Authorized Push Payment (APP) fraud is one of the most damaging forms of digital deception. The pattern repeats itself thousands of times each year: an email from the bank’s security team warning of suspicious activity. A phone call that follows immediately. The caller ID matches. The “fraud prevention officer” knows details about recent transactions.
Within minutes, the victim authorizes a transfer to “protect” their savings — often tens of thousands of pounds. The realization comes too late. The money is already gone. This is Authorised Push Payment (APP) fraud — a crime where the victim themselves, under manipulation, authorizes the transfer. Unlike unauthorized fraud where criminals break into accounts, APP fraud weaponizes human psychology. The victim willingly — though unknowingly — hands over their money.
Read more…
Source: Group IB
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Halifax and Lloyds customers hit by online data breach
March 12, 2026
Lloyds, Halifax and Bank of Scotland customers were given access to strangers’ banking transactions in a major online data breach this morning. Customers were able to view charges and payments on their banking apps that were not linked to their own transactions following the suspected technical glitch. Wage payments, HMRC reference numbers and other personal transactions were ...
- BeatBanker: A dual‑mode Android Trojan
March 10, 2026
Recently, Kaspersky researchers uncovered BeatBanker, an Android‑based malware campaign targeting Brazil. It spreads primarily through phishing attacks via a website disguised as the Google Play Store. To achieve their goals, the malicious APKs carry multiple components, including a cryptocurrency miner and a banking Trojan capable of completely hijacking the device and spoofing screens, among other ...
- Taiwan Indicts 62 Over Laundering $339M From Crypto Scam Compounds in Cambodia
March 4, 2026
Taiwanese prosecutors have indicted 62 people over their alleged links to Prince Group, a network designated as a transnational criminal organization by the U.S. Department of Justice. According to a report by Reuters, those indicted include the group’s chairman and alleged mastermind Chen Zhi, who was arrested in Cambodia and extradited to China earlier this year.Thirteen ...
- CIMB refutes claims of data breach involving 1.2 million records
March 4, 2026
CIMB Group Holdings Bhd has given assurance that claims circulating online about a data breach involving its customers are false and that customer data continues to be protected. The financial services provider said on social media platform X that its security teams have verified that all systems are secure and that customer data remains fully safeguarded. ...
- Hacker gained access to PayPal systems resulting in unauthorised transactions
February 22, 2026
Some PayPal users have started to receive email from the company confirming a data breach that exposed personal information to a threat actor who gained access to PayPal’s systems, leading to some seeing unauthorized transactions on their accounts and the resetting of passwords. A breach notification letter, which the authors have verified, has confirmed that some ...
- FBI: Increase in malware enabled ATM jackpotting incidents across United States
February 19, 2026
The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate indicators of compromise (IOCs) and technical details associated with malware enabled ATM jackpotting. Threat actors exploit physical and software vulnerabilities in ATMs and deploy malware to dispense cash without a legitimate transaction. The FBI has observed an increase in ATM jackpotting incidents across the ...