APP fraud can survive successful authentication because confirming who controlled an account does not necessarily establish why a payment was made. A customer may authenticate and authorise a transaction while a fraudster, through deception or social engineering, has materially shaped the decision behind it. Effective investigation must therefore look beyond authentication to reconstruct payment intent, test competing explanations and determine what the available evidence actually establishes.
KEY POINTS
Successful authentication is evidence about an authentication process. It does not, by itself, establish that the customer's decision to make the payment was free from deception.
APP fraud and account takeover require different but sometimes overlapping investigative questions. Account takeover asks who controlled the account or session; APP fraud also requires investigators to establish how deception shaped the customer's decision to pay.
Strong customer authentication remains an important control. European evidence nevertheless shows increasing manipulation of payers, demonstrating how criminal methodology can migrate towards the authenticated customer rather than necessarily defeating authentication technically.
APP fraud detection should combine customer behaviour, transaction chronology, authentication and session evidence, intervention records, beneficiary intelligence and subsequent funds movement. No single indicator establishes that a customer is being deceived.
Fraud Intelligence Lab proposes three analytical models for this problem: the Payment Intent Reconstruction Model, the APP Fraud Hypothesis Matrix, and the Fraud Chronology and Control-Visibility Model. Together, they address three practitioner questions: what happened, which explanation best fits the evidence, and what the institution could reasonably have known before the loss occurred.
From Payment to Prosecution: A Structured Approach to Evidence, Analysis and Outcomes
Source: Fraud Intelligence Lab original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
Introduction
Authorised payment fraud creates a difficult evidential problem for financial institutions. In an unauthorised transaction, the investigation may begin by determining whether somebody other than the legitimate customer obtained control of an account, payment instrument or authenticated session. In authorised push payment (APP) fraud, the customer may retain effective control of the payment account throughout. The device can be familiar, the credentials genuine, authentication successful and the payment instruction technically valid. The decisive deception may have occurred earlier, when manipulation altered the customer's understanding of who was being paid, why the payment was necessary or what would happen to the money.
That distinction becomes more important as authentication controls improve. The European Banking Authority (EBA) and European Central Bank (ECB) reported in December 2025 that strong customer authentication (SCA) remained effective against the fraud types it was designed to mitigate, particularly card fraud, while manipulation of payers was becoming a more significant threat requiring additional mitigation. Total EEA payment fraud reached €4.2 billion in 2024, although the overall fraud rate remained around 0.002% of transaction value.
The investigative implication is more demanding than deciding whether authentication succeeded. A financial institution needs to distinguish authentication evidence from evidence concerning the decision that produced the payment. This article uses payment intent as a Fraud Intelligence Lab analytical concept: the customer's contemporaneous understanding of the purpose, destination and expected outcome of a payment. It is not presented as a harmonised legal test across the United Kingdom, European Union and United States.
Payment intent, as used here, does not ask merely whether the customer intended to press “send”. It asks whether the customer's understanding of the payment's purpose, beneficiary and expected consequence was materially shaped by deception. That distinction matters because an APP victim can deliberately create a beneficiary, enter an amount and authenticate a transfer while acting on a false understanding deliberately constructed by somebody else.
The central proposition is therefore that authentication can establish participation in a payment process without establishing the integrity of the decision that produced the payment. APP fraud investigation requires practitioners to reconstruct deception, belief formation, customer behaviour, account control, authentication, beneficiary characteristics and subsequent movement of value as parts of the same evidential problem.
APP Fraud Is a Decision-Manipulation Problem
The FCA describes APP fraud as involving customers being tricked into sending money to a fraudster through a bank transfer that the customer authorises. It distinguishes this from unauthorised fraud, where money is taken or a payment is made without the customer's authorisation.
That distinction changes where investigators should look for evidence. In classic account takeover, a criminal may seek credentials, compromise a device, steal a session or otherwise assume control of the account. In classic APP fraud, the criminal may not need to compromise the payment mechanism at all. The objective can instead be to manipulate the person whom the mechanism is designed to authenticate.
An impersonation scam may persuade a customer that funds must be moved to a supposedly secure account. An investment scam may construct a convincing but false economic purpose for repeated transfers. Business email compromise may insert fraudulent beneficiary instructions into a genuine commercial relationship. In each example, a legitimate customer can deliberately make a payment while operating on information deliberately corrupted by a criminal.
This produces an important evidential distinction. Device recognition, password validation, biometric authentication or a one-time passcode may materially support the conclusion that the customer participated in authentication. They do not independently establish that the customer correctly understood the beneficiary's identity, the economic purpose of the transaction or the circumstances surrounding the request.
Successful authentication can establish who completed a process. It does not necessarily establish how the decision to complete that process was formed.
For fraud investigators and control owners, the transaction should therefore not automatically be treated as the beginning of the fraud event. In many APP cases, it is the financial consequence of an earlier sequence of manipulation.
Authentication Evidence Is Not Payment-Intent Evidence
Separating authentication from payment intent should not be interpreted as an argument that authentication has failed. That would misstate the evidence.
The EBA and ECB reported that the 2024 EEA payment-fraud rate remained around 0.002% of total transaction value, while the total value of fraud increased from €3.5 billion in 2023 to €4.2 billion in 2024. Their assessment concluded that SCA remained effective against the fraud types it was designed to mitigate but warned that new forms of fraud, particularly payer manipulation, required additional approaches. Earlier EBA/ECB evidence had similarly found lower fraud rates for SCA-authenticated transactions, particularly card payments.
