Authorised push payment (APP) fraud, where a victim is tricked into sending money to an account controlled by criminals, is the leading form of consumer payment fraud in markets with instant payments. In the UK, mandatory reimbursement since October 2024 has changed the economics for payment firms. At the same time, AI-generated synthetic identities and deepfakes are beating controls designed for human fraudsters.
UK APP reimbursement in practice
Under the Payment Systems Regulator's rules, the sending and receiving payment firms split the cost of reimbursing victims of in-scope APP fraud equally. The maximum reimbursement is £85,000 per claim, reduced before launch from the £415,000 first proposed after pressure from smaller firms. The principle is unchanged: a firm that receives fraudulent funds shares responsibility for the loss.
Experience so far shows both the benefits and the side effects. Receiving firms now have a strong reason to tighten onboarding and monitoring, but some have added friction that falls mainly on legitimate customers. Firms in or entering the UK market need real-time screening of incoming payments against mule account and fraud intelligence; confirmation of payee before outbound transfers; monitoring that can spot social engineering patterns; protection for vulnerable customers; and case management that handles claims within the required deadlines.
Synthetic identity fraud at onboarding
Synthetic identity fraud combines real and invented details to create a person who does not exist. It is growing quickly with generative AI. Unlike account takeover, it opens new accounts that pass standard KYC because the identity looks genuine. Fraudsters often build a credit history over months before borrowing as much as possible and disappearing.
Deepfakes are now being used to defeat liveness checks, the very control meant to stop fake identities passing video verification. Europol has warned about deepfake document manipulation and impersonation in financial onboarding. Biometric checks alone are no longer enough: firms need layered identity assurance that adds device signals, behavioural analytics during onboarding and monitoring that catches bust-out patterns before losses occur.
The GCC picture
GCC instant payment systems, including SARIE in Saudi Arabia, Aani in the UAE and Fawran in Qatar, bring the same problem as instant payments anywhere: money moves irrevocably in seconds, often before fraud checks can assess the full risk. Regulators are responding with stronger expectations on monitoring and on fraud controls for new payment services, including open banking payment initiation.
Migrant workers, who send large volumes of remittances and have varying levels of digital experience, are frequent targets of social engineering in the region. Firms serving them need fraud controls tuned to the scams seen in GCC corridors, not only to European or global patterns.
What payment institutions need to build
Effective fraud prevention works in layers. Checks before authorisation, such as device fingerprinting, behavioural biometrics, velocity rules and network analysis, stop most fraud early. Real-time machine learning models trained on the firm's own data catch what those checks miss. Monitoring after authorisation picks up patterns that only appear across several transactions. Case management ties the layers together so that investigators can act quickly and record decisions in a way that stands up to regulatory review.
The best-placed firms have one thing in common: their fraud and compliance data sit together. When a device seen in a fraud case also appears in an AML alert, a joined-up firm sees the link; a firm with separate systems misses it.