Back to Cases
Identity Theft UK 2022

The UK Authorised Push Payment Fraud Epidemic

UK consumers lost £485 million in a single year to scams where they were tricked into authorising bank transfers.

£485 millionTotal Losses
200,000+ casesVictims Affected
UK FinanceSource

Timeline: How It Unfolded

Throughout 2022

Scammers use a combination of spoofed phone calls, fake emails, and cloned websites to trick UK consumers into transferring money from their bank accounts.

Common scenario

A victim receives a call that appears to come from their bank's fraud department. The "agent" says they've detected a suspicious transaction and the victim must transfer their money to a "safe account" immediately.

The trap

The victim, believing they're protecting their money, transfers thousands of pounds to an account controlled by the scammers.

After transfer

The money is moved through multiple accounts within minutes and often sent overseas, making recovery extremely difficult.

May 2023

UK Finance publishes its 2022 Annual Fraud Report, revealing £485.2 million in APP fraud losses across 207,372 cases for the full year 2022. £287.3 million (62%) was returned to victims. The Payment Systems Regulator announces new mandatory reimbursement rules.

How the Scam Worked

  • Scammers combined multiple techniques: spoofed caller ID showing the bank's real number, knowledge of the victim's name and partial account details (often from data breaches), and professional-sounding scripts.
  • The "safe account" trick exploits the victim's desire to protect their money — they authorise the transfer themselves, making it harder for banks to prevent or reverse.
  • Some scams involved impersonating the police, telling victims their bank was involved in fraud and they needed to move money to a "clean" account.
  • Data from previous breaches gave scammers enough personal information to sound legitimate during the call.

Red Flags That Were Missed

Banks never ask you to transfer money to a "safe account" — there is no such thing
The caller ID showed the bank's number, but caller ID can be spoofed
The request created extreme urgency — "you must act now to protect your money"
The caller asked the victim to keep the call secret from branch staff
The caller discouraged the victim from hanging up and calling the bank back

What You Should Learn From This

Your bank will NEVER ask you to transfer money to another account for "safekeeping." If someone says this, it is always a scam.
The police will never call and ask you to move money or keep a transaction secret.
If someone calls claiming to be from your bank, hang up, wait 5 minutes, and call the number on the back of your card.
In the UK, the Contingent Reimbursement Model now means most banks will reimburse APP fraud victims — but prevention is always better.
Share the phrase "Take Five" — the UK campaign encouraging people to stop and think for 5 minutes before making any financial decision prompted by a call or message.

Outcome

The Payment Systems Regulator introduced mandatory reimbursement rules effective October 2024, requiring banks to refund APP fraud victims within 5 business days. This was a major shift in accountability from victims to financial institutions.