Those findings are compatible. A control can remain effective against one threat while criminal behaviour migrates towards another vulnerability. Where credentials are harder to steal and unauthorised transactions harder to execute, manipulating the authenticated customer can become comparatively attractive.
The control lesson is therefore not that authentication has become ineffective. It is that authentication controls and payer-manipulation controls address different failure modes.
An investigator should consequently avoid reasoning backwards from a successful authentication event to a conclusion about the legitimacy of the underlying decision. Authentication records should form one evidential domain alongside customer communications, transaction chronology, behavioural history, beneficiary information, device and session evidence, intervention records and subsequent funds movement. Where the question is who controlled the authenticated session rather than why the customer authorised a payment, the investigation moves into the distinct attribution problem presented by account takeover fraud.
A successful authentication event may help answer whether the prescribed authentication process occurred. It does not necessarily explain why the customer initiated the payment, whom the customer believed they were paying, what the customer believed would happen to the money or whether those beliefs were produced by deception.
This distinction becomes more complex when payment decisions or execution are delegated to an AI agent. In that environment, investigators may need to separate the customer's original intent from the authority delegated to the agent, the agent's subsequent decision and the transaction ultimately executed. Successful authentication may establish that a recognised payment process occurred without resolving whether the agent's action remained within the mandate originally given by the customer. Fraud Intelligence Lab examines this emerging problem in When AI Agents Move Money: Investigating Authority, Intent and Fraud in Agentic Payments.
Those are investigative questions rather than authentication questions.
F.I.L. Model 1 — Payment Intent Reconstruction
Model 1. F.I.L. Payment Intent Reconstruction Model. An original analytical framework for reconstructing decision formation, payment execution and subsequent movement of value.
Source: Fraud Intelligence Lab original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
The model changes the unit of analysis. Instead of beginning with the payment and asking whether it appears unusual, the investigator reconstructs both the decision that produced the payment and the movement of value that followed it.
The first zone, Decision Formation, examines how the customer was contacted, which representations were made, what the customer came to believe and how that belief produced an intention to transfer value. The purpose is not to infer the customer's state of mind from the transaction alone. It is to reconstruct the decision from customer testimony, communications, contemporaneous records and other available evidence.
The second zone, Payment Control and Execution, determines who controlled the account and session, who created the beneficiary, who constructed the payment instruction and how authentication occurred. This zone is particularly important when distinguishing payer manipulation from account takeover or a hybrid compromise.
The third zone, Value Destination, follows the payment beyond execution. It examines the beneficiary account, receipt behaviour, onward dispersal, connected accounts and relevant network intelligence. This creates an opportunity to test the victim-side narrative against evidence from the destination of the funds.
The horizontal evidential layer is what turns the sequence into an investigative model rather than a fraud lifecycle diagram. Evidence within each zone should be assessed according to whether it corroborates the working hypothesis, contradicts it or leaves a material gap. An investigator should therefore be able to identify not only what the evidence shows, but where the case still depends on inference.
A customer transferring £20,000 to a new beneficiary may justify intervention, but value and beneficiary novelty do not establish deception. A property purchase, investment, family transfer or legitimate business transaction can produce comparable characteristics. Conversely, a payment resembling previous legitimate activity may still result from fraud where a criminal has constructed a sufficiently plausible context.
The analytical objective is not to accumulate suspicious characteristics until they resemble proof. It is to determine whether the combined evidence supports the deception hypothesis more strongly than credible alternatives.
Reconstructing Payment Intent in Practice
Establish the Customer's Contemporaneous Understanding
The first investigative task is to establish what the customer believed at the time of payment rather than relying exclusively on a retrospective description after the loss became apparent. Relevant evidence can include messages, emails, call records, invoices, websites, payment references, supposed investment dashboards, beneficiary information and notes from interactions with the financial institution.
The investigator should identify three elements in particular: who the customer believed the counterparty to be, why the customer believed the payment was necessary, and what outcome the customer expected after payment. These propositions convert a broad allegation of “being scammed” into factual claims capable of corroboration or refutation.
Retrospective accounts require ordinary evidential caution. Memory can be incomplete, embarrassment may affect initial disclosure, and a victim may not immediately recognise which interaction was significant. Those limitations do not establish that the account is unreliable. They mean that the narrative should be tested against contemporaneous records and independent evidence wherever possible.
Separate Customer Control From Criminal Influence
The next task is to establish who controlled the account and authenticated session. If the customer personally created the beneficiary, initiated the transfer and completed authentication, the evidence may support an authorised-payment hypothesis. If records instead indicate stolen credentials, attacker-controlled access or a criminal initiating transactions, an account-takeover or other unauthorised-payment hypothesis may be more appropriate.
The distinction should not be reduced to whether valid credentials were used. Valid credentials can be used by somebody other than the legitimate customer, while a legitimate customer can use valid credentials in circumstances created by deception. Investigators therefore need to establish the relationship between identity, session control, payment initiation and customer action rather than treating authentication as a proxy for all four.
Account takeover asks who controlled the account or session. APP fraud investigation asks how deception shaped the customer's decision to pay.
Classification should follow the evidence rather than the first fraud code assigned to the case.
Hybrid Cases: When Social Engineering Becomes Account Compromise
Not every case remains within a single fraud classification. A customer may initially be deceived into disclosing a one-time passcode, approving a new device, installing remote-access software or completing an authentication request. The criminal may then use that action to assume effective control of the account or session and initiate subsequent transactions.
