For years, financial institutions have built fraud controls around a familiar assumption: if the customer is genuine, the device is trusted, the login is valid, and the transaction is authorized, the payment is probably legitimate.
Authorized Push Payment fraud, or APP fraud, breaks that logic.
A customer can access an account from their own device, pass every authentication check, approve a payment, and still transfer money to a criminal. The identity is genuine. The authorization is genuine. What has been compromised is the customer’s intent.
Authentication confirms who is making the payment. It cannot always explain why the payment is being made or whether that decision has been manipulated.
When legitimate authentication enables fraud
Traditional controls are designed to answer an essential question: is this really the account holder?
That question still matters, but it is no longer enough.
In an APP scam, criminals do not necessarily need to steal credentials, compromise devices, or bypass multifactor authentication. They can persuade customers to complete every security step themselves. By impersonating a bank employee, government official, business leader, investment adviser, technology provider, or family member, scammers create a situation that appears credible and urgent.
The customer may be told that an account has been compromised, money must be moved to a safe account, a confidential transaction must be completed, or an investment opportunity will disappear unless immediate action is taken. Under pressure, the customer follows the instructions and authorizes the payment.
From the institution’s perspective, the activity may appear legitimate. From the customer’s perspective, the transaction may also feel legitimate at that moment. Yet the decision has been engineered by a criminal.
This is the new authentication paradox:
Identity is not intent. Authentication is not trust. Authorization is not legitimacy.
Generative AI is making social engineering more convincing, personalized, and scalable.
Criminals can now produce professional messages, communicate across languages, imitate familiar voices, recreate appearances, and adapt conversations in real time. Scam communication no longer needs to contain spelling mistakes, inconsistencies, or obvious warning signs traditionally associated with fraud.
The risk is no longer theoretical.
In Hong Kong in 2024, a finance employee at global engineering company was contacted by someone appearing to be the company’s Chief Financial Officer and asked to complete a confidential transaction. The employee subsequently joined a video conference that appeared to include the CFO and several colleagues.
Every participant was a deepfake.
Believing the meeting and instructions were genuine, the employee made 15 transfers totaling HK$200 million, approximately £20 million, across five accounts. The case demonstrated that familiar faces, voices, and video interactions can no longer be treated as definitive evidence of trust.
The incident also exposes the limits of controls that assess identity and access without examining context. The employee was genuine. The interaction appeared genuine. The transaction was authorised. Yet the underlying intent had been manipulated.
This is the combination financial institutions must now confront: AI-enabled persuasion, real-time payments, and legitimate authentication.
From authentication to intent-aware protection
The answer is not simply more authentication.
Additional passwords, biometric checks, or one-time passcodes may strengthen identity verification, but they will not necessarily stop a customer who has been persuaded to authorize a fraudulent payment.
Institutions need to complement authentication with intent-aware risk detection. This requires understanding the circumstances surrounding a payment, rather than assessing the transaction in isolation.
Is the customer paying a new beneficiary? Has money been moved unexpectedly from savings? Has payment velocity increased? Was a device recently added? Is the amount inconsistent with the customer’s normal behavior? Is the recipient connected to previous fraud or mule-account activity? Are there signs that the customer is following instructions during the payment journey?
Customer interactions can add another important layer of intelligence. Hesitation, scripted responses, unusual urgency, repeated references to confidentiality, or resistance to security questions may indicate that a customer is being coached.
No single signal proves manipulation. But when behavioral, transactional, device, beneficiary, network, and interaction signals are connected, they can reveal a very different risk picture.
The decision can then move from approval or decline to something more intelligent: pause, verify, challenge, or intervene.
Breaking the scam chain before the payment moves
The next generation of fraud prevention will not be defined only by how accurately institutions detect suspicious transactions. It will be defined by how effectively they identify manipulation before a payment is completed.
That requires timely and proportionate intervention.
A contextual warning can encourage a customer to reconsider the payment. A short cooling-off period can disrupt the urgency created by a scammer. An out-of-band verification can validate a request through a separate channel. A targeted customer call can expose coaching or coercion. A beneficiary risk check can identify connections to mule accounts or known fraud networks.
The objective is not to introduce unnecessary friction across every transaction. It is to apply intelligence and human judgment where the potential for harm is greatest.
Intervention must also be designed around the customer. Generic warnings are easily ignored, particularly when a scammer has already prepared the victim to expect them. Effective interventions should reflect the customer’s situation, explain the specific risk, and create enough separation from the scammer for the customer to reassess the decision.
This shifts fraud prevention from a control-led exercise to a customer-protection outcome.
Connecting intelligence across the fraud ecosystem
APP fraud cannot be addressed by fraud teams operating in isolation.
Fraud, AML, KYC, payments, investigations, disputes, and customer operations often hold different parts of the same risk story. When those signals remain fragmented, institutions may authenticate the customer without understanding the beneficiary, investigate a transaction without seeing the customer interaction, or identify a mule account only after funds have moved.
A connected operating model brings these signals together. It combines technology and analytics with domain expertise and human judgment, enabling institutions to see the entire customer and payment journey rather than a series of disconnected events.
At Concentrix, we believe this convergence is critical to the future of financial crime prevention. AI-led intelligence can identify patterns at speed and scale. Customer journey insights can reveal changes in behaviour and interaction. Skilled professionals can interpret context, engage customers, investigate complex cases, and make informed decisions where technology alone may not be enough.
The real value comes from orchestrating these capabilities as one connected ecosystem.
Trust must be continuously understood
Customers should not have to become fraud experts to stay safe.
Financial institutions need controls that can recognize when a real customer is acting under abnormal, deceptive, or manipulated circumstances. That means moving beyond point-in-time authentication towards continuous risk assessment and precise intervention across the customer journey.
Authentication remains essential. But in an environment shaped by deepfakes, synthetic identities, social engineering, and instant payments, it cannot establish trust on its own.
Authentication tells us who is making the transaction. Connected intelligence must help us understand why.
The institutions that act on this distinction will be better positioned to prevent losses, protect customers, reduce unnecessary friction, and stay ahead of the next generation of financial crime.
