Fraud Prevention

Frequently asked questions

What is APP fraud?

Authorised push payment (APP) fraud is where a customer is tricked into authorising a payment to a criminal, often through impersonation or a fake invoice. Because the customer authorises it, traditional unauthorised-transaction protections do not apply, which is why the UK introduced a mandatory reimbursement framework overseen by the Payment Systems Regulator (PSR).

Who needs fraud prevention training?

Customer-facing, operations and finance staff across regulated firms benefit most, as they are most likely to encounter fraud and best placed to stop it. The FCA expects firms to maintain effective systems and controls to detect and deter fraud, and trained staff are central to recognising impersonation and escalating concerns quickly.

What are the firm's APP fraud reimbursement obligations?

Under the Payment Systems Regulator's mandatory reimbursement scheme, payment firms within scope must reimburse victims of APP fraud, with the cost generally shared between the sending and receiving firms. Training helps staff prevent fraud at source and understand when reimbursement obligations are triggered, reducing both losses and customer harm.

What is the difference between internal and external fraud?

Internal fraud is committed by people inside the business, such as employees or contractors abusing access or trust. External fraud is driven by outside criminals, often through social engineering, impersonation or APP scams. Both rely on control weaknesses that staff are frequently best placed to spot, which is why firm-wide awareness matters.

How does the failure to prevent fraud offence affect firms?

The Economic Crime and Corporate Transparency Act 2023 introduced a corporate offence of failure to prevent fraud for large organisations. A firm can be liable where an associated person commits fraud for its benefit, unless it had reasonable fraud-prevention procedures. Staff training is a core part of demonstrating those procedures.

How does fraud prevention relate to AML?

Fraud and money laundering are closely linked: fraud often generates the criminal proceeds that are later laundered, and the same red flags and reporting routes frequently apply. Effective fraud controls support a firm's AML obligations under the MLR 2017, and suspicions identified through fraud detection may need escalation to the MLRO.

What records should firms keep on fraud prevention?

Firms should retain records of fraud-prevention training and completion, fraud risk assessments, reported incidents and the actions taken, and the controls in place. These records support the FCA's expectation of effective systems and controls and help evidence the reasonable procedures relevant to the failure-to-prevent-fraud offence.