What Is Authorized Push Payment Fraud? Scams and Reimbursement

Authorized push payment fraud is a scam where a criminal tricks you into transferring money from your own bank account to an account they control. Because you logged in and sent the payment yourself, the bank’s systems treated it as a legitimate instruction, and the federal rules that protect you from stolen-card or hacked-account fraud generally do not apply. That single fact is why these scams are so devastating: reported losses to imposter scams alone reached $2.95 billion in 2024, and the FBI’s Internet Crime Complaint Center logged $16.6 billion in total cybercrime losses that year.¹²

Authorized vs. Unauthorized: Why the Difference Matters

In a classic bank fraud, someone steals your debit card number or online banking login and moves money without your knowledge. Federal regulations call that an “unauthorized electronic fund transfer,” defined as a transfer initiated by someone other than the account holder without actual authority.³ Under Regulation E, your liability is capped at $50 if you report within two business days, and your bank absorbs the rest.⁴

APP fraud sidesteps that framework entirely. You logged into your own account and pressed send. The bank processed a payment instruction you gave it. The fact that you were lied to does not, under current U.S. law, make the bank responsible for reversing the transfer.

There is one important gray area. The CFPB has said that when a scammer tricks you into sharing your login credentials and the scammer then initiates a transfer, that transfer is unauthorized and Regulation E does apply.⁵ The dividing line is who actually pushed the button. Scammer using your credentials: federal protection. You, after being deceived: generally no protection. That one detail usually decides whether your bank owes you anything.

How the Scams Work

APP schemes rely on urgency, false authority, and emotional pressure. The specific stories change, but the mechanics are familiar.

Impersonation of Banks and Government

The most common tactic is pretending to be someone you trust. A caller claims to be from your bank’s fraud department, says your account has been compromised, and tells you to move money to a “safe account” right now. The urgency is deliberate. If you hang up and call the bank back at the number on your card, the scam collapses. Government impersonation works the same way: fraudsters pose as the IRS, Social Security Administration, or law enforcement, threatening arrest unless you pay immediately. Government imposter losses alone hit $789 million in 2024.¹

Business Email Compromise and Invoice Fraud

This variant targets businesses and accounted for $2.77 billion in reported losses in 2024.² A criminal hacks a vendor’s email account or spoofs a convincing lookalike address, then sends an invoice with “updated” bank details. Accounts payable processes the payment through normal channels, and the money lands with the scammer instead of the real supplier. Because a real employee authorized the transfer, the company usually has no recourse against its bank.

Investment and Purchase Scams

Investment fraud was the single costliest category reported to the FBI in 2024, at $6.57 billion.² Fake trading platforms show you an account balance that grows beautifully, which convinces you to send more. Purchase scams are simpler: a seller advertises goods online, pressures you to pay by direct bank transfer rather than a credit card, and vanishes.

Cryptocurrency Scams

Cryptocurrency makes everything worse. Crypto payments are not reversible and carry no legal protections comparable to credit or debit card transactions, and crypto held in accounts is not insured by the government the way bank deposits are protected by FDIC insurance.⁶ “Pig butchering” scams combine romance and investment fraud: the scammer builds a relationship over weeks, then steers you toward a fake crypto platform. Once funds hit a wallet the scammer controls, recovery is essentially impossible.

Romance Scams

Romance fraud involves weeks or months of relationship-building before any money is requested. The ask usually comes as a fabricated crisis: a medical emergency, a travel problem, a legal issue. Emotional investment makes you less likely to question the request, and the voluntary nature of the payment makes it a textbook APP scenario. Losses add up because the scammer makes multiple requests over time.

AI Voice Cloning

Scammers can now clone a family member’s voice from a few seconds of audio pulled from social media or voicemail. The FTC has warned that cloned voices can sound convincing enough to impersonate a boss asking for bank account numbers or a relative claiming to be in trouble.⁷ The standard script is an updated grandparent scam: a frantic call about an arrest or accident, demands for immediate payment by wire transfer or gift cards, and insistence that you not tell anyone. The emotional shock is designed to override your judgment before you think to call the person directly.

Why Getting Your Money Back Is So Hard

No federal statute requires banks to reimburse customers who were deceived into initiating a payment. That is the hard legal reality.

The Regulation E Gap

Regulation E’s consumer protections are built around unauthorized transfers, defined as transfers “initiated by a person other than the consumer without actual authority.”³ If you initiated the transfer yourself, even under false pretenses, the regulation does not cover you. The rule that consumer negligence cannot be used to increase liability beyond Regulation E’s limits only applies when a transfer is genuinely unauthorized in the first place.⁸

Businesses and UCC Article 4A

If you run a business, your wire transfers are governed by Article 4A of the Uniform Commercial Code, adopted in some form by every state. A bank that follows “commercially reasonable” security procedures and accepts a payment order in good faith has no refund obligation, even if the underlying request was fraudulent. The security procedures are set by agreement between the bank and the customer and might include callback verification, encryption, or identifying codes. Courts decide whether those procedures are commercially reasonable by looking at the size and frequency of your typical transfers, the alternatives the bank offered, and industry norms. If the procedures pass that test, the loss stays with the business.

