Authorized push payment fraud: Sent in seconds. (Often) gone for good.
Most businesses train employees to be wary of suspicious emails. But today's fraudsters aren't relying on email alone. Authorized push payment (APP) fraud can start with a phone call, text message or other seemingly routine payment request. The goal is always the same: convince an employee to send money to a fraudulent account.
Unlike account takeover fraud, APP fraud involves a payment that is authorized by the business itself. As a result, recovering stolen funds can be difficult. Real-time payments also increase the risk because transactions are completed within seconds and are typically irreversible.
The financial impact is rising. ACI Worldwide projects global losses from APP scams will reach $6.8 billion by 2027. In the U.S. alone, Deloitte estimates losses could approach $15 billion by 2028. The true cost may be even higher, as many victims never report these scams and reported cases do not always include the full amount lost.
Why businesses are at risk
APP fraud succeeds because it targets people, not systems. It’s called “confidence fraud.”
Fraudsters use social engineering tactics and AI, often impersonating executives, vendors, bankers or government agencies to create urgency, build trust and pressure employees to act quickly, before they verify details.
For businesses, some of the most common APP scams include:
- Invoice and mandate scams: Criminals use fake invoices or payment change requests to trick businesses into replacing a supplier's legitimate bank account information with their own.
- Business Email Compromise: Also known as a “CEO Scam,” the fraudster impersonates leadership or a trusted manager to trick an employee into sending money under the pretense of a confidential or urgent business matter.
- Impersonation scams: The scammer poses as a bank, government agency or other trusted partner and uses urgency and intimidation to coerce the victim into making a payment or sharing financial information.
Why the threat is growing
Today's fraudsters are becoming more sophisticated, with advances in AI making scams more convincing through realistic emails, messages and impersonation tactics that can be difficult to spot.
At the same time, businesses are processing more digital and real-time payments than ever before, creating additional opportunities for criminals to exploit.
Simple steps to help protect your business
Fraudsters are counting on employees to act quickly. If a payment request feels unusual, stop and verify before sending funds. A brief conversation or additional approval step could help prevent a costly loss and keep your business protected.
Consider these additional best practices:
- Confirm payment instruction changes directly, using a known phone number
- Require dual approval for large payments or account changes
- Be cautious of requests involving urgency, secrecy or unusual payment methods
- Regularly review payment controls and vendor information
- Train employees to recognize social engineering tactics
If you think you’ve been a victim:
- Contact Columbia Bank immediately at 866-563-1010. We’ll help protect your accounts and provide important next steps.
- Stop communicating with the scammer — they won’t return your money.
- Document everything by saving screenshots, chat logs and payment receipts.
- Freeze your accounts and cards and change passwords for all affected accounts.
- File a report with the police and FTC— this can help with legal action and may be required for some refund claims.
