Authorized push payment fraud is difficult because the customer may approve the payment while acting under a scammer’s influence. This checklist gives fraud teams, banking risk leaders, and analysts a practical way to think about APP fraud signals before and after money moves.
This resource supports EdEconomy’s banking fraud resource hub and the full analysis in Authorized Push Payment Fraud: Why Banks Struggle to Stop APP Scams.
1. Sender-Side Behavior Signals
- First-time payee or newly changed beneficiary details.
- Payment amount is unusual for the customer, account age, or historical pattern.
- Rapid sequence of smaller payments below review thresholds.
- Recent password reset, device enrollment, phone number change, or profile update.
- Long payment session, repeated screen revisits, or behavior that suggests coaching.
- Customer appears nervous, evasive, rushed, or reluctant to explain payment purpose.
2. Recipient and Mule Account Signals
- Recipient account is newly opened or recently reactivated.
- Inbound payments arrive from unrelated senders.
- Funds drain quickly after receipt through cash withdrawal, crypto, wires, or onward transfers.
- Recipient details connect to prior scam claims, suspicious devices, synthetic identity indicators, or mule networks.
- Beneficiary name, account history, or payment purpose does not match the stated transaction.
3. Scam Story Signals
- Safe-account transfer: someone claims money must be moved to protect it.
- Fake bank employee or government impersonation.
- Investment, crypto, romance, marketplace, tech support, or family emergency pressure.
- Customer is told the transaction is urgent, confidential, or must not be discussed with the bank.
- Customer repeats scripted language or says someone told them what to tell the bank.
4. Payment Journey Controls
- Use scam-specific warnings instead of generic are-you-sure prompts.
- Ask direct questions: has anyone told you to move money to a safe account, keep this secret, or lie about the purpose?
- Apply risk-based friction for first-time payees, unusual payments, high-risk recipient patterns, and recent account changes.
- Escalate high-risk APP signals to trained staff before releasing funds where policy allows.
5. Case Intake Questions
- Who instructed the customer to make the payment?
- How did the conversation start: phone, text, email, social media, marketplace, or messaging app?
- Was the customer told to hide the transaction from the bank or family?
- Was remote access software, screen sharing, crypto, gift cards, or a new payee involved?
- Did the customer receive a warning, and what did they say before proceeding?
How to Use This Checklist
No single signal proves APP fraud. The value comes from combining sender behavior, recipient account context, scam narrative, device/session activity, and payment timing into a risk view analysts can explain.
For more context, read the full APP fraud analysis, explore the banking fraud resource hub, or subscribe to the EdEconomy newsletter.
