What authorized push payment fraud is and why it works

Authorized push payment (APP) fraud is when a scammer tricks you into sending money directly from your bank account to an account they control—and your bank treats it as a legitimate transfer because you authorized it. Unlike a stolen credit card or hacked password, the fraud happens at the moment you give the instruction. Once the money leaves your account, it is gone, and recovery is slow and uncertain.

The scammer typically impersonates someone you trust: your bank, your employer, a government agency, a lawyer, a landlord, or a business you do regular work with. They create urgency (a tax bill due today, a security threat on your account, a time-sensitive job payment) and direct you to send money via bank transfer, wire, or a payment app. You complete the transaction yourself, which is why your bank's fraud filters often do not catch it.

The reason APP fraud is so effective is that it exploits the one thing banks cannot protect against: your own judgment under pressure. A stolen card number triggers fraud detection. A payment you authorized yourself does not.

Key Takeaways

  • APP fraud works because you authorize the payment yourself after being deceived about who is asking for it or why—your bank cannot stop what looks like a legitimate instruction from you.
  • The most common targets are people making large one-time payments: tax refunds, job deposits, rental payments, legal settlements, and business invoices.
  • Stopping APP fraud before it happens means verifying the person asking for money through a phone number or website you find yourself, not one they provide.
  • If you send money to a scammer, contact your bank within one hour and ask them to recall the payment; after that, recovery depends on whether the receiving bank cooperates and whether the money has already moved.
  • Your bank may not be required to refund APP fraud, depending on your country and the specific circumstances, so prevention is far more reliable than recovery.

How to verify a payment request before you send money

The core defense against APP fraud is independent verification: confirming the request through a channel the scammer does not control. If someone asks you to send money, do not use the contact information they provide. Instead, find the phone number or website yourself.

For a bank: Go to your bank's official website or the back of your debit card. Call that number and ask whether there is a fraud alert on your account. Do not call a number the message gave you.

For an employer: Contact your HR or payroll department directly using the company directory or a number you already have on file. Ask whether they requested a payment from you.

For a government agency (tax authority, court, benefits office): Visit the official government website for that agency and use the contact number listed there. Scammers often create fake websites that look identical to real ones, so type the URL yourself rather than clicking a link in an email or text.

For a business or contractor: If you are paying an invoice, call the business using a number from a previous invoice or their website. If you are paying a deposit for work, ask for a second form of contact (email, physical address) and verify it independently before sending anything.

Red flags that signal a payment request is fraudulent

Certain patterns appear in almost every APP fraud case. Learning to spot them gives you time to stop and verify before you transfer money.

Pressure and urgency: "You must pay today or your account will be closed." "The court filing deadline is in two hours." "We need this wire transfer immediately." Legitimate organizations almost never demand same-day payment via bank transfer for routine matters. If someone is pushing you to move fast, that is a signal to slow down and verify independently.

Unusual payment method: Your employer normally deposits your paycheck, but suddenly they are asking you to wire money to "activate" your account. Your tax authority normally sends a bill by mail, but an email is asking you to pay via bank transfer. Legitimate organizations use the payment methods they have always used with you.

Requests to keep the payment secret: "Do not tell anyone at the office about this payment." "Your bank may try to talk you out of this—ignore them." Real organizations do not ask you to hide transactions from your own bank or employer.

Generic greetings and poor grammar: "Dear Customer" instead of your name. Spelling errors or awkward phrasing. Official communications from banks and government agencies are usually proofread. A sloppy message is often a sign the sender is not who they claim to be.

Requests to use a specific payment app or method: "Send the money via Wise" or "Use this payment app." Scammers often specify a payment method because they know certain channels are harder to reverse. If the organization usually accepts multiple payment methods, the sudden insistence on one is suspicious.

What to do if you realize you have been scammed

If you discover within minutes or hours that you sent money to a scammer, your first step is to contact your bank immediately. Call the phone number on the back of your card or your bank's official website—do not use a number from the scam message.

Tell your bank: the amount you sent, the account number or name you sent it to, the time you sent it, and that you believe it was fraud. Ask your bank to recall the payment or reverse the transaction. Some banks can stop the money if it has not yet been withdrawn from the receiving account, which is why speed matters.

Your bank will likely ask you to file a fraud claim or dispute. This is a formal record that you did not authorize the payment (or that you authorized it under false pretenses). The exact name and process varies by bank, but the goal is the same: to document that the transaction was fraudulent.

