Banking apps make sending money quick, convenient and increasingly secure. Unfortunately, those same characteristics can help a convincing scammer turn a moment of misplaced trust into an immediate bank transfer.
The central threat is often misunderstood. Many modern banking scams do not involve criminals breaking through a bank’s technical security or somehow “hacking” the app. Instead, the criminal targets the person holding the phone. They may persuade someone to buy something that does not exist, invest in a bogus scheme, transfer money to a supposed “safe account”, disclose security information or approve a transaction.
That distinction is increasingly important. UK Finance reported that Authorised Push Payment fraud — where victims are deceived into approving payments themselves — caused £576.4 million of losses in 2025, up 19% from 2024. Some 66% of APP cases originated online, while a further 17% began through telecommunications.
This ranking uses the latest complete UK industry fraud figures available in 2026 alongside current PSR, FCA, NCSC, Financial Ombudsman and police guidance.
Key Takeaways
- Purchase scams are the biggest APP threat by volume, accounting for 71% of cases in 2025.
- Investment scams cause the greatest APP losses, reaching £221.5 million in 2025.
- A message appearing to come from a bank does not prove it is genuine. Treat instructions to transfer money to a “safe account” as a major warning sign.
- Mobile-banking account takeover remains a separate concern: mobile-banking fraud cases rose 21% to a record 25,180 in 2025.
- If money has been sent or an account may be compromised, contact the bank immediately through an official channel rather than continuing to communicate with the person who contacted you.
Brief Research Summary
UK Finance’s latest annual figures show an important shift. APP fraud losses rose strongly in 2025 even as several traditional impersonation categories declined. Purchase, investment and advance-fee scams all produced serious losses, while mobile-banking fraud cases reached their highest level yet.
UK Finance also warns that its figures count confirmed cases involving accounts rather than unique individual victims, and loss figures are generally reported gross, including money that may later be recovered. This article therefore does not describe case totals as numbers of individual victims.
The overall lesson is that banking security is only part of the problem. Criminals increasingly try to manipulate customers into performing the critical action themselves.
Comparison Table
| Rank | Scam Type | How It Commonly Starts | Banking App Risk | Typical Warning Sign | Current UK Threat Level* |
|---|---|---|---|---|---|
| 1 | Purchase scam | Marketplace, advert, social media or fake shop | Victim sends payment for non-existent goods | Pressure to use bank transfer rather than protected payment method | Very high — highest APP case volume |
| 2 | Investment scam | Social media, search advert, message or unsolicited contact | Repeated transfers to fake investment accounts | Guaranteed or unusually high returns | Very high — highest APP losses |
| 3 | Bank/police/organisation impersonation | Call, text, email or message | Victim is told to move funds or reveal information | Request to send money to a “safe account” | High, though declining in industry data |
| 4 | Phishing/smishing and banking account takeover | Fake message, login page or compromised credentials | Criminal gains unauthorised access to banking | Unexpected login, payment or security-code request | High — mobile-banking cases reached a record |
| 5 | Advance-fee scam | Advert, email, social media or bogus opportunity | Victim repeatedly transfers deposits or fees | Payment demanded before a promised benefit is released | High and rising sharply |
*These descriptions are editorial assessments based on current case volume, losses, growth and banking-app relevance; they are not official government threat classifications.
1. Purchase Scams
What it is
A purchase scam occurs when somebody pays for goods or services that do not exist or will never be supplied.
Fake electronics, vehicles, event tickets, holiday accommodation and marketplace listings can all be used as bait.
How the scam works
A criminal advertises an apparently attractive product, often through social media, an online marketplace or a convincing website.
The buyer is encouraged to deal directly with the seller and may be offered a discount for using a bank transfer. Once payment has been made, the seller disappears, stops replying or invents reasons why another payment is required.
How your banking app becomes involved
The banking app provides the final payment mechanism. A victim may manually add the criminal’s account as a new payee and approve a Faster Payment believing they are paying a genuine seller.
A bank warning during that payment journey deserves careful attention rather than being treated as an obstacle to completing the purchase.
