model calibration and compliance programme design. Contact us to learn how RiskLex supports APP fraud prevention teams.