After you file the claim, your bank will contact the receiving bank and ask them to freeze the account and return the money. This process typically takes 10 to 30 days. If the receiving bank cooperates and the money has not been moved, you may get it back. If the money has already been transferred to another account or withdrawn in cash, recovery becomes much harder.

Whether your bank is required to refund APP fraud

In the United States, banks are not legally required to refund APP fraud in most cases. The Electronic Funds Transfer Act (EFTA) protects you if someone else used your account without permission, but it does not cover payments you authorized yourself, even if you were deceived about who was asking for the money.

Some banks offer Regulation E protection or voluntary refund programs for APP fraud, but this is a business choice, not a legal requirement. A few banks have committed to refunding APP fraud under certain conditions (for example, if you can show you took reasonable steps to verify the request), but most have not.

In the United Kingdom and European Union, the rules are stricter. Banks are required to refund unauthorized payments and must share liability for APP fraud in some cases, though the exact rules depend on whether you were negligent. In Australia and Canada, protections vary by bank and by the specific circumstances.

The practical result is that prevention is far more reliable than recovery. Even if your bank eventually refunds the money, the process takes weeks or months, and there is no may provide. Stopping the fraud before you send the money is the only way to be certain you will not lose it.

Protecting yourself from APP fraud going forward

After you have been targeted by APP fraud once, scammers may try again because they know you are willing to send money. Here are concrete steps to reduce your risk:

Set up transaction alerts: Ask your bank to notify you of any transfer over a certain amount (for example, $500 or $1,000). If you receive an alert for a payment you did not make, you can contact your bank immediately.

Use a separate account for large payments: If you regularly make large transfers (rent, contractor payments, tax payments), consider keeping most of your money in a savings account and moving only what you need to your checking account before the payment. This limits the amount available to steal in a single fraud attempt.

Add a verification step to your payment routine: Before you authorize any transfer over a certain amount, call the recipient using a phone number you find yourself. Make it a rule, not an exception. This takes five minutes and stops most APP fraud.

Be skeptical of unsolicited contact: If someone contacts you asking for a payment, assume it is fraud until you verify it. Legitimate organizations usually contact you through channels you have already established with them.

Report the fraud to the authorities: In the United States, report APP fraud to the Federal Trade Commission (FTC) at reportfraud.ftc.gov. In the UK, report it to Action Fraud. In Australia, report it to the ACCC. These reports help law enforcement track fraud patterns and may lead to arrests.

Frequently Asked Questions

Can my bank force the receiving bank to return the money?

Your bank can request a recall, but the receiving bank is not legally required to comply in most cases. If the receiving bank cooperates and the money has not been withdrawn or transferred, recovery is possible. If the money has already moved, the receiving bank cannot recover it from a third party—your bank would have to pursue the scammer directly, which rarely happens.

What if the scammer used a fake name or a payment app to receive the money?

Payment apps like Venmo, PayPal, and Cash App require identity verification to withdraw money, so the scammer's real identity is eventually tied to the account. However, if they withdraw the money quickly or transfer it to a bank account in another country, tracing it becomes very difficult. This is why speed matters: the faster you report it, the better the chance the receiving bank can freeze the account before the money leaves.

If I was tricked into authorizing the payment, is that the same as unauthorized fraud?

Legally, no—in most jurisdictions, a payment you authorized is considered authorized, even if you were deceived. However, some banks and regulators distinguish between "unauthorized" (someone else used your account) and "fraudulent" (you authorized it under false pretenses). The distinction affects whether you are refunded, so ask your bank specifically whether they cover APP fraud or only unauthorized access.

Should I change my password or PIN after APP fraud?

Yes. If a scammer was able to trick you into sending money, they may also have other information about you (your account number, your phone number, your email). Changing your password and PIN makes it harder for them to access your account directly. Also enable two-factor authentication if your bank offers it.

Can I stop a wire transfer or ACH payment after I send it?

Wire transfers are nearly impossible to stop once sent—the money typically reaches the receiving bank within hours and can be withdrawn immediately. ACH transfers (used for most bank-to-bank payments in the US) take one to three business days to settle, so there is a small window to contact your bank and ask them to reverse it. The sooner you call, the better your chances. After the payment settles, reversal is much harder.