The investigation must therefore reconstruct not only whether deception occurred, but when control changed and which actor initiated each material action after that point. A genuine authentication step completed by the customer may establish participation in an authentication event while subsequent session evidence indicates that the customer did not initiate the disputed payment. Conversely, where the customer retained control and personally created the beneficiary and payment instruction, the evidence may support payer manipulation rather than account takeover.
The practical consequence is important. A case beginning with social engineering can develop into account compromise, while an initial allegation of account takeover may ultimately be better explained by customer-authorised activity induced by deception. Fraud classification should emerge from temporal reconstruction rather than be imposed at intake and preserved despite contradictory evidence.
Reconstruct Behavioural Development, Not Just Deviation
Behavioural analysis can identify circumstances requiring enquiry: creation of a new beneficiary, unusual transaction value, altered payment timing, rapid escalation in amounts, departure from normal counterparties or a sequence of activity inconsistent with the customer's established pattern.
These remain indicators. A legitimate investment, property transaction, family emergency or change in business activity may create substantial deviation from historical behaviour. The relevant question is not whether the payment was unusual in the abstract, but whether the deviation combined with other information creates a reasonable basis to test a fraud hypothesis.
The stronger analytical question is whether the sequence is unusual for this customer and consistent with a recognised fraud methodology. A new beneficiary alone may carry limited evidential weight. A new beneficiary followed by a small initial transfer, subsequent escalation in value and repeated payments over a compressed period creates a different investigative proposition. If receiving-side evidence also shows rapid dispersal or connections to other suspected fraud receipts, the evidential picture changes again.
The significance arises from the relationship between events, not from treating each event as independently suspicious.
Investigate the Beneficiary, Not Only the Payer
Sender-side evidence can reconstruct how the customer came to make the payment, but it provides only one side of the transaction. Receiving-side intelligence can test that account against the behaviour of the beneficiary and the subsequent movement of funds. Therefore, the investigative question extends beyond why the payer sent the money to what happened when the value reached its destination. Where the payment follows sustained relationship-building or an investment proposition, that enquiry may need to extend further into the beneficiary, digital and network infrastructure, as examined in Romance and Investment Scams: Investigating the Networks Behind Relationship-Based Fraud.
A beneficiary receiving payments from multiple apparently unrelated customers, followed by rapid dispersal, may warrant further investigation, particularly where the activity departs from the expected account profile or connects with accounts already associated with suspected fraud. The FCA's review of APP-fraud controls emphasised the importance of fraud detection, prevention, intelligence and ongoing monitoring, while identifying scope for improvement across the firms it reviewed.
The significance of this evidence lies in its relationship to the wider case, not in any individual characteristic. A recently opened account, rapid movement of funds or a network association does not establish that the beneficiary knowingly participated in fraud. Legitimate activity can produce similar patterns, and apparent connections may have credible alternative explanations.
Receiving-side evidence becomes more probative when it independently corroborates the payer-side chronology. If a customer describes deception leading to a payment, while beneficiary analysis identifies other apparently unrelated originators, rapid onward dispersal or connections to accounts associated with similar fraud reports, the two evidential perspectives may strengthen the same investigative hypothesis. Equally, beneficiary activity inconsistent with that hypothesis should not be disregarded.
The objective is therefore not to identify enough suspicious characteristics to label the recipient a money mule. It is to determine whether payer behaviour, beneficiary behaviour and subsequent funds movement tell a coherent evidential story — and where that story remains incomplete.
F.I.L. Model 2 — APP Fraud Hypothesis Matrix
Model 2. F.I.L. APP Fraud Hypothesis Matrix. An original analytical framework for testing competing fraud explanations against common evidence domains.
Source: Fraud Intelligence Lab original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
The matrix addresses a common investigative weakness: evidence can be interpreted through the classification already assigned to the case. Once an allegation is labelled APP fraud, investigators may search primarily for evidence of deception; once labelled account takeover, they may concentrate on devices and credentials. That creates a risk of confirmation bias.
The matrix reverses the approach. The investigator takes the same evidential domains and asks what each would be expected to show if the APP hypothesis, account-takeover hypothesis, hybrid-compromise hypothesis or legitimate explanation were correct.
Authentication evidence demonstrates why this matters. A genuine customer authentication event may support an APP hypothesis where the customer acted under deception. Under an account-takeover hypothesis, the investigation may instead need to determine whether a criminal possessed or exploited the authentication mechanism. In a hybrid case, customer participation in authentication may be the event that enabled later criminal control. Under a legitimate explanation, authentication may simply corroborate an ordinary transaction.
The same authentication event can therefore carry different evidential weight under different fraud hypotheses.
The matrix is not intended to produce a numerical score. Its purpose is to expose contradictory evidence, missing evidence and alternative explanations before the investigator reaches a disposition. This reflects a broader investigative principle: fraud indicators are not evidence of wrongdoing in themselves; their significance depends on context, corroboration and the testing of credible alternative explanations.
United Kingdom — APP Controls, Reimbursement and the Intervention Problem
What Happened
In its APP-fraud multi-firm review, published in November 2023 and updated in December 2025, the FCA reported findings from a mixed, risk-based sample of 12 current-account providers, challenger banks and payment firms. The FCA examined how firms mitigated APP fraud and wider fraud attacks, identifying examples of good practice alongside significant scope for firms to strengthen fraud-risk management and customer treatment.