Warning signs
Be cautious where:
- the price is substantially below the normal market price;
- the seller insists on bank transfer;
- the listing has recently appeared or the seller has little verifiable history;
- you are rushed because “other buyers are waiting”;
- the seller tries to move communication away from the marketplace;
- bank details suddenly change;
- the advertised photographs or description appear copied from another listing.
What the evidence says
Purchase scams represented 71% of APP fraud cases in 2025. UK Finance recorded 175,809 cases and £118.1 million of losses, with losses rising 20% from 2024.
That scale makes purchase fraud the strongest candidate for the number-one position even though investment scams cost victims more overall.
How to protect yourself
Use the marketplace’s established payment system where one exists. Research unfamiliar sellers independently and be especially wary where an attractive price is conditional on paying by direct transfer.
Never assume that finding a company name, photograph or positive-looking review through a quick search proves the person you are dealing with controls that business.
What to do if you have already responded
Contact your bank immediately and tell it that the transfer may have been made as part of a scam. Ask whether the payment can be stopped, traced or recovered.
Save the advert, seller profile, messages, payment details and screenshots before accounts or listings disappear.
2. Investment Scams
What it is
Investment fraud persuades people to transfer money into an investment, trading opportunity or financial product that is fake, misrepresented or controlled by criminals.
How the scam works
Contact can start through an advert, social-media post, search result, messaging app or unsolicited approach.
A polished website or apparently professional adviser may be used to establish credibility. Some scams display fictitious investment balances or apparent early profits before encouraging much larger deposits.
How your banking app becomes involved
Victims may be instructed to make one transfer and then further payments as their supposed investment grows.
A scammer may describe bank warnings as routine or encourage the customer to give the bank a misleading reason for the transaction. Instructions to conceal the genuine purpose of a payment should be treated as a severe warning sign.
Warning signs
Look for:
- unexpected investment approaches;
- guaranteed returns;
- pressure to invest immediately;
- claims of unusually high returns with little risk;
- requests to send money to accounts in unrelated names;
- instructions to ignore bank warnings;
- requests to install screen-sharing or remote-access software;
- contact details that differ from those shown by the FCA.
What the evidence says
Investment fraud produced £221.5 million of APP losses in 2025, the largest loss total of any APP scam category. Losses rose 40% year on year, while cases increased 26% to 14,893.
The FCA advises consumers to use its Firm Checker and to verify unexpected financial businesses using contact details obtained independently rather than those supplied by the caller or website.
How to protect yourself
Check whether the firm is authorised for the activity it is offering. Use the FCA’s own website to reach the Firm Checker and Warning List.
Do not rely solely on a company name or registration number. Criminals can imitate legitimate businesses.
What to do if you have already responded
Stop making further payments. Contact your bank immediately and report the firm or investment to the FCA where relevant.
Beware of a second scam promising to recover the lost investment in exchange for another payment. The FCA specifically warns that previous victims can be targeted again through these so-called recovery approaches.
3. Bank, Police and Organisation Impersonation Scams
What it is
The fraudster pretends to represent a trusted organisation — commonly a bank, police force, government department, utility provider or telecommunications company.
How the scam works
The criminal creates urgency. They may claim that suspicious payments have appeared, an account has been compromised, tax is overdue or money needs to be protected.
The classic banking version tells the victim that funds must be moved to another account for security reasons.
How your banking app becomes involved
The victim may be directed to open the genuine banking app and make the transfer personally.
This is why seeing the real app on your own phone does not make the caller genuine. The deception may be happening entirely outside the banking system.
Warning signs
Treat these as serious red flags:
- being told to transfer money to a “safe” or “secure” account;
- being rushed into making a payment;
- being told not to speak to relatives or bank staff;
- requests for passwords, PINs or one-time security codes;
- a caller claiming your normal account can no longer be trusted;
- pressure to install remote-access software;
- being instructed to misrepresent the reason for a payment.
Caller ID is not sufficient proof of identity.
