Fraud is becoming less obvious. Criminals are finding new ways to convince people to make payments, which is called authorised push payment (APP) fraud.
We’ll take you through what APP fraud is, some red flags to look out for, how to prevent it, and what you can do if it happens to you.
What could an APP scam look like?
A business owner was purchasing a property and was expecting to receive an email from their solicitor asking for payment as they were ready to exchange. They received an email which appeared to be from their solicitor, which instructed them to pay the funds to a specific account. They paid £1 million, and then a few days later received a call from the legitimate solicitor asking for the payment.
The business owner didn’t know that their email had previously been compromised, which meant the fraudster could monitor their activity and take advantage at the right time.
By the time they realised they had been defrauded, the funds had been moved on and couldn't be recovered.
What is authorised push payment fraud?
Authorised push payment fraud happens when a criminal tricks someone into sending them money. Because the payment has been approved, it can initially look like a genuine transaction to your bank.
APP fraud is a big problem. According to UK Finance’s Annual Fraud Report 2026, £576.4 million was lost to APP fraud in 2025, up 19% from the previous year.
There are lots of different APP schemes, but two of the most common are bank impersonation and invoice redirection.
Bank impersonation is when someone claims to work for your bank and tells you your account or money is at risk, then asks you to make a payment.
Invoice redirection is when someone pretends to be one of your real suppliers, and tell you their bank details have changed. You think you’re paying a real invoice, but your money ends up in the fraudster’s account instead.
Other examples include investment, CEO, romance and advance-fee scams. While the story is different, the method is the same: creating a convincing reason for you to send money voluntarily.
Red flags to look out for
If you get an unexpected payment request or security call, think twice. Especially if:
- Bank details or payment instructions suddenly change.
- The sender’s email address or domain is slightly different from the one you recognise.
- An invoice arrives at an unusual time or doesn’t follow the supplier’s normal billing pattern.
- The account name is unfamiliar or doesn’t match the supplier.
- Someone tells you to pay immediately, keep it a secret, or ignore your usual approval processes.
- You’re asked to move money to ‘keep it safe’ or approve a ‘refund’.
- Someone asks for your PIN, password, passcode or one-time password.
- Someone tries to stop you hanging up or checking their request independently.
When you get the request matters too. Criminals may target people later in the day, at weekends or during busy times like year-end or the festive period, when it can be harder to stop and check if the request is real.
If you have been a victim of fraud, contact your bank straight away. The sooner you act, the better the chance of limiting your loss, although there’s no guarantee that money lost to fraud can be recovered.
A quick check could protect your business
APP fraud works when a convincing story leads to a rushed decision. If someone asks you to send money, give them access to your account, or share a security code, stop and check.
Just hang up. Then contact the person or business independently and ask a colleague to take a look. Always call on a trusted number to confirm the details before making a payment.
Know what to do next
Spotting the signs early is the first step. You can read more about how to protect your business from APP fraud here:
Worried about fraud?
Visit our Fraud Centre for immediate help and further advice.