The PSR's Q1 2026 APP scams reimbursement dashboard, updated on 30 July 2026, reports that during the first 18 months of the policy 88%—£316 million—of money lost to reimbursable APP scams was returned to victims. Consumers reported around 438,300 claims, approximately 301,500 of which were in scope for reimbursement, while 82% of claims in Q1 2026 were closed within five business days.
Why It Matters
The reimbursement data demonstrates an important consumer outcome, but it should not be used as a complete measure of fraud-control effectiveness. The Payment Systems Regulator's (PSR) APP scams reimbursement dashboard has a defined Faster Payments scope and methodological limitations that need to be understood before drawing wider conclusions from its figures.
More fundamentally, reimbursement and prevention answer different questions. Reimbursement examines treatment of an eligible loss after the fraud has occurred. Detection examines whether relevant behaviour was recognised. Intervention examines whether recognition occurred early enough, and whether the response could reasonably have altered the outcome. Investigation determines what the evidence establishes. Control learning asks whether completed cases change future detection or intervention.
A high reimbursement rate can demonstrate effective post-loss treatment without establishing effective pre-payment detection.
Likewise, a reduction in losses cannot automatically be attributed to one control without considering exposure, reporting, customer behaviour, prevention and other relevant factors.
Professional and Investigative Lesson
A missed-scam review should reconstruct the information available at the time of payment, rather than judging the control solely with hindsight. Investigators and control owners should identify which signals existed, which were accessible to the relevant system, how they were weighted and whether a proportionate intervention could reasonably have distinguished the suspected scam from legitimate unusual activity.
The practitioner standard is not “fraud occurred, therefore the control failed”. The relevant question is whether the control architecture was capable of recognising the observable behaviour associated with the methodology, whether the necessary information was available at the relevant time and whether intervention logic was appropriately calibrated.
Wider Implication
The UK's reimbursement regime increases the financial importance of prevention, but the more durable lesson is analytical. Claims data should feed back into fraud intelligence. Confirmed cases can reveal recurring customer narratives, beneficiary characteristics, intervention failures and typological changes.
A reimbursement process that resolves the customer outcome without informing control learning leaves part of the intelligence value of the case unused.
The UK Government's 2026–2029 Fraud Strategy reinforces the wider importance of disrupting fraud upstream and adapting to changing criminal methodologies rather than treating fraud solely as a post-loss problem.
European Union — Strong Authentication and Engineered Payment Decisions
What Happened
In May 2025, Eurojust reported the disruption of an organised criminal group associated with a fake online investment platform that had defrauded more than 100 victims of over €3 million. Victims initially transferred modest sums. Fake charts then appeared to show substantial profits, while purported brokers used telephone contact and psychological pressure to persuade victims to transfer larger amounts. Eurojust reported that the funds were not invested as represented but went to the criminal group.
Why It Matters
The case demonstrates why transaction authentication captures only one stage of the fraud process. The criminal methodology developed across contact, manufactured legitimacy, apparent investment performance, psychological influence and escalating payments. By the time a victim authenticated a later transfer, much of the fraud-enabling activity had already occurred outside the payment system.
The investigative significance lies in progression. The first transfer and the fifth transfer are not analytically equivalent merely because both were authenticated by the same customer. By a later payment, the institution may possess a longer transaction history, an emerging beneficiary relationship, increasing values and a behavioural sequence that did not exist when the first transfer was made.
That observation is consistent with the European Banking Authority (EBA) and European Central Bank (ECB) conclusion that Strong Customer Authentication (SCA) remains effective against relevant fraud types while payer manipulation is increasing. The evidence does not establish that SCA is ineffective. It demonstrates why authentication alone cannot address every form of payer manipulation.
Professional and Investigative Lesson
Investigators should reconstruct the temporal development of the payment relationship rather than treating every transfer as an independent event. An initial modest payment to a new investment destination may have several credible explanations. Repeated payments, escalating values, unusual beneficiary relationships and behaviour inconsistent with the customer's baseline may create a materially different investigative proposition when examined as a sequence.
The relevant control question is therefore whether the institution can recognise behavioural development across transactions, rather than merely whether each transaction independently satisfies a threshold.
Wider Implication
SCA and fraud analytics perform different functions. Authentication seeks to establish access or approval according to prescribed factors. Behavioural fraud controls assess whether authenticated activity is consistent with the customer's expected behaviour and surrounding context.
Mature control architecture needs both without treating either as conclusive evidence of fraud or legitimacy.
United States — Business Email Compromise and Manipulated Commercial Intent
What Happened
On 30 April 2026, the US Department of Justice announced the sentencing of four defendants for their roles in a transnational business email compromise scheme that stole more than $38 million from victims in the United States and abroad. According to court records described by the Department, members of the organisation obtained unauthorised access to victims' email accounts, monitored communications involving legitimate financial transactions and impersonated trusted business partners to redirect payments to bank accounts controlled by the criminal organisation.
Why It Matters
Business email compromise demonstrates the payment-intent problem in a commercial setting. The payer may deliberately initiate and authenticate a payment while the beneficiary instruction has been criminally substituted within a communication environment the payer believes to be genuine.
The FBI describes BEC as exploiting trusted electronic communications and identifies techniques including spoofed email accounts or websites, spear-phishing and malware capable of giving criminals access to legitimate billing and invoice information. For investigators, that reinforces the need to distinguish compromise of the communication channel from compromise of the payment account itself.
