What is authorised push payment fraud and am I protected?

Authorised push payment (APP) fraud is when you are tricked into sending money yourself to a criminal. Because you authorised the payment, it was historically treated very differently from fraud where money is taken without your consent — and that distinction left victims with nothing.

The common forms:

Impersonation fraud. A caller or message claims to be your bank, the police, HMRC or a utility, creates urgency, and tells you your account is compromised and you must move money to a "safe account". No genuine bank ever asks this.

Invoice and mandate fraud. Criminals intercept or spoof email correspondence — most damagingly during property purchases — and send altered bank details for a large payment. Conveyancing fraud has cost people entire house deposits.

Purchase scams, paying by bank transfer for goods that never arrive.

Romance and investment fraud, built over weeks or months.

CEO fraud, where an employee is instructed by a spoofed senior executive to make an urgent payment.

What protection exists. The position has strengthened considerably. In the UK, mandatory reimbursement rules introduced by the Payment Systems Regulator in October 2024 require sending and receiving firms to reimburse APP fraud victims for payments over Faster Payments and CHAPS, within a set time and up to a cap, sharing the cost between the two banks.

The exceptions matter. Reimbursement can be refused where the customer acted with gross negligence — a deliberately high bar, not merely being careless — and does not apply to some categories including international payments, or where the customer was complicit. Vulnerable customers receive additional protection.

Confirmation of Payee checks whether the account name matches before you send, and a mismatch warning should stop you.

Practical defences: never move money to a "safe account"; verify changed bank details by phoning a number you already had; and treat urgency itself as the warning sign.