Technique

Authorized Push Payment Fraud

Also known as: APP Fraud, APP Scam, Push Payment Fraud, Bank Transfer Scam

EXPLOITATION

Authorized Push Payment (APP) fraud occurs when a fraudster uses social engineering to manipulate a victim into willingly initiating a real-time bank transfer to an attacker-controlled account. Because the victim themselves authorizes the transaction, it bypasses traditional fraud detection systems…

Common attack flows

How it fits in a scam

This technique shows up duringEXPLOITATION

Before

After

This is often where the scam ends.

Defense

How to defend against this

How to spot it

  • Uncharacteristic urgency: sender pressures you to transfer immediately
  • discouraging delay or consultation with others
  • Payment method insistence: request specifically demands real-time bank transfer
  • wire
  • or instant payment rather than reversible methods like credit card
  • New or changed payee details: invoice or payment instructions suddenly reference a different bank account than previously used
  • Unsolicited contact claiming authority: unexpected call/email from someone claiming to be your bank
  • police
  • or government agency asking you to move money to a safe account
  • Secrecy requests: sender asks you not to tell your bank
  • family
  • or friends about the transaction
  • Emotional manipulation: romantic partner or friend you have never met in person suddenly needs emergency funds
  • Too-good-to-be-true offers: investment opportunity promising unusually high returns with low risk
  • or product at a fraction of market price
  • Communication channel shift: counterparty insists on moving conversation off the original platform to direct messaging or phone

Tools you can use

Steps you can take

Seen in the wild

Where we’ve seen it

Commonly targets

Further reading