The comparison is mechanistic, not legal. This US case demonstrates manipulated payment intent within genuine commercial relationships; it is not presented as a US application of the UK's APP-fraud classification or reimbursement regime.
That distinction matters because the cross-jurisdictional proposition concerns investigative method rather than harmonised liability. Different legal systems can classify or allocate losses differently while still confronting the operational problem of a genuine payer acting on corrupted information.
Professional and Investigative Lesson
A familiar commercial purpose should not automatically resolve beneficiary risk. Investigators should examine whether beneficiary details changed, whether the payment destination corresponds with historical counterparties, whether instructions arrived through expected channels and whether the timing or content of the request materially departed from previous interactions.
A strong investigation also separates compromise of the communications environment from compromise of the payment account. In a BEC case, the payment account may remain securely controlled by the legitimate customer while the external source of the customer's payment instructions has been compromised.
Wider Implication
Payment-fraud investigation can require evidence held outside the financial institution. Email records, customer documentation, payment instructions, beneficiary-account information and downstream funds movement may be distributed across multiple organisations.
The control implication is not that a bank should be expected to observe evidence it does not possess. It is that investigators should distinguish absence of evidence from absence of fraud, while control owners should be explicit about the information their systems can and cannot observe.
Cross-Jurisdictional Analysis — The Common Problem Is Not Common Liability
The UK, EU and US do not operate a single authorised-payment fraud regime. The UK's mandatory Faster Payments reimbursement architecture is distinctive. European evidence sits within the EU's payment-security and SCA framework. US liability and consumer protection depend on different statutes, payment channels, regulatory rules and factual classifications.
Those differences matter. A reimbursement conclusion from the UK cannot simply be transferred to the US, and European SCA evidence should not be treated as a direct assessment of the UK's APP reimbursement framework.
The underlying fraud mechanism nevertheless exposes a common operational problem. A criminal can influence a legitimate payer so that the financial institution receives an apparently legitimate instruction from the person it expects to authenticate. The fraud-control challenge is therefore broader than identity verification.
The common problem is not identical liability. It is the gap between authenticating a payer and understanding a payment.
That gap is where behavioural analytics, beneficiary intelligence, contextual intervention and investigative judgement become important. None replaces authentication. They address questions authentication was never designed to answer.
F.I.L. Model 3 — Fraud Chronology and Control-Visibility
Model 3. F.I.L. Fraud Chronology and Control-Visibility Model. An original analytical framework for distinguishing fraud chronology from what the institution could observe at each stage.
Source: Fraud Intelligence Lab original analytical framework. It is not a statutory test, regulatory model or law-enforcement investigation standard.
APP fraud investigation is fundamentally temporal. Investigators should establish when the deceptive interaction began, when the customer's understanding changed, when the beneficiary was introduced, when payment intent formed, when authentication occurred, when any intervention took place, when value moved and when subsequent intelligence became available.
The second timeline addresses a different question: when did those events become observable to the institution?
The distinction is critical because evidence discovered after the transaction can establish that fraud occurred without proving that the same conclusion was reasonably available before execution. A receiving account may only be identified as part of a wider mule network days later. Other victims may report the same beneficiary after the first payment has already been made. Communications recovered during investigation may establish deception that was never visible to the payment institution in real time.
The Not Yet Observable zone contains activity occurring within the fraud methodology for which the institution does not yet possess a usable signal. That does not make the activity unimportant to the eventual investigation; it means it should not retrospectively be treated as evidence a pre-payment control necessarily possessed.
The Potentially Actionable zone begins when relevant behaviour becomes visible in a form capable of supporting intervention or further enquiry. The existence of an observable signal does not automatically establish that intervention was required. Its evidential weight, timing, accessibility and relationship to other information still need to be assessed.
The Known Only With Hindsight zone contains evidence acquired after the relevant decision point. That information can establish the fraud, enrich the typology and improve future controls, but it should not be silently imported into an assessment of what an earlier control should have known.This produces a more disciplined missed-scam question:
What was knowable, by which control, at what point in the fraud sequence, and early enough to change the outcome?
The answer may reveal that relevant information was unavailable. It may instead show that the information existed but was fragmented across systems, inadequately weighted, received too late in the decision process or inaccessible to the investigator conducting the intervention.
The model therefore distinguishes absence of a signal from failure to operationalise an available signal.
Designing Better APP Fraud Interventions
The effectiveness of an intervention depends on whether it tests the suspected methodology rather than merely notifying the customer that scams exist. Generic warnings can be weak where the victim already believes that the supposed bank employee, investment adviser, supplier, police officer or family member is genuine.
If the working hypothesis is bank impersonation, asking only whether the customer is “sure” they want to proceed may add little because the fraudster's narrative has already supplied the answer. A diagnostic intervention instead tests that narrative. Has anyone told the customer that their existing account is unsafe? Have they been instructed to move money to protect it? Have they been told not to disclose the true purpose of the transfer to the bank? Were the beneficiary details supplied during unsolicited contact?
The purpose is not to prove fraud from one answer. It is to obtain information capable of discriminating between the fraud hypothesis and a legitimate payment explanation.
The same principle applies to other typologies. Where the concern is investment fraud, the relevant enquiry may concern the investment relationship, previous payments, withdrawal experience, promised returns and identity of the destination. Where the concern is invoice redirection, changes in beneficiary information, communication channel and established payment practice may carry greater diagnostic value.
