Definition:Push payment fraud
⚠️ Push payment fraud — also known as authorized push payment (APP) fraud — occurs when a victim is deceived into voluntarily initiating a payment to an account controlled by a fraudster, and it has become a significant concern for both the insurance industry as a risk to insure and as an operational threat to insurers themselves. Unlike card fraud or unauthorized account takeovers, the defining characteristic of push payment fraud is that the transaction is authorized by the account holder, making it far harder to reverse and complicating the question of liability among policyholders, banks, and insurers. Within insurance, this fraud type surfaces in multiple contexts: as a covered peril under crime and cyber policies, as a source of claims under professional indemnity coverage when intermediaries are implicated, and as a direct threat to insurers' own treasury and claims payment operations.
🔍 The mechanics typically involve social engineering — impersonation of a trusted party such as a broker, solicitor, or vendor — combined with urgency and spoofed communications that lead the victim to transfer funds to a fraudulent account. In the insurance sector specifically, common schemes include fraudulent diversion of premium payments during policy placement, redirection of claims settlement funds, and impersonation of reinsurance counterparties in treaty payment flows. Policies that respond to push payment fraud vary in their approach: commercial crime policies may cover social engineering losses under a dedicated sublimit, while cyber policies may treat the fraud as a form of funds transfer fraud or computer crime. The coverage is often subject to callback verification requirements — the insured must demonstrate it followed prescribed authentication procedures before making the payment — and sublimits tend to be lower than the policy's overall aggregate, reflecting the frequency and severity challenges that underwriters face in pricing this exposure.
🛡️ Regulatory responses to push payment fraud have intensified, particularly in the United Kingdom, where the Payment Systems Regulator has introduced mandatory reimbursement frameworks for victims, shifting the financial burden toward payment service providers and, indirectly, toward the insurance products that backstop those providers. This regulatory momentum has created new demand for insurance coverage among banks and fintech companies seeking to transfer the reimbursement risk. For the insurance industry at large, push payment fraud underscores the growing intersection of operational risk, technology, and human behavior — a combination that challenges traditional loss modeling approaches and demands continuous adaptation in policy wording, claims handling protocols, and internal controls. As payment systems become faster and more global, the exposure is expanding well beyond the UK, prompting insurers in the United States, the EU, and Asia-Pacific to develop or refine products addressing this evolving threat.
Related concepts: