Authorized push payment fraud is a scam in which someone deceives you into sending money from your own bank account to an account the criminal controls. Because you logged in and approved the transfer yourself, the payment is treated as authorized, and the consumer protections that cover stolen-card or hacked-account fraud largely do not apply. Reported losses to imposter scams alone reached $2.95 billion in 2024, and the FBI’s Internet Crime Complaint Center logged $16.6 billion in total cybercrime losses that year.1Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 20242Internet Crime Complaint Center. 2024 IC3 Annual Report
Why the Word “Authorized” Matters
In most bank fraud, a criminal gets hold of your card number or login and moves money without your knowledge. Federal rules call that an “unauthorized electronic fund transfer,” defined as one initiated by someone other than the account holder without actual authority.3eCFR. 12 CFR 1005.2 – Definitions Under Regulation E, your liability is capped at $50 if you report within two business days, and the bank absorbs the rest.4Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
APP fraud sidesteps that framework. You logged into your account. You typed the amount. You pressed send. The bank processed a legitimate payment instruction, and the fact that you were lied to about who was receiving it does not, under current U.S. law, make the bank responsible for reversing it.
There is one important line to know. The CFPB has said that if a scammer tricks you into handing over your account credentials and then the scammer logs in and moves the money, that transfer is unauthorized and Regulation E does apply.5Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs The question is who actually pressed the button. If the scammer did it with credentials they conned out of you, you have federal protection. If you did it yourself after being deceived, you generally do not.
The Scam Patterns to Recognize
APP scammers work with urgency, false authority, and emotional pressure. The scripts vary but the shape is familiar once you know what to look for.
Impersonation Scams
The most common tactic is pretending to be someone you trust. A caller says they are from your bank’s fraud department, your account has been compromised, and you need to move your money to a “safe account” right now. The urgency is the point: if you hang up and call the bank back on a number you look up yourself, the scam collapses.
Government impersonation works the same way. Someone claims to be from the IRS, the Social Security Administration, or law enforcement, and threatens arrest or legal action unless you pay immediately. Losses to government imposter scams hit $789 million in 2024.1Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024
Business Email Compromise
This one targets companies and accounted for $2.77 billion in reported losses in 2024.2Internet Crime Complaint Center. 2024 IC3 Annual Report A fraudster either breaks into a vendor’s email account or sets up a convincing lookalike address, then sends an invoice with “updated” bank details. Accounts payable processes it normally, and the money goes to the criminal instead of the real supplier. Because a real employee approved the payment through normal channels, the company usually has no recourse against its bank.
Investment and Purchase Scams
Investment fraud was the single costliest category reported to the FBI in 2024 at $6.57 billion.2Internet Crime Complaint Center. 2024 IC3 Annual Report Polished websites and fabricated track records convince victims to transfer money into fake trading platforms, and doctored account balances showing paper gains encourage them to send more. Purchase scams are simpler: an online seller advertises goods at an attractive price, pushes you to pay by direct bank transfer instead of credit card, and vanishes once the money lands.
Cryptocurrency Scams
Crypto adds a layer of finality that makes APP fraud even worse. Cryptocurrency payments are not reversible and carry no legal protections comparable to credit or debit card transactions.6Federal Trade Commission. What To Know About Cryptocurrency and Scams Crypto held in accounts is also not covered by government insurance the way bank deposits are protected by the FDIC. So-called “pig butchering” scams blend romance and investment fraud: the scammer spends weeks building trust, then steers the victim into a fake crypto platform. Once the funds hit a wallet the scammer controls, recovery is essentially impossible.
Romance Scams
Romance fraud runs on weeks or months of relationship-building before any money is discussed. The ask usually comes as a fabricated crisis: a medical emergency, a stranded traveler, a legal problem. The emotional investment makes the victim less likely to question it, and the voluntary payment makes it a textbook APP case. Losses tend to be large because the scammer keeps coming back for more.
AI Voice Cloning
Scammers now clone a family member’s voice from a few seconds of audio pulled off social media or voicemail. The FTC has warned that these cloned voices can sound convincing enough to impersonate a boss asking for account details or a relative claiming an emergency.7Federal Trade Commission. Fighting Back Against Harmful Voice Cloning The updated grandparent scam is the classic version: a frantic call claiming an arrest or injury, a demand for immediate payment by wire or gift card, and pressure not to tell anyone else. The shock is designed to override your judgment before you think to verify the story.
Why the Money Is So Hard to Recover
The heart of the problem is that U.S. law treats authorized transfers as your responsibility. No federal statute requires banks to reimburse customers who were tricked into sending a payment.