The objective is not to turn every unusual payment into an interrogation. Excessive intervention creates customer harm, operational cost and the risk that customers become conditioned to disregard warnings. The appropriate objective is discriminating friction: intervention targeted at circumstances in which additional enquiry has a reasonable prospect of distinguishing deception from legitimate activity.
Control owners should therefore test intervention performance rather than merely record deployment. Which typologies trigger intervention? Which observable characteristics produced the trigger? At what stage in the payment sequence does it occur? Which customer responses materially alter the risk assessment? How frequently do confirmed scams proceed despite intervention? Which legitimate payments are unnecessarily disrupted?
Those questions turn customer intervention from a static warning mechanism into a measurable control.
F.I.L. Practitioner Decision Structure — From Indicator to Response
The three principal models describe reconstruction, hypothesis testing and control visibility. A supporting decision structure connects those concepts to case handling:
OBSERVATION
↓
WORKING HYPOTHESIS
↓
COMPETING HYPOTHESIS
↓
CORROBORATING EVIDENCE ↔ REFUTING EVIDENCE
↓
EVIDENTIAL GAPS
↓
ASSESSMENT
↓
PROPORTIONATE RESPONSE
↓
CONTROL LEARNING
An observation starts the enquiry; it does not determine its outcome. A working hypothesis gives the investigation direction, while the competing hypothesis prevents the initial explanation from becoming self-confirming. Corroborating and refuting evidence should then be assessed together, with material gaps explicitly identified.
The assessment should explain why one explanation carries greater evidential weight than another rather than merely recording the number of indicators associated with each. The resulting response should be proportionate to the evidence and stage of the fraud. Before execution, that may mean additional enquiry or payment intervention. After execution, it may mean recovery activity, beneficiary investigation, receiving-PSP notification or escalation.
The final stage is control learning. A confirmed fraud case should be capable of changing future detection where it exposes a repeatable signal, control gap or emerging typology. A false positive should also create learning where it identifies legitimate behaviour being weighted too heavily.
From Case Disposition to Control Learning
A completed APP fraud investigation should produce more than a reimbursement or complaint outcome. It can also produce fraud intelligence.
Confirmed scam cases may reveal recurring beneficiary characteristics, communication methods, payment sequences, behavioural changes or intervention failures. False positives can identify legitimate behaviours that controls weight too heavily. Cases initially classified as APP fraud but subsequently identified as account takeover can expose weaknesses in session analysis or fraud taxonomy.
This makes disposition rationale important. A control-learning process needs to know why an investigator concluded that fraud was established, not merely which final category was selected. Without that reasoning, feedback risks converting case labels into detection rules without preserving the evidential distinctions that made the original decision defensible.
The feedback cycle should therefore ask whether a confirmed case exposed a missing signal, a signal that existed but was unavailable to the control, poor calibration, inadequate beneficiary intelligence, ineffective intervention or an emerging methodology not covered by the existing control framework.
The relevant measure is not simply whether fraud cases are closed. It is whether completed investigations improve the institution's ability to recognise the next materially similar case.
Practical Investigative Framework
The following questions are not intended as a mechanical checklist. Their purpose is to ensure that the disposition addresses the principal evidential domains and that gaps are made explicit rather than silently converted into assumptions.
Account and Session
Who controlled the account when the disputed activity occurred? Which device, session and authentication factors were used? Is there evidence of credential compromise, remote access or session takeover? If control changed, when did that occur and which subsequent actions can be attributed to each actor?
Payment Intent
What did the customer believe the payment was for? Whom did they believe they were paying? What outcome did they expect? Which representation created that belief, and through which communication channel? What contemporaneous evidence supports or challenges that account?
Behaviour
How did the payment compare with the customer's historical behaviour? Was the beneficiary new? Did transaction value, frequency or timing change? Was there an escalation pattern? Are those deviations genuinely unusual for this customer rather than unusual only against a broad peer group?
Authentication
What does the authentication evidence actually establish? Did the customer personally complete the process? Does successful authentication support legitimate account control while leaving deception unresolved? Is there evidence that the customer was manipulated into completing an authentication step that enabled subsequent account compromise?
Beneficiary and Network
What is known about the recipient? Are there relevant prior fraud reports, multiple apparently unrelated originators, rapid onward dispersal or associations with other accounts of investigative interest? Which relationships require explanation, and which have credible legitimate explanations?
Funds Flow
What happened to the funds after they reached the beneficiary? Were they retained, withdrawn, converted or rapidly dispersed to other accounts? Where available, can subsequent movement be linked to other beneficiaries, accounts or transactions already associated with suspected fraud?
Funds-flow evidence should be interpreted in context. Rapid onward movement, fragmentation or transfer through multiple accounts may support a fraud hypothesis, but those characteristics do not independently establish criminal purpose or knowledge. The investigator should consider whether the movement is consistent with the expected activity of the beneficiary and whether credible legitimate explanations remain.
The strongest evidential value arises when downstream movement corroborates evidence developed elsewhere in the investigation. A customer account of deception, unusual payment behaviour, beneficiary intelligence and subsequent dispersal may collectively support the same hypothesis more strongly than any one element viewed in isolation. Equally, funds-flow evidence that does not fit the working hypothesis should be identified rather than discounted.
Corroboration and Refutation
The investigation should then test whether evidence from the different domains converges on the same explanation. Which evidence independently supports the customer's account? Which evidence contradicts it? What remains uncorroborated? What credible alternative explanation remains, and what additional enquiry could materially change the assessment?
