Common Fraud Patterns in Payments

Payment fraud takes many forms, but a few patterns account for most losses. Authorised push payment fraud happens when a customer is tricked into sending money to a criminal, often through a fake invoice, a romance scam, or an impersonation of a bank or a supplier. Because the customer authorised the payment, it is hard to recover, and banks have introduced confirmation of payee checks and warning messages to slow customers down before they send. Business email compromise is a variant where a criminal hacks or spoofs a supplier's email and changes the payment details on an invoice, so the company pays the criminal instead of the supplier. Both patterns exploit trust and urgency, and both are defeated more by process and awareness than by technology alone. Account takeover is another major pattern. A criminal gains access to a customer's online banking, often using stolen credentials from a data breach, and then moves money out quickly, sometimes changing the contact details first so the customer does not get the alerts. Banks fight this with device recognition, behavioural biometrics, and step up authentication when something looks unusual, such as a login from a new device or a new location. Card fraud, cheque fraud and first party fraud, where the customer themselves makes a false claim, are also common. Each pattern leaves different signals in the data, which is why fraud teams study typologies and share intelligence across the industry, so that a pattern seen at one bank can be blocked at another. The human side of fraud matters as much as the technical side. Many victims are embarrassed and slow to report, which gives criminals time to move the money on. Front line staff who handle the call from a fraud victim need clear procedures, empathy, and the authority to act quickly, including freezing accounts and starting recovery. For a BA, fraud requirements cover the full lifecycle. Prevention, detection, customer warning, reporting, recovery and reimbursement. In the United Kingdom, for example, reimbursement rules for authorised push payment fraud changed in 2024, making the sending bank responsible for refunding victims in most cases, which changed the business case for fraud prevention investment overnight. Regulations like that are a reminder that fraud work is never purely technical. Authorised push payment fraud is the fraud type that has grown fastest, and the case that illustrates it is simple. A customer receives an email that appears to be from their supplier, with a new bank account for the next invoice. The customer pays 25,000 pounds to the new account. The email was fake, the account belongs to a criminal, and the money is gone within minutes, moved through three more accounts and withdrawn as cash. The customer authorised the payment, so the bank did not block it, and the customer believed the instructions were genuine, so they did not question it. The fraud succeeds because it exploits trust, not technology. The UK reimbursement rules changed the economics of APP fraud on 7 October 2024. Under the Payment Systems Regulator rules, the sending bank and the receiving bank must reimburse the victim, splitting the cost equally, up to a maximum of 85,000 pounds, within five business days of the claim. The rules apply to Faster Payments and CHAPS, and they do not apply where the customer was grossly negligent, or where the payment was for an unlawful purpose. The rules changed the business case for fraud prevention overnight, because the bank that receives the fraudulent payment now shares the cost, and therefore has an incentive to detect it. Confirmation of Payee is the control that prevents most APP fraud. When a customer enters a payee name and account details, the bank checks whether they match, and tells the customer: match, close match, no match, or unavailable. A no match is a warning that the payee may not be who the customer thinks. The control is effective, but it is not perfect: a criminal who has opened an account in the victim's supplier's name will pass the check, because the name matches. The control must therefore be combined with transaction monitoring, with velocity checks, and with customer education, because no single control stops APP fraud.