What Reimbursement Does Exist

Zelle and Imposter Scams

Peer-to-peer services like Zelle, Venmo, and Cash App are preferred by APP scammers because transfers happen instantly and are hard to reverse. Under pressure from the CFPB and Congress, Zelle’s parent company, Early Warning Services, began reimbursing victims of qualifying imposter scams in mid-2023. The policy covers situations where a scammer impersonates a bank, government agency, or utility company, and participating financial institutions are required to refund affected customers. Investment scams, romance scams, and purchase fraud are not covered.

Filing a Complaint With the CFPB

If your bank refuses to help, you can submit a complaint to the Consumer Financial Protection Bureau. Be realistic about what this does. The CFPB forwards your complaint to the company, which generally has 15 days to respond (or 60 days for complex cases).⁹ The agency does not adjudicate your dispute or order the bank to pay you back. What it does is create a formal record, which sometimes motivates banks to resolve complaints they would otherwise ignore. You can review and respond to the company’s response through the CFPB portal.¹⁰

One boundary worth knowing: the United Kingdom made reimbursement for APP scams on its Faster Payments system mandatory as of October 7, 2024, with a cap of £85,000 per claim.¹¹ No comparable U.S. framework exists. Your recovery here depends on your bank’s internal policies and willingness to investigate.

What to Do If You Have Just Been Scammed

Speed is everything. Scammers start moving stolen funds within minutes, layering them through multiple accounts to make tracing impossible. Act in this order.

Call your bank immediately using the fraud number on your card or the bank’s website. Tell them the transfer was made under fraudulent pretenses and ask them to attempt a recall. Give them the exact time, amount, and recipient details. If they act fast enough, some banks can freeze the receiving account.
File a complaint at ic3.gov, the FBI’s central cybercrime intake. For larger business losses, IC3’s Recovery Asset Team can sometimes intervene to freeze funds before they leave the banking system.¹²
Report the scam at ReportFraud.ftc.gov. This won’t recover your money, but it creates a formal record you may need later.¹³
Change passwords on email and banking accounts, especially if the scammer had any access to your communications. Turn on multi-factor authentication on every financial account.
Screenshot every communication with the scammer. Save transaction confirmations, phone numbers, and email addresses. Your bank and any regulator reviewing your case will need this.
Submit a written complaint through your bank’s formal complaint process. Banks must acknowledge and respond. If the response is unsatisfactory, escalate to the CFPB.¹⁰

How to Avoid Becoming a Victim

Most APP fraud succeeds because the victim acts before verifying. The single most effective defense is a personal rule: never send money or change payment details based on an inbound call, text, or email without independently confirming the request through a channel you already trust.

If someone claiming to be your bank calls about a security issue, hang up and call the number on your card or the bank’s website. No legitimate bank will ask you to move money to a “safe account.” No government agency will demand immediate payment by wire transfer or threaten arrest over the phone. Treat these as bright-line rules with no exceptions.

For businesses, the equivalent rule is verifying any change to vendor payment details through a pre-existing contact at the vendor, not through the contact information in the email requesting the change. A two-minute phone call to a number already in your records defeats most business email compromise schemes.

If you get an urgent call from a family member asking for money, the FTC recommends calling that person back at a number you already have for them. If you can’t reach them, contact another family member or friend to verify the story before sending anything.⁷ AI-cloned voices sound convincing, but they do not survive a callback to the real person.

Keep multi-factor authentication on all financial and email accounts. Scammers who get into your email can monitor invoices, intercept communications, and time their attacks. Review bank transactions regularly for unfamiliar activity. For large online purchases, pay by credit card rather than bank transfer when you can, because credit card transactions come with chargeback rights that direct bank transfers do not.

1
Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024
2
Internet Crime Complaint Center. 2024 IC3 Annual Report
3
eCFR. 12 CFR 1005.2 – Definitions
4
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
6
Federal Trade Commission. What To Know About Cryptocurrency and Scams
7
Federal Trade Commission. Fighting Back Against Harmful Voice Cloning
8
Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers
9
Consumer Financial Protection Bureau. Learn How the Complaint Process Works
10
Consumer Financial Protection Bureau. Submit a Complaint
11
Payment Systems Regulator. PS24/7 Faster Payments APP Scams Reimbursement Requirement
12
Internet Crime Complaint Center. Internet Crime Complaint Center
13
Federal Trade Commission. ReportFraud.ftc.gov