Corroboration should not be confused with repetition. Several indicators derived from the same underlying event do not necessarily constitute independent evidence. Greater evidential weight may arise where different sources — for example customer communications, session evidence, behavioural chronology, beneficiary intelligence and funds movement — independently support the same material proposition.
Contradictory evidence should receive the same analytical attention. An investigator should not explain away evidence merely because it conflicts with the initial fraud classification. A defensible disposition should identify material inconsistencies and explain why the preferred hypothesis remains better supported despite them.
Critically, the investigator should also ask:
What evidence would have to exist if the competing explanation were true?
Investigative quality is not demonstrated by finding evidence consistent with the first hypothesis. It is demonstrated by testing whether that hypothesis remains the best-supported explanation after contradictory evidence and credible alternatives have also been considered.
Practical Control Questions for APP Fraud Teams
Control owners should apply the same discipline to the architecture surrounding the investigation. A useful assurance review should determine whether the institution can identify behavioural development across multiple payments rather than assessing transactions independently. It should establish whether authentication, device, customer and transaction evidence can be brought together at the point of investigation; whether receiving-side intelligence is incorporated where lawfully available; and whether confirmed fraud outcomes feed back into detection and intervention logic.
The review should also establish whether intervention occurs early enough to matter. A highly accurate model that identifies deception only after value has dispersed may provide useful investigative intelligence without providing effective prevention. Conversely, an extremely sensitive pre-payment control may prevent some fraud while generating disproportionate false positives and customer friction.
This requires teams to distinguish several forms of performance. Detection performance asks whether relevant behaviour was recognised. Intervention performance asks whether recognition occurred early enough and whether the response was capable of changing the outcome. Investigative performance asks whether the available evidence was correctly interpreted, competing hypotheses tested and the disposition adequately reasoned. Post-loss performance considers reimbursement, recovery, customer treatment and related case handling where applicable. Control-learning performance asks whether completed cases materially improve future detection and intervention.
Measuring one stage as a proxy for all five can conceal weakness elsewhere in the control environment.
Authentication should establish what the payment process can prove, not determine the entire fraud assessment. A valid authentication event may demonstrate that a recognised customer, device or credential completed a particular step, but it does not necessarily establish why the customer authorised the payment or whether that decision was materially shaped by deception. Investigators should therefore separate evidence about authentication, account access and payment execution from evidence concerning the customer's understanding and intent at the time of payment.
APP fraud investigation should reconstruct both the payment decision and the subsequent movement of value. Investigators should establish how the customer's understanding developed before payment, what representations or communications influenced the decision, who controlled the account and session, what authentication events occurred and what warnings or interventions were presented. The enquiry should then follow the value after payment, examining beneficiaries, onward transfers, transaction velocity, linked accounts and other relevant indicators. Decision reconstruction and value tracing answer different investigative questions, but together they can provide a more complete fraud picture.
Competing hypotheses should be tested against the same evidence rather than allowing an initial classification to determine how that evidence is interpreted. APP fraud, account takeover, hybrid compromise and legitimate unusual activity can produce overlapping transactional, device and authentication signals. Investigators should identify what evidence would support or weaken each credible explanation and document material inconsistencies. Classification should emerge from evidential testing rather than become the assumption around which the investigation is constructed.
Control effectiveness should be assessed through a chronology of visibility. Investigators and control owners should distinguish information available before payment, information generated during the transaction and evidence discovered only through subsequent investigation. A fact that strongly supports a fraud finding after the event should not automatically be treated as information that a pre-payment control could reasonably have identified or acted upon. Reconstructing what the control could see, and when it could see it, provides a more defensible basis for assessing missed intervention opportunities.
Intervention should also test the suspected fraud methodology rather than merely introduce additional friction. Generic warnings may be appropriate in some circumstances, but they can become less useful where customers encounter them repeatedly or where the warning does not address the deception actually being used. Where proportionate, diagnostic questions and contextual interventions can help test the customer's understanding of the payment, the relationship with the beneficiary and the representations underlying the transaction. The objective is not simply to interrupt unusual activity, but to identify whether the customer's payment decision may have been engineered by deception.
Finally, detection, intervention, investigation, post-loss treatment and control learning should be evaluated as distinct outcomes. A control may detect suspicious activity but fail to intervene effectively; an intervention may occur without preventing loss; and a correctly investigated case may reveal weaknesses in an otherwise functioning detection system. Confirmed fraud, false positives, missed interventions and misclassified cases should therefore feed back into typologies, warning design, detection logic and control calibration. Mature APP fraud assurance should measure these stages separately so that success at one point in the control environment does not conceal weakness at another.
Conclusion
APP fraud challenges a deeply embedded assumption in digital payments: that stronger authentication necessarily produces stronger evidence about the legitimacy of the transaction. European Banking Authority (EBA) evidence indicates that Strong Customer Authentication (SCA) continues to mitigate important categories of payment fraud, but the analytical problem is that criminals do not always need to defeat the authentication mechanism. They can instead manipulate the person whom the mechanism is designed to authenticate.
That adaptation changes the investigative task. Establishing that a customer completed authentication is important, but it does not complete the fraud analysis. Investigators need to reconstruct how the decision was formed, what the customer believed about the beneficiary and purpose, whether the customer retained control of the account, which contextual signals existed before execution and what beneficiary and funds-flow evidence subsequently establishes. The resulting assessment should distinguish observation from hypothesis and remain open to credible alternative explanations.