What the evidence says
Police/bank impersonation produced £55.5 million of losses across 6,016 cases in 2025. Other organisation impersonation produced another £36.9 million across 18,435 cases. Both categories declined year on year, and UK Finance attributes part of the reduction to consumer education and payment warnings.
The decline is encouraging, but losses remain substantial enough to justify a top-five position.
How to protect yourself
End the unexpected conversation. Then contact the organisation independently using a number from its official website, your bank card or the authenticated banking app.
Do not use a telephone number, link or contact information provided by the person whose identity you are trying to verify.
What to do if you have already responded
Contact the bank’s fraud team immediately. If login information, passwords or security codes were disclosed, explain exactly what information was shared so the bank can secure the account appropriately.
4. PhishiXng, Smishing and Mobile-Banking Account Takeover
What it is
This category differs from the first three because it can result in an unauthorised payment.
Phishing emails, scam texts — often called smishing — and fake websites can be used to obtain passwords, personal information or banking credentials. The stolen information may then contribute to account takeover.
How the scam works
A message might claim that a parcel has been delayed, an account needs verification or suspicious banking activity has occurred.
The link may lead to a false page designed to collect information. In other situations, a victim may be persuaded to divulge security information during a telephone conversation.
How your banking app becomes involved
Once sufficient information has been compromised, criminals may attempt to obtain access to a banking account through a mobile device.
UK Finance defines mobile-banking fraud as a criminal using compromised details to access a customer’s account through a banking app and make an unauthorised transfer.
Warning signs
Watch for:
- login links arriving unexpectedly by text or email;
- prompts to install an unfamiliar app;
- unexpected authentication notifications;
- one-time passcodes you did not request;
- new-payee or transaction alerts you do not recognise;
- sudden loss of mobile service combined with unusual account activity;
- requests to read security codes to another person.
What the evidence says
UK Finance recorded 25,180 mobile-banking fraud cases in 2025, up 21% and the highest total it has reported. Losses nevertheless fell 10% to £43.9 million.
Across internet, telephone and mobile remote banking combined, 37,646 cases caused £104.4 million of losses.
The NCSC advises people who have entered banking information into a suspicious site to contact their bank immediately. Suspicious texts can be forwarded to 7726, while suspicious emails can be forwarded to the NCSC’s reporting service.
How to protect yourself
Open the banking app directly rather than through links in messages.
Keep your phone’s operating system and banking software updated, protect the device with a strong screen lock and use biometric protection where offered and appropriate.
Only install applications through legitimate app stores, and never disclose an authentication code simply because somebody claiming to represent a trusted organisation asks for it.
What to do if you have already responded
Contact your bank immediately and secure affected accounts.
For unauthorised payments, different protections apply from those covering APP fraud. FCA guidance states that consumers should report an unauthorised payment promptly; eligible unauthorised-payment refunds are generally expected by the end of the next business day, subject to applicable exceptions.
5. Advance-Fee Scams
What it is
An advance-fee scam asks someone to pay money upfront in return for a promised benefit that never arrives.
Examples can involve bogus loans, prizes, inheritances, valuable goods, rental accommodation or supposed refunds.
How the scam works
The initial fee may seem relatively modest. Once somebody pays, another problem appears: tax, insurance, administration, verification or another deposit supposedly needs paying before the money or goods can be released.
How your banking app becomes involved
Each request can appear to be an ordinary bank transfer.
Repeated transfers deserve particular scrutiny when the promised benefit remains unavailable and another payment is always required first.
Warning signs
Be sceptical where:
- money is required before winnings or funds can be released;
- a loan provider wants an unexpected upfront fee;
- a landlord demands funds before basic checks can be completed;
- additional charges keep appearing;
- the recipient account name appears unrelated;
- you are promised substantially more money than you are being asked to send;
- the person discourages independent verification.
What the evidence says
Advance-fee scam losses reached £58.4 million in 2025, up 65%, while case numbers rose 38% to 24,080.
UK Finance described the 2025 loss figure as the highest it had recorded and said intelligence suggested part of the rise involved deposits for non-existent high-value goods and holiday rentals.
How to protect yourself
Verify the underlying business or opportunity independently before paying.
