What push payment fraud is

Push payment fraud is when someone tricks you into sending money directly from your own bank account to an account they control. You authorize the transfer yourself—the fraudster doesn't steal your login credentials or forge your signature. Instead, they manipulate you into believing you're paying a legitimate bill, transferring funds to a trusted person, or solving an urgent problem. Once the money leaves your account, it's gone almost when ready, and getting it back is difficult.

The key difference from other fraud: you are the one who pushes the money out. A hacker doesn't need to break into your bank account. A scammer doesn't need your debit card number. They just need to convince you that sending them money is the right thing to do.

Push payment fraud is also called authorized push payment (APP) fraud or social engineering fraud. It's one of the fastest-growing types of financial crime because it exploits human judgment rather than weak passwords or outdated security.

Key Takeaways

  • Push payment fraud happens when you voluntarily send money to a fraudster's account after being tricked into believing the payment is legitimate.
  • Common scenarios include fake invoices from vendors, impersonation of someone you trust, urgent requests from authority figures, and romance scams.
  • Once money is sent via bank transfer or wire, it typically reaches the fraudster's account within hours and is withdrawn or moved before your bank can stop it.
  • Your bank may not refund you because you authorized the payment, though some banks now offer limited protection under newer fraud policies.
  • The best defense is verification: call the person or business directly using a number you find independently, never one provided in the message asking for payment.

How the fraud actually happens

A fraudster contacts you through email, text, phone call, or social media. They impersonate someone you trust—your boss, your bank, a vendor you work with, a family member, a romantic partner—or they pose as an authority figure like a tax official or law enforcement. The message creates urgency: your account will be closed, a payment is overdue, a legal problem needs when ready attention, or someone you care about is in danger.

They ask you to send money to a specific account. Sometimes they provide detailed instructions. Sometimes they ask you to set up a wire transfer, initiate an ACH transfer, or use a peer-to-peer payment app. You log into your own bank account, using your own credentials, and send the money yourself. From your bank's perspective, the transaction looks completely normal—an authorized transfer from an account holder to a recipient of their choice.

By the time you realize something is wrong—the person you thought you were paying calls to ask why you sent money, or you discover the invoice was fake—the fraudster has already withdrawn the funds or moved them to another account. Your bank receives your fraud report hours or days later, but the money is gone.

Common scenarios and how they're set up

CEO fraud (business email compromise): A fraudster sends an email that looks like it came from your company's CEO or finance director, asking you to wire funds for an urgent acquisition, a confidential project, or a time-sensitive payment. The email address is slightly off, or the fraudster has compromised the actual company email account. You send the money to a bank account you've never used before, but the request came from someone you recognize.

Vendor impersonation: You receive an invoice from a vendor your company regularly pays. The invoice looks legitimate, but the bank details have been changed. You process the payment as usual, sending money to what you believe is the vendor's account. The vendor later contacts you asking why payment hasn't arrived.

Romance scams: Someone builds a relationship with you online over weeks or months, then claims to need money for an emergency—a medical bill, a business opportunity, travel costs to meet you. You send money via wire transfer or peer-to-peer payment. The person disappears or asks for more money.

Authority impersonation: You receive a call or email from someone claiming to be from the IRS, your bank, or law enforcement. They say you owe money, your account has been compromised, or you're involved in a legal matter. They pressure you to send money when ready to resolve it. The number they provide is spoofed to look like it came from a government agency.

Family emergency scams: Someone calls claiming to be a family member in crisis—arrested, in an accident, stranded abroad. They ask you to send money when ready and tell you not to contact other family members because it would embarrass them. You wire money before you can verify the story.

Why banks struggle to stop it and recover the money

When you report push payment fraud to your bank, the bank faces a legal and practical problem: you authorized the payment. You logged in with your credentials. You approved the transfer. From a technical standpoint, the transaction is valid.

In the United States, banks are not required by federal law to refund push payment fraud. The Electronic Funds Transfer Act (EFTA) protects you against unauthorized transfers—someone using your card or account without permission—but not against transfers you authorized, even if you were deceived into authorizing them. This is different from credit card fraud, where you have stronger protections.