The UK, EU and US evidence does not establish a common liability regime, but it exposes a common investigative problem. UK evidence demonstrates the need to distinguish prevention and intervention from post-loss reimbursement. European evidence illustrates why effective authentication and payer-manipulation risk can coexist. The US BEC case demonstrates how genuine commercial payment activity can be redirected through corruption of the information on which a payer relies.
The three Fraud Intelligence Lab models address different parts of that problem. The Payment Intent Reconstruction Model reconstructs the fraud across decision formation, payment control and value destination. The APP Fraud Hypothesis Matrix tests competing explanations against common evidence rather than allowing the initial classification to determine the investigation. The Fraud Chronology and Control-Visibility Model distinguishes what happened from what the institution could reasonably observe before the loss.
Together, they shift the practitioner question away from whether a transaction merely looks suspicious. The stronger questions are: How was the payment decision formed? Which hypothesis best explains the evidence? What was observable at the relevant time? What remained unknown? And what could the institution reasonably have done with the information it possessed?
Authentication can establish who completed a payment process. APP fraud investigation must establish how the decision to pay was formed.
For practitioners, that distinction turns an authorised transaction from an endpoint into an investigative sequence.
Methodology and Evidential Note
This article is a practitioner analysis of authorised push payment fraud, with particular emphasis on payer manipulation, payment intent, authentication evidence, beneficiary behaviour, intervention opportunities and the movement of value following payment. It draws primarily on regulatory, government, law-enforcement and official institutional material from the United Kingdom, European Union and United States. Primary sources were selected for their relevance to authorised-payment fraud, social engineering and payer manipulation, authentication and payment security, fraud controls, reimbursement, beneficiary behaviour and documented fraud methodology.
The analysis distinguishes authentication, authorisation and payment intent because they answer different evidential questions. Evidence that a customer, recognised device or valid credential completed an authentication process may establish important facts about how a transaction was executed, but it does not necessarily establish the circumstances in which the payment decision was made. Conversely, evidence that a customer was deceived does not automatically establish that an authentication control malfunctioned or that information sufficient to identify the deception was available to the payment provider before execution. The article therefore treats authentication evidence as one component of the wider evidential picture rather than as a complete explanation of payment intent.
Jurisdictional examples are compared by underlying fraud mechanism and investigative relevance rather than treated as legally or regulatorily equivalent. The UK's APP reimbursement framework, the European Union's payment-security and Strong Customer Authentication environment, and US fraud and payment-liability frameworks differ materially in their legal foundations, institutional responsibilities, terminology and allocation of liability. Cross-jurisdictional comparison is therefore used to identify common investigative problems and control questions, not to suggest that legal duties, reimbursement rights or liability standards can be transferred directly between jurisdictions.
The article also distinguishes information available to a control at the time of payment from evidence obtained subsequently through investigation. Transaction history, device information, beneficiary characteristics, communications, customer testimony and subsequent movement of funds may become highly significant when reconstructing an APP fraud event. However, evidence that establishes fraud retrospectively should not automatically be treated as evidence that was available, visible or sufficiently developed to support intervention before payment. This distinction underpins the article's use of control-visibility chronology when assessing detection and intervention opportunities.
APP fraud, account takeover, hybrid compromise and legitimate unusual activity may produce overlapping indicators. References to unusual payments, authentication events, new beneficiaries, device changes, payment velocity or other behavioural signals should therefore be understood as investigative indicators rather than proof of a particular fraud classification. The analytical approach adopted in the article is hypothesis-led: investigators should consider what evidence supports or weakens competing explanations and allow the classification to emerge from the available evidence rather than using an initial classification to determine its interpretation.
“Payment intent”, the Payment Intent Reconstruction Model, APP Fraud Hypothesis Matrix, Fraud Chronology and Control-Visibility Model, and supporting Practitioner Decision Structure are original Fraud Intelligence Lab analytical constructs developed to organise investigative reasoning around APP fraud. They are not presented as regulator-issued frameworks, statutory tests, legal definitions, evidential thresholds or established industry standards. Their purpose is to help separate relevant investigative questions, reconstruct chronology, test competing explanations and identify what information was available at different stages of the payment and investigative process.
The Payment Systems Regulator's (PSR) APP scams reimbursement dataset is subject to the scope and methodological boundaries published alongside the underlying data. The figures should therefore not be treated as universal measures of APP fraud prevalence, total fraud losses or the performance of payment providers outside the population and reporting framework covered by the dataset. Where other quantitative measures are discussed, they should similarly be interpreted according to the definitions, time periods, populations and limitations of their originating sources.
Finally, this article treats detection, intervention, investigation, reimbursement or other post-loss treatment, and control learning as related but analytically distinct stages. Successful performance at one stage does not necessarily demonstrate effectiveness at another: an institution may detect suspicious activity without preventing a loss, reimburse a victim without demonstrating that the pre-payment control could have identified the fraud, or correctly investigate a case that exposes weaknesses in earlier detection. The methodological principle underpinning the analysis is therefore that APP fraud should be reconstructed across the complete decision and payment chronology, while conclusions about fraud, control effectiveness and liability should go no further than the evidence and applicable jurisdictional framework can support.
Primary case source for the European investment-fraud example involving more than 100 victims, staged payments, fake investment performance and psychological pressure.
Primary US law-enforcement source for BEC methodology, including spoofing, spear-phishing, compromised communications and fraudulent payment instructions.
Get link
Facebook
X
Pinterest
Email
Other Apps
Related Analysis
Continue reading investigations and analysis across Fraud Intelligence Lab.
