Authorized Push Payment fraud refers to scams that trick victims into authorizing a payment to a fraudulent account. The fraudster uses social engineering and convincing tactics to manipulate and deceive their targets (often achieved by posing as trusted individuals or businesses). The victim, who acts in good faith, voluntarily sends money of their own volition.

Since the account or cardholder initiates the transfer, the money is “pushed” (rather than “pulled” like when a hacker drains account funds). The transfer, coming from the authorized user, appears legitimate. That makes APP fraud particularly difficult in terms of fund recovery.

While APP scams often focus on consumers, merchants and businesses are not immune. Employees might believe they are working with a known supplier and send over sensitive information. Service reps might not catch compromised customer accounts. Some fraudsters may even pose as clients to backdoor a company’s systems. Companies that do not prepare adequate defenses can be exposed to unwanted risk.

APP fraud is sequential. The schemes start with innocent-looking connection requests that build into trust. But over time, the relationship is leveraged for legitimate-looking payment requests designed to deceive. Without consideration of this broader transaction context, the insidious actions often go undetected—until it is too late.

What should businesses look for when it comes to APP fraud? In short, any actions that depict a criminal acting as a client or employee. Here are some common signs:

• Incorrect billing info:: Note any slight modifications, discrepancies, multiple accounts, mismatched details, or wrong numbers on all accounting and transaction data.
  
  
• Unusual payment actions:Look for large or irregular amounts with all outflows. That can look like fast checkouts, first-time purchases from a new account, high-value item sales with a history of low-cost purchases, multiple unit purchases for the same high-demand item, or shipments to different addresses. The same goes for payment or transfer attempts made by varied devices, novel payment methods, foreign accounts, etc.
  
  
• Suspicious communication: Impersonators must first build a relationship with the targeted victim to enact their schemes, and they often make initial contact through standard channels. So random vendor requests, unexpected emails, strange language, incorrect grammar, or odd documentation all hint at a scam or phishing attempt.
  
  
• Strange stakeholder behavior: Look for out-of-character actions from all third-party providers, employees, or stakeholders. Unexpected urgency, a penchant to avoid verifications, attempts at workarounds, location changes, out-of-hours requests, etc all count.