Even when a bank wants to help, the money is often already gone. Wire transfers and ACH transfers move quickly. A fraudster who receives the funds when ready withdraws them or transfers them to another account, often at a different bank or in a different country. By the time your bank contacts the receiving bank to freeze the account, the money has moved again.

Some banks now offer push payment fraud protection or confirmation of payee (CoP) services, which verify that the name on the receiving account matches the name you provide. If there's a mismatch, the bank alerts you. But this protection is not universal, and it only works if both banks participate in the system.

What to do if you've sent money to a fraudster

Contact your bank when ready. Call the number on the back of your card or statement—not a number from the email or message that asked for the payment. Tell them you sent money as a result of fraud and provide the receiving account details, the amount, and the date of the transfer.

Your bank can attempt to recall the transfer, but success depends on how much time has passed and whether the receiving bank cooperates. If the money has already been withdrawn, recall is unlikely to work. Ask your bank whether they offer any fraud reimbursement or whether the receiving bank has frozen the account.

File a report with the Federal Trade Commission (FTC) at reportfraud.ftc.gov. This creates an official record and helps law enforcement track fraud patterns. Include all details: how you were contacted, what story was used, the account information you sent money to, and any communications you have.

If the fraud involved impersonation of a government agency, also file a report with that agency. If it was IRS impersonation, report it to the Treasury Inspector General for Tax Administration (TIGTA). If it involved a bank impersonation, report it to the Consumer Financial Protection Bureau (CFPB).

Report the incident to local law enforcement and ask for a case number. This may be necessary if you need to dispute the transaction with your bank or if the fraud is part of a larger investigation.

How to protect yourself from push payment fraud

Verify before you pay. If someone asks you to send money, contact them directly using a phone number or email address you find independently—not one provided in the message asking for payment. Call your company's main line and ask to be transferred to the person who requested the payment. Visit the official website of a business or agency and use the contact information there. This single step stops most push payment fraud.

Be suspicious of urgency. Legitimate businesses and government agencies rarely demand when ready payment with threats of account closure or legal action. If someone is pressuring you to send money right now without time to verify, it's a red flag.

Never send money to someone you've only met online. Romance scams rely on emotional connection and time investment. If someone you've never met in person is asking for money, the relationship is not what it appears to be.

Check email addresses and phone numbers carefully. Fraudsters use addresses that look similar to legitimate ones—a zero instead of the letter O, a slightly different domain name. Hover over links before clicking them to see the actual URL. Caller ID can be spoofed, so don't trust it as proof of identity.

Use your bank's verification tools. If your bank offers confirmation of payee or push payment fraud protection, enable it. Some banks also allow you to set up transaction limits or require additional verification for large transfers.

Set up alerts. Ask your bank to notify you of large transfers or transfers to new accounts. This gives you a chance to stop a fraudulent transaction before it completes.

Frequently Asked Questions

Can my bank refund push payment fraud?

Federal law does not require banks to refund authorized transfers, even if you were tricked into authorizing them. However, some banks now offer voluntary fraud reimbursement programs or have agreed to refund push payment fraud under certain conditions. Contact your bank when ready to ask what they can do. The sooner you report it, the better your chances.

What's the difference between push payment fraud and wire fraud?

Push payment fraud is the broader category—you send money because you were deceived. Wire fraud is a specific crime under federal law that involves using electronic communications (email, phone, internet) to commit fraud. If you were tricked into sending a wire transfer, that's both push payment fraud and wire fraud. Wire fraud is a federal crime, so the FBI may investigate.

How long does it take to recover money from push payment fraud?

Recovery is unlikely if the money has been withdrawn. If the receiving bank freezes the account quickly, recovery may take weeks or months and depends on cooperation between banks and law enforcement. Most push payment fraud victims do not recover their money. Prevention is far more effective than recovery.

Will my bank close my account if I fall for a scam?

Banks do not close accounts because a customer was defrauded. However, if you are repeatedly targeted by scams or if your account is used to receive stolen funds, the bank may close it for other reasons. Being a fraud victim does not put your account at risk.

What if the fraudster used a fake name or spoofed number?

Report it to the FTC and your local police, but understand that tracing spoofed calls or fake identities is difficult. Law enforcement can investigate if the fraud is part of a larger scheme, but individual cases are often not prioritized unless large amounts of money are involved. Focus on preventing future fraud rather than recovering past losses.