For regulated financial products such as loans or investments, check the relevant FCA information rather than relying on paperwork supplied by the person requesting the fee.
What to do if you have already responded
Do not pay any additional “release”, “recovery” or administration fee.
Contact your bank immediately and keep copies of every request, transaction and conversation.
What These Scams Have in Common
The subject changes, but the psychological techniques are remarkably consistent.
Fraudsters commonly use:
- Urgency: “Do this now.”
- Fear: “Your account is being emptied.”
- Authority: “I am calling from your bank.”
- Scarcity: “Someone else will buy it unless you pay.”
- Secrecy: “Don’t tell anybody about the investigation.”
- Trust: building a relationship before requesting money.
- Escalation: starting with a small payment before requesting larger sums.
- Isolation: discouraging the victim from checking with another person.
- Security-code requests: asking for information that can help authorise activity.
The important point is that a criminal does not have to defeat the banking app’s security if they can persuade its legitimate user to approve the transaction.
How to Make Your Banking App Safer
Use this practical checklist:
- Protect your phone with a strong passcode, fingerprint or facial authentication where appropriate.
- Keep the phone’s operating system and banking app updated.
- Open banking apps directly rather than from links in messages.
- Never share PINs, passwords or one-time passcodes with callers.
- Read payment warnings rather than automatically dismissing them.
- Check the payee name and account details before approving transfers.
- Turn on transaction and security notifications where your bank offers them.
- Review payment limits if your bank provides adjustable controls.
- Secure the email account and mobile number linked to your banking profile.
- Contact your bank through its official app, website or verified telephone number when something appears suspicious.
What UK APP Fraud Reimbursement Rules Actually Cover
The mandatory APP reimbursement regime started on 7 October 2024.
For qualifying scams, it covers APP payments made by individuals, microenterprises and charities through UK Faster Payments and CHAPS. The normal maximum reimbursement is £85,000 per claim. Providers can apply an excess of up to £100, although the excess cannot be applied to customers treated as vulnerable.
Eligible claims should normally be reimbursed within five business days. A provider can pause the timetable while obtaining necessary information, but an outcome should generally be reached within 35 business days. Claims can normally be denied if submitted more than 13 months after the final relevant payment.
There are important exclusions. The mandatory rules do not automatically cover every situation involving lost money. Among the exclusions are genuine civil disputes, payments through payment systems outside the regime, international payments and payments made before 7 October 2024. Payments involving certain onward cryptocurrency transactions can also fall outside the mandatory regime.
A provider can also refuse reimbursement where it proves fraud by the claimant or, for a non-vulnerable consumer, gross negligence under the consumer standard of caution. The PSR describes gross negligence as a high threshold; the burden of demonstrating it rests with the payment provider.
Current PSR data are encouraging: between 7 October 2024 and 31 March 2026, 88% of money lost in in-scope APP scam claims was reimbursed, while 82% of claims were closed within five business days and 98% within 35 business days. That does not mean every scam payment is eligible.
What to Do If You Think You’ve Been Scammed
1. Contact Your Bank Immediately
Use the official banking app, telephone number printed on your card or another independently verified channel.
Explain that you believe fraud has occurred and identify the transactions involved.
2. Ask Whether the Payment Can Be Stopped or Recovered
Speed matters. The recipient may move money rapidly after receiving it.
Ask whether the payment can be recalled or whether the beneficiary bank can be contacted.
3. Secure Compromised Accounts
Change affected passwords, particularly where the same credentials were reused elsewhere.
If security information may have been disclosed, tell the bank exactly what happened rather than simply changing a password and assuming the problem is resolved.
4. Report the Fraud
Report Fraud is now the national reporting service for fraud and cyber crime in England, Wales and Northern Ireland, replacing Action Fraud. Reports can be made online or by calling 0300 123 2040.
People in Scotland should contact Police Scotland on 101 for fraud reporting.
5. Preserve Evidence
Keep:
- screenshots
- emails and text messages
- usernames and profile details
- payment confirmations
- bank references
- telephone numbers
- dates and times
- website addresses
- correspondence with the seller or alleged organisation.
