Picture a flagged payment. A customer starts a $40,000 transfer to an account they’ve never paid before. Monitoring catches it, and the bank sends a one-time passcode. The customer enters it correctly, on the first try, from their own phone. The payment goes out.
On paper, every control worked. The customer was who they said they were, and they approved the payment themselves. The money is still gone, because the person on the receiving end wasn’t who they said they were.
That’s authorized push payment fraud, or APP fraud: a scam where the real account holder is tricked into sending the money. It’s also the point where step-up authentication, one of the most trusted controls in the fraud stack, stops doing anything useful.
Authorized push payment fraud passes every identity check
Step-up authentication answers one question: is this really the account holder? For account takeover, that’s exactly the right question. If a criminal has stolen a password, a passcode sent to the customer’s real phone stops them cold.
In an APP scam, the answer to that question is yes. The person holding the phone is your customer. They know their password, they have their device, and they want the payment to go through. They’ve just been convinced that the person they’re paying is a business partner, a family member, a romance, or their own bank’s fraud department.
The Federal Reserve’s ScamClassifier model draws this exact line. It separates scams where a victim gave a criminal access to their account from scams where the victim made the payment themselves. Step-up authentication was built for the first kind. It has nothing to say about the second.
It can even make things worse. To a customer who has been deceived, a passcode from their own bank feels like the bank signing off on the payment. Scammers know this and plan for it. Some even coach victims on what to tell anyone who asks why they’re moving the money, which is why the FTC calls being told to lie about a large transfer a clear sign of a scam.
This is where the losses are heading
APP scams aren’t a niche problem. Consumers reported losing $15.9 billion to fraud in 2025, and bank payments were the payment method with the highest total losses, ahead of crypto, according to the FTC’s March 2026 testimony to Congress.
US fraud data isn’t broken out by APP fraud, but UK data is, and it’s a useful early signal. UK Finance’s Annual Fraud Report 2026 put APP fraud losses at £576.4 million in 2025, up 19% in a year, with case numbers at their highest level since comparable records began. Over the same period, losses from unauthorized fraud (criminals getting into accounts or using stolen cards) fell 5%. The losses are moving away from criminals breaking in and toward customers being talked into paying.
As faster payment rails spread in the US, the window to catch a bad payment after it leaves keeps shrinking. That puts even more weight on the decision made before the money moves.
Warnings and extra friction don’t stop a convinced customer
When step-up authentication doesn’t settle a flagged payment, most banks reach for one of two fallbacks.
The first is more friction: another warning screen, a confirmation checkbox, a short hold. The trouble is that a scam victim is, by definition, convinced. UK Finance makes this point about investment scams, the biggest APP category, in its 2026 report: once a victim believes the payee is genuine, they’ll likely send the money anyway, warnings or not. More friction mostly slows down your legitimate customers while the scammed one clicks through.
The second is a human reviewer, and this one genuinely works. A trained analyst who calls the customer and asks the right questions can catch what no passcode will. But it doesn’t scale. Flagged volume grows every quarter, and you can’t hire analysts as fast as payments move.
We’ve written before about how authorized fraud slips past traditional controls more broadly. Step-up authentication is the clearest example, because it’s the control most teams assume is covering them.
Verify the payee, not just the payer
If the customer isn’t the problem, checking the customer again won’t solve it. The question that actually resolves an APP scam is about the other side of the payment: does the receiving account really belong to the person or business your customer thinks they’re paying?
That’s a question a bank can answer without adding friction for the customer. It’s the question PayVerify was built around: verifying the recipient of a payment before it’s submitted to the network. It steps up to stronger checks only when something looks suspicious, rather than adding a step to every payment. When a payment is flagged, the bank gets a real answer about who is on the receiving end, instead of choosing between another passcode and another analyst.
The other place to stop an APP scam is before a payment exists at all. Most of these scams start with a message, not a transfer. Tools like KnowScam give customers a way to check a suspicious email or text, or confirm whether someone they met online is real, before they ever open their banking app.
The question to bring to your next fraud review
Pull last quarter’s confirmed scam losses and ask one question: how many of those payments passed step-up authentication?
If the answer is “most of them,” the control isn’t broken. It’s answering a question that was never in doubt. Your customer was always who they said they were. The question that mattered was who was waiting on the other end.
