A payment can pass through a legitimate banking system and still end up in the wrong hands. Sometimes criminals gain access to accounts and move money without permission. Other times, they impersonate trusted people or businesses and convince the account holder to make the transfer themselves. This makes payment fraud a serious concern for banks, payment providers and businesses that are handling customer transactions. Understanding how payment fraud works and knowing when and where to apply security checks can help prevent financial losses before funds are transferred.
What Is Payment Fraud?
Payment fraud occurs when someone steals money or makes a fraudulent payment by using another person’s payment details, accessing their account without permission or tricking them into sending money. It can happen through bank transfers, credit or debit cards, digital wallets and other payment methods.
For example, a fraudster may mimic a supplier and send an invoice with altered bank details. The business approves the payment, believing the request is genuine but the money reaches the fraudster.
The Financial Conduct Authority (FCA) distinguishes between unauthorized payment fraud, where money is taken without the account holder’s permission and authorized push payment (APP) fraud, where someone is tricked into approving a transfer to a fraudster. In both situations, money is lost through fraudulent activity but the way the payment takes place differs.
Common Types of Payment Fraud
Not every payment scam begins with stolen credentials. Sometimes, criminals exploit payment systems while others take advantage of the trust between people and businesses.
Here are some common types of payment fraud:
Stolen card fraud
A customer notices purchases they never made even though their card is still in their possession. This can happen when criminals obtain card information through phishing or data breaches. Stolen card fraud involves using someone else’s physical card or payment credentials without permission to make purchases or withdrawals.
When stolen card details are used online via an app or over the phone without presenting the physical card, this form of stolen card is also known as card not present fraud.
Chargeback Fraud
Chargeback fraud occurs when a customer knowingly makes a purchase, receives the product or service and then falsely tells their bank that they did not authorize the payment. They may claim that their card details were stolen or that the order never arrived. This deliberate attempt to reverse a valid payment is also known as friendly fraud or first party misuse. Visa distinguishes it from legitimate disputes involving actual card theft, billing errors or undelivered goods.
Account takeover fraud
Imagine accessing a banking account only to discover that a new beneficiary has been added and money has disappeared. In account takeover fraud, fraudsters gain unauthorized access through stolen passwords, phishing or compromised login credentials. They may then change account settings and initiate transfers.
Authorized push payment (APP) fraud
A customer receives a scam call from someone claiming to represent their bank. They are warned about suspicious activity and instructed to move their savings into a secure account. The account actually belongs to the scammer. This is what we call APP fraud in which the victim approves the transfer but has been deceived about where the money is going.
Business email compromise
A finance employee receives an email appearing to come from a regular supplier, requesting that an outstanding invoice be paid into a new bank account. The employee follows the instructions and is unaware that the account belongs to the fraudster. This is business email compromise (BEC), where criminals impersonate trusted business contacts or compromise genuine email accounts to redirect payments.
The FBI’s Internet Crime Complaint Center (IC3) explains that fraudsters can access business emails, examine existing financial conversations and mimic suppliers or employees to redirect pending payments into fraudulent bank accounts.
Digital wallet fraud
Imagine receiving a notification that money has left your digital wallet even though you have not made a payment. Someone may have gained access to your wallet credentials and transferred the funds without permission. But not every wallet scam involves a hacked account. Sometimes fraudsters may also impersonate someone the user trusts and convince them to send money through a payment app. The Federal Trade Commission (FTC) warns that scammers use such tactics to trick people into making payments that can be difficult to recover.
How Payment Fraud Is Detected
It involves examining payment activity, customer information and connected risk signals to identify suspicious transactions.
| Detection method | How it works |
| Transaction monitoring and risk scoring | Compares payment amounts, frequency and destinations against expected activity. An unusually large transfer to a new beneficiary may receive a higher risk score. |
| Behavioural and device analysis | Examines login behaviour, device fingerprints and network information. Shared devices or payment identifiers across multiple accounts may reveal coordinated fraud. |
| Identity and payment verification | Checks customer identity and available bank account ownership information. Unexpected mismatches can prompt further verification. |
| Rules and machine learning | Rules flag predefined patterns such as rapid transfers while machine learning models identify more complex relationships in transaction data. |
The FFIEC’s Customer Due Diligence guidance explains that banks should compare customer transactions against expected activity and investigate significant, unexplained changes. FinCEN also identifies altered payment instructions and unusual beneficiary details as potential indicators of fraud.
How to Prevent Payment Fraud
Payment fraud prevention involves securing accounts, verifying recipients and stopping suspicious transactions before money is lost. Businesses can take the following measures:
- Strengthen customer authentication: Use multi-factor authentication (MFA) for account access and sensitive payments.
- Verify payment details: Confirm recipient names and account information before transferring funds. FinCEN advises independently confirming suspicious payment instructions to prevent fraudulent transfers.
- Monitor Transactions: Flag unusual payments in real time and hold suspicious transfers for verification where possible.
- Set payment limits: Apply transaction value and frequency limits based on risk.
- Detect fraud networks: Identify connected accounts through shared devices, IP addresses, and payment identifiers to uncover coordinated fraud.
- Secure payment access: Restrict payment permissions and require separate approvals for sensitive transfers.
Frequently Asked Questions
What are the most common types of Payment fraud?
Common types include stolen card fraud, account takeover, APP fraud, business email compromise and digital wallet fraud. Their prevalence varies by market and payment channel.
What is the difference between payment fraud and card fraud?
Payment fraud covers fraudulent activity involving different payment methods, including bank transfers and digital wallets. Card fraud specifically involves the misuse of payment cards or their credentials.
How can businesses prevent payment fraud?
Beyond technical safeguards, businesses should train employees to recognize impersonation scams, establish clear payment approval procedures and ensure suspicious requests can be reported promptly.
