Authenticated doesn’t mean safe

One of the harder forms of fraud to fight is when a person or business is manipulated into making a payment to an account controlled by a fraudster. This is known as “authorised push payment” fraud (APP fraud) and it happens in the form of purchase and investment scams, romance scams, impersonation scams, and invoice redirection. 

Absa’s recently released 2026 interim results show it and its customers lost R129-million in the first half of 2026, largely attributed to digital fraud in personal banking, specifically social engineering. Fraudsters don’t need to hack into systems if they convince someone to make the payment themselves. 

But there is hope. In the early 2000s, card skimming represented a major threat, but the adoption of EMV chip-and-PIN technology, as well as contactless payments neutralised it enormously. 

Today, a bank’s system sees a legitimate customer executing a transaction, on a recognised device, entering the correct credentials but behavioural intelligence can detect the signals of APP fraud and intervene before it is too late. 

How it works 

APP fraud can be initiated through nearly any form of contact: a phone call, email, text or even a fake ad. What matters is that the fraudster on the other side will have a very plausible story. 

They could claim to be calling from your bank with an urgent reason for doing so, such as checking up on an unusual transaction (the cruel irony). They may even run through the standard identity verification screening that your bank does. 

In each case, the fraudster needs to establish trust, and sometimes urgency, to provoke action. With the use of AI, the scams feel very credible for many people and it’s what makes APP fraud so insidious. 

The fraudster’s goal is to get you to make a payment into an account they control. From there the money is laundered through a vast network of mule accounts becoming untraceable. This makes APP fraud a common target for transnational criminal syndicates. No flags are set off and the bank hears about it from the customer, sometimes days after because customers feel embarrassed or confused. 

Detecting APP fraud through layers of signals  

Behavioural intelligence layers transaction, behaviour and beneficiary signals into the likelihood that a payment is being made to a fraudster. The signals can be measured against the customer’s history or against known fraud patterns. 

On the transaction side, this means analysing what the customer does: staying on a call while the banking app is in session, adding a new beneficiary followed by a large transfer, or transacting at an unusual time of day. 

On the behaviour side, it means watching the way customers interact with their app rather than just what they type into it. Long hesitation on the confirmation screen, a pasted-in account number, and repeated edits to the same field may all be markers of a customer being coached through a payment. 

Lastly, on the beneficiary side: a new account drawing a large payment from a sender with no prior relationship, or an account that empties within minutes of receiving funds. 

None of these signals prove fraud on their own, but when taken together, could allow fraud and risk teams enough time to intervene before the money is gone. 

This changes where banks and payment providers look for risk. Evaluating the payment itself, not just the credentials behind it, makes it possible to catch suspicious patterns early enough to act.

Customer education can only do so much when the scam itself is engineered to be imperceptible, even to trained professionals. Behavioural intelligence can enable us to detect when authenticated and authorised don’t add up to safe.