Authenticated customers sending money to scammers broke the old fraud playbook. Three industry voices explain which pattern forced a rebuild, and which signal finally caught it.

Most fraud controls were built to answer one question: is this really the customer? Authorised push payment scams make that question useless. The customer logs in, passes every check and sends the money themselves. As a result, the fraud signals that matter now describe behaviour and context, not identity.

So we asked industry leaders one question: what is one fraud or scam pattern your team had to rebuild its controls around this year, and what signal finally helped you catch it? We wanted real examples over vendor pitches. Three respondents answered, and two pointed to the same pattern. Below, we set their replies against the latest data on scams and the fraud signals banks now use.

Fintechbits analysis

Why APP scams broke the old playbook

The numbers explain the pressure. UK APP fraud losses rose 19% to £576.4 million in 2025, according to the UK Finance Fraud Report 2026. Investment scams were the costliest type, with losses up 40%. Meanwhile, two-thirds of APP cases started online, while scams starting by phone caused 28% of losses.

Liability changed too. Since October 2024, UK payment firms have had to reimburse most APP victims, with the cost split between sending and receiving firms. An independent review published by the PSR in July found losses over Faster Payments fell by around 21% afterwards, or £73 million a year. Therefore, banks now pay directly when their fraud signals miss a scam.

Behaviour and the beneficiary together

Our first respondent described the core shift in plain terms.

“One pattern that’s needed far more attention is authorised push payment fraud, where the customer approves the payment themselves but has been tricked into sending money to a fraudster.

Most traditional controls are built to catch payments the customer didn’t authorise. In an APP scam, the customer passes authentication and believes the payment is genuine, so looking for an odd login or stolen credentials won’t catch it.

The most useful signal is a change in the customer’s normal payment behaviour, read alongside what you know about the recipient. A new payee, an unusually large amount, money moving on quickly, or a run of payments that doesn’t fit the customer’s history all mean much more when several show up together.

Just as important is what happens after a payment is flagged. A warning people click past is not enough. It has to explain the specific risk in plain words and give the customer a real chance to stop and check.”

Ahmed Yousuf, Financial Author, Customers Chain

His point on combining fraud signals matches how US rules now work. Nacha’s new ACH rules, which took effect on 20 March 2026, require large receiving banks to watch incoming credits for unusual velocity, atypically large credits and suspected mule accounts, American Banker reported. In other words, the beneficiary side now carries real weight in both markets. In the UK, receiving firms pay half of each reimbursed claim, so mule detection has become a priority. Inbound fraud signals, such as many small credits followed by one fast outbound transfer, now matter as much as checks on the sender.

The call that gives the scam away

Our second respondent pointed to a narrower but sharper signal: what is happening on the phone while the customer pays.

“APP scams forced us to change how we build payment middleware. We had to move from checking who the user is to checking what they’re trying to do. Multi-factor authentication isn’t enough when the real account holder is making the payment, often while a fraudster coaches them live.

The signal that made the difference was an active screen-sharing session or an ongoing voice call during a high-value payment. We changed the orchestration layer to take real-time signals from the device and check them against the destination account. If the user is on a call or sharing their screen while paying an account with fast money in and fast money out, a classic sign of a mule account, the system now forces a cooling-off period. That applies even if the user has passed biometric or token checks.

When the customer is the one pressing the button, the context matters more than the credential. Pausing the payment before it settles gives the victim a chance to break the scammer’s hold.”

Sudhanshu Dubey, Delivery Manager and Enterprise Solutions Architect, Errna

Active-call detection is a real and growing control. Google’s Android now warns users who open a banking app during a screen-shared call with an unknown number, then adds a 30-second pause. The pilot started in the UK in 2025 and has since reached most major UK banks, Google said in December. UK payment firms can also delay a suspicious Faster Payment by up to four business days. Note that Errna is mainly a blockchain and crypto exchange developer, so his example describes a client build rather than a bank’s own controls. Still, the design he describes, pairing call data with mule fraud signals before settlement, mirrors what larger UK banks are testing.

Fraud signals outside payments

Our third respondent runs an AI video platform rather than a bank. Even so, his example shows how behavioural fraud signals work in other settings.

“We’re an AI video platform, not a payments company, so I’ll answer from what we deal with: abuse on a platform with millions of interactions. The pattern that made us rethink our controls this year was credit abuse through account cycling. People would sign up, burn through free credits, then open new accounts with throwaway emails and do it again. At our scale, that ate into GPU compute we pay for by the second.

Email checks and IP tracking didn’t crack it. Both are easy to get around. What worked was behavioural fingerprinting. We looked at what a user does in their first 90 seconds. Abusive accounts follow almost the same path: skip onboarding, jump to the most expensive template, max out the settings, render, download, leave. Real users browse, hesitate and try a cheaper template first.

Once we added that signal, credit abuse fell by more than 70% in about three weeks, without adding friction for genuine users. People can fake who they are. They find it much harder to fake how they behave.”

Runbo Li, Co-founder and CEO, Magic Hour

His lesson carries over to payments. Behavioural biometrics, such as typing rhythm and navigation speed, already help banks spot remote access and coached sessions. However, his 70% figure is self-reported, and promo abuse costs far less per case than an APP scam. The principle still holds: sequence and timing are fraud signals that a stolen identity cannot copy.

What the strongest fraud signals share

Taken together, the answers point to three habits. First, combine fraud signals rather than relying on one threshold. A new payee alone means little, but a new payee, a large amount and an active call together mean a lot. Second, look at both ends of the payment. Receiving banks now share APP losses in the UK and must monitor incoming credits in the US.

Third, design the intervention as carefully as the fraud signals that trigger it. A pause or a clear, specific warning often matters more than a perfect score. For more on where models help and where they fail, see our roundup on AI fraud models. Card networks are also moving into bank transfers, as our report on Visa’s A2A fraud tools showed.

What to watch next

Several changes will shape fraud signals in 2027. In the UK, the PSR plans a formal consultation on the reimbursement regime in December 2026. In the US, the second phase of Nacha’s fraud monitoring rules extends the duty to smaller firms. Meanwhile, identity checks are moving to AI agents as well as people, as our piece on Socure’s agent tools shows.

Above all, the lesson is consistent. Fraudsters can pass an identity check. The fraud signals that catch them now come from context, timing and the account on the other end.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial advice. Views expressed are those of the FintechBits editorial team.