Do not continue communicating with a scammer merely to gather more evidence.
6. Challenge an Unsatisfactory Reimbursement Decision
First make a formal complaint to the bank or payment provider.
For fraud, scam and payment-service complaints, Financial Ombudsman Service guidance says firms generally have 15 days to consider the complaint, with provisions for cases requiring longer investigation. If you remain dissatisfied with the final response, or the relevant response period passes, you may be able to refer the matter to the Financial Ombudsman Service. A referral normally needs to be made within six months of the firm’s final response.
Frequently Asked Questions
What is an authorised push payment (APP) scam?
An authorised push payment scam happens when a criminal tricks someone into approving a bank transfer themselves. The payment may be made through a banking app using Faster Payments or another eligible payment system. The crucial point is that the customer authorises the transaction because they believe the criminal’s story.
Can scammers hack my banking app?
Some criminals do try to gain unauthorised access to mobile-banking accounts, but many banking-app scams rely on social engineering instead. Fraudsters may persuade victims to reveal information, approve a payment or transfer money to an account controlled by the scammer.
Will my bank refund me if I fall victim to an APP scam?
Not automatically. Mandatory UK APP scam reimbursement rules cover many qualifying Faster Payments and CHAPS claims made from 7 October 2024, with a maximum reimbursement level of £85,000 per eligible claim. Exclusions and customer responsibilities apply, so reimbursement depends on the circumstances.
Will a bank ever ask me to transfer money to a safe account?
A request to move money to a supposedly “safe”, “secure” or “protected” account is a major scam warning sign. If someone claiming to represent your bank makes such a request, end the contact and independently contact your bank through its official app, website or verified telephone number.
What should I do if I have transferred money to a scammer?
Contact your bank immediately and explain that you believe you have made a fraudulent payment. Ask whether the transfer can be stopped or recovered. Keep payment records, messages and screenshots, and report the fraud through the appropriate official reporting service.
Where should I report an online banking scam in the UK?
People in England, Wales and Northern Ireland can report fraud and cyber crime through Report Fraud. People in Scotland should report fraud to Police Scotland on 101.
What is the biggest warning sign of a banking-app scam?
Unexpected pressure to act quickly is one of the strongest warning signs. Be particularly cautious if somebody asks you to transfer money, share a security code, install software, keep the conversation secret or ignore a warning displayed by your bank.
Can a scammer make their phone number look like my bank’s number?
Caller information should never be treated as proof that a caller is genuine. If you receive an unexpected financial request, end the call and contact your bank independently using trusted contact details.
Are purchase scams covered by APP fraud protections?
A purchase scam may fall within APP reimbursement protections if it meets the relevant eligibility requirements. However, genuine civil disputes — such as disagreements over the quality of legitimately purchased goods or services — are not automatically treated as APP scams under the reimbursement regime.
How can I make my banking app safer?
Keep your phone and banking app updated, use a strong device passcode and biometric authentication where available, activate transaction alerts, check payment details carefully and never disclose passwords, PINs or one-time security codes to unexpected callers.
Conclusion
The strongest fraud trend is not that criminals have suddenly learned to break every banking app. It is that deception can sometimes achieve what technical attacks cannot.
Purchase scams exploit the desire for a good deal. Investment scams exploit the promise of financial gain. Impersonation scams exploit authority and fear. Phishing targets security information. Advance-fee fraud exploits the belief that one final payment will unlock something valuable.
A simple habit can interrupt all five: stop before acting on an unexpected request and verify it independently.
If somebody tells you that your money, investment, purchase or account is at immediate risk, do not let their urgency set your timetable. End the contact, open your bank’s genuine app or find its official contact details yourself, and check before approving anything.
Editorial Disclaimer
This article provides general fraud-prevention and consumer information only. It does not constitute financial, legal or cybersecurity advice. Fraud circumstances and reimbursement eligibility vary, so contact your bank, the relevant regulator, police reporting service or a qualified adviser for guidance on a specific case.
Last Checked: 24 August 2026 | Review Due: November 2026