APP fraud vs card fraud: what card issuers need to know
Authorised push payment fraud and card fraud are counted separately, but scams increasingly cross between them. The 2025 numbers and what they mean for issuers.
Fraud statistics usually split into two worlds. Unauthorised fraud is when someone uses a card or account without the owner's permission. Authorised push payment (APP) fraud is when the owner is tricked into making the payment themselves, usually by bank transfer.
For card issuers, the line between the two is getting thinner.
The 2025 numbers
UK Finance's Annual Fraud Report 2026 put total UK payment fraud losses in 2025 at £1.28 billion. APP fraud losses were £576.4 million, up 19% on the year, while unauthorised fraud losses were £703.4 million. The report highlights criminals' growing use of social engineering to get victims to authorise payments themselves.
Why issuers should care
- The same scripts that drive APP fraud, such as fake bank calls and investment pitches, are used to coach card payments, including card purchases of crypto and gift cards.
- A payment the cardholder authorises passes identity checks, because the cardholder really is making it.
- Scammers also use social engineering to obtain one-time passcodes, turning an authentication step into a tool for fraud.
Asking a different question
Identity checks ask: is this the cardholder? For coached payments the answer is yes. The useful question is whether someone else is pulling the strings. That needs context from the moment of payment and a way to reach the cardholder, on their own device, before the money moves.