Regulation E’s protections apply only to transfers “initiated by a person other than the consumer without actual authority.”3eCFR. 12 CFR 1005.2 – Definitions If you initiated it yourself, even under false pretenses, the transfer sits outside the rule. Reg E also blocks banks from increasing your liability on genuinely unauthorized transfers based on your negligence, but that protection is beside the point when the transfer is classified as authorized to begin with.8Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers
Businesses face a different framework and a similar outcome. Wire transfers between companies are governed by Article 4A of the Uniform Commercial Code. A bank that follows “commercially reasonable” security procedures and accepts a payment order in good faith bears no refund obligation, even when the payment was induced by fraud.
What Reimbursement Actually Exists
Peer-to-peer apps like Zelle, Venmo, and Cash App have become preferred channels for APP scammers because transfers happen instantly and are hard to reverse. Under pressure from the CFPB and Congress, Zelle’s parent company, Early Warning Services, began reimbursing victims of qualifying imposter scams in mid-2023. The policy covers cases where a scammer impersonates a bank, government agency, or utility, and participating banks are required to refund affected customers. It still leaves out investment scams, romance scams, and purchase fraud.
By way of contrast, the UK made reimbursement mandatory for APP scam victims on its Faster Payments system as of October 7, 2024, with a cap of £85,000 per claim.9Payment Systems Regulator. PS24/7 Faster Payments APP Scams Reimbursement Requirement No comparable federal requirement exists in the United States, so whether you get anything back depends on your bank’s internal policies.
If your bank refuses to help, you can file a complaint with the Consumer Financial Protection Bureau. The CFPB forwards it to the bank, which generally has 15 days to respond (60 for complex cases).10Consumer Financial Protection Bureau. Learn How the Complaint Process Works The CFPB does not adjudicate your dispute or order the bank to reimburse you. It creates a formal record, and that record sometimes moves banks to resolve complaints they would otherwise ignore.11Consumer Financial Protection Bureau. Submit a Complaint
What to Do Right Now If You’ve Been Scammed
Speed is everything. Criminals begin moving stolen funds within minutes of receiving them, layering the money through multiple accounts to make tracing impossible. The order matters.
- Call your bank on the fraud number printed on your card or listed on its website. Tell them the transfer was made under fraudulent pretenses and ask them to attempt a recall. Give them the exact time, amount, and recipient. If they act fast enough, they may be able to freeze the receiving account.
- File a complaint at ic3.gov, the FBI’s central intake for cybercrime. For larger business losses, IC3’s Recovery Asset Team can sometimes intervene to freeze funds before they leave the banking system.12Internet Crime Complaint Center. Internet Crime Complaint Center
- Report the scam at ReportFraud.ftc.gov. This won’t recover your money, but it creates a formal record you may need later.13Federal Trade Commission. ReportFraud.ftc.gov
- Change passwords on your email and banking accounts, especially if the scammer had access to any of your communications. Turn on multi-factor authentication everywhere you have not already.
- Screenshot every message from the scammer. Save transaction confirmations, phone numbers, and email addresses. Your bank and any regulator reviewing the case will ask for it.
- Submit a formal written complaint through your bank’s official complaint process, separate from your initial fraud report. If the response is unsatisfactory, escalate to the CFPB.11Consumer Financial Protection Bureau. Submit a Complaint
How to Avoid Being the Next Victim
Most APP fraud works because the victim is caught off guard and acts before verifying. The single most effective defense is a personal rule: never send money or change payment details based on an inbound call, text, or email without independently confirming the request through a channel you already trust.
If someone claiming to be your bank calls about a security issue, hang up and call the number on your card. No legitimate bank will ask you to move money to a “safe account.” No government agency will demand immediate payment by wire transfer or threaten arrest over the phone. Treat those as absolute rules.
For businesses, the equivalent rule is verifying any change to vendor payment details through a known contact at the vendor, using contact information from your existing records rather than the email requesting the change. A two-minute phone call defeats most business email compromise schemes.
If you get an urgent call from a family member asking for money, the FTC recommends calling that person back at a number you already have for them. If you can’t reach them, contact another relative or friend to verify the story before sending anything.7Federal Trade Commission. Fighting Back Against Harmful Voice Cloning Cloned voices are convincing, but they cannot survive a callback to the real person.
Keep multi-factor authentication on all financial and email accounts. Review your bank transactions regularly. When making large online purchases, pay by credit card rather than direct bank transfer where you can, because credit card transactions come with chargeback rights that bank transfers do not.