Guidance Note: Recognising and Preventing Authorised Push Payment Fraud

Purpose

Authorised push payment (APP) fraud occurs when a customer is manipulated into authorising a payment to an account controlled by a fraudster. Because customers make the payment themselves, often using their own credentials and devices, controls designed to detect unauthorised access may not identify it. This guidance note helps member banks and their staff to recognise APP fraud, intervene effectively and support customers who are affected.

It is industry guidance. It does not replace each bank's own policies, nor any requirements of the Central Bank of The Gambia.

Why APP fraud matters

As payments become faster and more convenient, the window for stopping a fraudulent payment narrows. Once funds have been moved on from the receiving account, recovery becomes difficult. Losses can be severe for individual customers, and repeated incidents erode public confidence in digital payments.

Common typologies

• Impersonation of a bank, a regulator, a government agency or the police: the fraudster claims the customer's account is at risk and instructs them to move money to a so-called safe account.
• Impersonation of a relative or friend: often by message from a new number, describing an emergency and asking for urgent help.
• Invoice and payment-redirection fraud: a business receives a message, apparently from a supplier, advising of changed bank details.
• Purchase scams: goods or services advertised online, often at attractive prices, which never arrive after payment.
• Investment scams: promises of high or guaranteed returns, sometimes involving digital assets or unfamiliar schemes.
• Romance scams: a relationship built online over time, followed by requests for money.
• Job and advance-fee scams: payment requested for application fees, visas, training, or the release of a supposed prize or inheritance.

Red flags

In the customer's behaviour

• Urgency, anxiety or reluctance to explain the purpose of a payment.
• Being on the telephone with someone while making the transaction, or appearing to have been coached on what to say.
• A payment that is unusual for the customer in amount, destination or frequency.
• Statements that the customer has been told not to tell the bank, or that bank staff may be involved in fraud.
• Requests to withdraw large sums in cash, or to open new accounts or channels quickly.

In the transaction

• A first payment to a new payee, especially of a large amount.
• A recent change of contact details or device on the account, followed by a payment.
• Several payments in quick succession, or attempts to work around limits.
• A receiving account that has recently been opened or shows funds passing rapidly through it.

Staff interventions

Staff in branches and contact centres, and those supervising agents, can play a decisive role. Where red flags are present, staff should:

1. Pause and ask open questions about the purpose of the payment, how the customer came to make it and who they have been in contact with.
2. Explain, in plain terms, the scam that the circumstances suggest, and that the bank will never ask a customer to move money to a safe account.
3. Encourage the customer to verify the request independently, using contact details they already hold rather than those supplied by the caller or message.
4. Escalate to a supervisor or the fraud team in line with the bank's procedures where concern remains.
5. Record the conversation and its outcome, including where the customer chooses to proceed.

Staff should be respectful and avoid embarrassing the customer. Fraudsters are skilled and persuasive, and victims are not to blame.

Customer messaging

Consistent messages across the industry are more likely to be remembered. Member banks are encouraged to use simple, repeated messages such as:

• Your bank will never ask you to move money to a safe account.
• Never share your PIN, password or one-time passcode with anyone, including someone who says they are from your bank.
• If a message creates urgency or pressure, stop and check with someone you trust.
• Confirm any change of bank details by contacting the supplier using details you already have.
• If something feels wrong, contact your bank straight away using the number on your card or statement.

When fraud occurs

Speed is critical. Banks should provide a clear route for customers to report suspected fraud at any time, act promptly to contact the receiving institution and request that funds be frozen where possible, and keep the customer informed. Receiving banks should respond to such requests without delay, in accordance with the law and their procedures. Affected customers should be treated with care and directed to the bank's complaint procedure if they are dissatisfied with the outcome.

Reporting

Where staff know or suspect that funds represent the proceeds of crime, they must follow internal procedures for reporting to the bank's money laundering reporting officer, who will consider whether a suspicious transaction report should be made to the Financial Intelligence Unit. Banks should also report incidents to the Central Bank and to law-enforcement authorities as required. Anonymised information on emerging typologies may be shared with the Secretariat to help the Risk Management & Cybersecurity Committee keep this guidance up to date.