Scope
This guide focuses on fraud detection controls for cases where consumers are manipulated into making authorized payments. It covers social engineering tactics used in authorized push payment (APP) fraud, detection architecture for schemes originating on social media, and the reimbursement gap that makes prevention essential.
Use this guide when designing transaction monitoring rules, building consumer education programs, or investigating cases where the payment authorization wasn't compromised, but the consumer was.
Key Concepts and Definitions
Authorized Push Payment (APP) Fraud: The consumer initiates a legitimate payment to an account controlled by a fraudster. The payment system functions correctly; the manipulation occurs before the consumer enters credentials.
Social Engineering: Psychological manipulation exploiting trust, urgency, or authority to bypass technical controls. The attacker doesn't need to steal credentials if they can convince you to willingly hand over the money.
Purchase Scam: A fraudulent offer for goods or services, typically advertised on social media. Payment is collected, but the product never arrives.
Investment Scam: A false investment opportunity promising high returns, often involving non-existent cryptocurrency platforms or forex trading schemes.
Romance Scam: Long-term relationship fraud where the attacker builds an emotional connection before requesting financial assistance.
The Detection Problem
Traditional fraud controls focus on unauthorized access, flagging stolen credentials or unusual device use. These don't trigger when the consumer initiates the payment using their own device from their own location.
In the UK, £629.3 million was stolen in the first half of the year through fraud schemes, a 3% increase year-over-year. Over 2 million fraud cases were reported through Q2, a 17% rise. Most originated online, with social media as the primary channel.
Here's the reimbursement gap: 98% of victims whose credentials were stolen receive reimbursement. When consumers are tricked into authorizing the payment themselves, only 62% are reimbursed. LSEG Risk Intelligence projects global APP fraud losses could reach $331 billion by 2027.
You're dealing with a threat where the payment authorization is genuine, but the context is fraudulent.
Detection Architecture
Behavioral Deviation Monitoring
Track payment patterns at the account level. Look for transactions that deviate from established behavior:
- First-time payee when the customer typically pays recurring billers
- Payment amount significantly above the historical average
- Rapid sequence of payments to different accounts
- Payment immediately following an account credential change
- Transaction initiated during unusual hours for that customer
Don't rely solely on velocity rules. A romance scam might involve a single £6,500 payment after months of relationship building. UK data shows romance scam victims lost an average of £6,500 per incident, these aren't small, repeating transactions your velocity rules will catch.
Payee Account Analysis
Examine the receiving account's characteristics:
- Account age (newly opened accounts receive higher scrutiny)
- Incoming payment patterns (multiple small payments from different sources suggest money mule activity)
- Rapid withdrawal behavior after deposit
- Account registered to high-risk jurisdiction
- Mismatch between account name and typical payee names for this customer
Social Media Link Detection
Purchase scams often originate from social media posts. You can't monitor social platforms directly, but you can instrument your payment flow:
- Capture referrer data when a customer lands on the payment page
- Track payment description fields for social media platform names
- Monitor for payment amounts matching advertised prices in known scam campaigns
- Flag transactions where the merchant has no established web presence outside social media
Communication Pattern Flags
Social engineering relies on urgency and pressure. Look for:
- Payment initiated within minutes of a password reset or contact detail change
- Customer service calls immediately preceding a high-value transfer
- Multiple failed authentication attempts followed by a successful payment
- Payment to a new payee with expedited processing requested
Implementation Guidance
Rule Calibration
Start with observation mode. Tag transactions that match your detection criteria but don't block them initially. Measure false positive rates against genuine fraud.
For APP fraud, expect higher false positive rates than credential theft cases. A consumer buying a car from a private seller looks identical to a consumer sending money to a purchase scam, until the car doesn't arrive.
Set your initial intervention point at customer notification, not transaction blocking. Send an SMS or app notification: "You're about to send £3,000 to a new payee. This matches patterns we see in purchase scams. Confirm this is legitimate."
Reimbursement Decision Framework
Document your reimbursement criteria before fraud occurs. You need consistent standards for determining liability.
Consider these factors:
- Did the customer ignore explicit fraud warnings during the payment flow?
- Was the receiving account flagged in your fraud database?
- Did the customer conduct reasonable verification (searched company name, checked reviews)?
- Was the payment amount consistent with the claimed transaction?
The 62% reimbursement rate in UK APP fraud cases suggests inconsistent standards across institutions. Your fraud operations team needs clear guidance on what constitutes reasonable consumer behavior versus negligence.
Consumer Education Touchpoints
Build fraud warnings into your payment interface:
- First payment to a new payee: display a warning banner with common scam indicators
- High-value transfer: require secondary confirmation with fraud education content
- Payment to an individual (not a business): highlight romance and investment scam risks
- Payment description contains investment terms: show regulatory warnings
Don't rely on generic "be careful" messaging. Reference specific scam types and tactics: "Investment scams often promise guaranteed returns. Legitimate investments carry risk."
Common Pitfalls
Over-reliance on amount thresholds: Purchase scams averaged £300 per victim in UK data. Your high-value transaction monitoring won't catch these.
Ignoring payee-side signals: You're monitoring the sender's behavior but not analyzing the recipient account. Money mule accounts show distinctive patterns, multiple inbound payments followed by rapid withdrawal or transfer.
Treating APP fraud as low priority: The reimbursement gap means your institution absorbs these losses when you do reimburse and faces reputation damage when you don't. This isn't a minor fraud category.
Blocking without education: If you block a suspicious transaction without explaining why, the customer will retry through a different channel. Use the intervention moment to educate.
Separating fraud detection from customer service: Your contact center receives calls from customers who've been victimized but haven't realized it yet. Train representatives to recognize social engineering indicators and flag accounts for fraud review.
Quick Reference Table
| Fraud Type | Primary Channel | Avg. Loss (UK) | Detection Signal | Intervention Point |
|---|---|---|---|---|
| Purchase Scam | Social Media | £300 | New payee + social referrer | Pre-authorization warning |
| Investment Scam | Email/Social | High variance | Investment terms in description | Mandatory education content |
| Romance Scam | Dating Apps/Social | £6,500 | Large payment to individual after messaging pattern | Secondary authentication + warning |
| Impersonation | Phone/Email | Varies | Payment after credential change | Contact verification required |
Reimbursement Rate Baseline: 62% for APP fraud vs. 98% for credential theft (UK Finance data). Your prevention controls must account for this liability gap.
Global Projection: $331 billion in APP fraud losses by 2027 (LSEG Risk Intelligence). This threat category is growing faster than traditional payment fraud.
