Payment Fraud and Authorised Push Payment Scams

Payment authority, deception, prevention and financial remediation

Establish who initiated and authorised the transfer

Unauthorised payment fraud and customer-authorised scams require different factual and legal analysis. An attacker may initiate a payment using stolen access information. In an authorised push payment scam, the customer is deceived into making the transfer. Successful authentication is not sufficient evidence that every instruction was authorised or free from deception.

Investigate the actual action, authority and applicable product framework. False credit applications and merchant disputes can involve fraud but are not automatically the same as an unauthorised electronic transfer. Do not assign universal liability from a model score, authentication method or the word scam.

Different risks, coordinated controls

Authentication, session protection and entitlement controls address access and authority. Scam prevention also examines deception, payment context, receiving-account intelligence and customer intervention. A genuine device or matched payee name does not establish a trustworthy recipient or purpose.

Targeted warnings and appropriate independent contact can help. Delays or cooling periods need lawful authority, actual policy and customer handling; a mandatory 24-hour delay is not a universal requirement for every high-risk payment. Scammers may coach customers through warnings and waiting periods.

Separate models can be useful, but there is no universal requirement for exactly two models or two parallel engines. Rules, models, analysts and product controls should cover the actual risks and preserve joined evidence. Receiving-account controls and lawful information sharing also matter.

Payment rails and recovery

Card authorisation, clearing, settlement and chargebacks are different processes. 3-D Secure authentication or token use does not universally place all liability with one issuer or merchant; applicable rules and exceptions matter. Do not present one chargeback deadline as valid for every reason, product and network.

Account-to-account payment finality does not mean no recovery request, return or customer remedy can ever exist. Cancellation, return, recall and reimbursement have different purposes and conditions. SWIFT is messaging infrastructure, not proof that the funds followed one mandatory correspondent path.

Use the original payment references and authoritative status before requesting or booking remediation. A requested return is not received money. Finance should distinguish gross loss, recoveries, customer reimbursement, inter-firm claims and outstanding balances.

Scoped reimbursement examples

The UK PSR consumer guidance describes in-scope APP protections for Faster Payments and CHAPS from 7 October 2024. Eligible individuals, microenterprises and charities have a mandatory limit of £85,000 per claim, subject to scope and permitted exceptions. An optional excess can be up to £100, with protections for vulnerable consumers. Reporting should be prompt and within 13 months. Reimbursement is usually within five business days, with permitted pauses and an overall 35-business-day outcome limit. This is not protection for every transfer worldwide.

For US electronic transfers, the CFPB Regulation E FAQs distinguish fraudster-initiated transfers using access information obtained through deception from transfers actually initiated by the consumer. Evaluate the applicable law and facts rather than treating both categories identically.

The European Parliament's payment-services legislative record tracks the PSD3/PSR package. Negotiated texts, adoption and application dates are different milestones. Do not infer an already-effective UK-style general APP scheme from a political agreement.

Fictional example: safe-account scam

A customer reports transferring funds after a caller impersonated bank staff. The bank records the actual payment, warning history and scam account, contacts appropriate parties for recovery and assesses claim rights without promising guaranteed return.

Customer support and financial claims remain separate from the receiving-account investigation. Reimbursement decisions can provide evidence for model review, but do not automatically create a perfect fraud label for every training purpose.

Takeaway

Classify authority from evidence, use controls appropriate to deception and compromise, and apply actual rail and customer-rights rules. Resolution needs implemented financial effects and clear updates.