APP fraud losses in the US could reach $15 billion by 2028. The attacks work because the person sending the money was convinced by someone impersonating a brand they trust.
In July 2026, Forbes reported on a lawsuit working its way through New York courts that could reshape how American banks handle fraud. New York’s attorney general had filed against Early Warning Services, the company behind Zelle, arguing that the platform failed to protect consumers from scam-induced transfers. The American Bankers Association and a coalition of trade groups filed an amicus brief urging the court to throw the case out. At the center of the dispute was a distinction that has haunted payment fraud regulation for decades: when a customer authorizes a transfer because they were deceived, who bears the loss?
Federal law provides a clear answer for unauthorized transactions. Regulation E, implementing the Electronic Fund Transfer Act, makes banks liable when money moves without the customer’s consent. But authorized push payment fraud operates in the gap. The customer did consent. They pressed send. They were deceived into doing it, but the authorization was real. Under current US law, that distinction leaves the victim with no reimbursement right and the institution with no obligation to cover the loss.
The UK named this problem, legislated for it, and mandated that banks reimburse victims. The US has not. And the losses keep compounding.
How large the problem has become
Deloitte’s Center for Financial Services published projections in June 2026 estimating that US authorized push payment fraud losses could reach $14.9 billion by 2028, up from an estimated $8.3 billion in 2024. In an aggressive scenario where AI-driven APP fraud outpaces defenses, losses could reach $18.2 billion. APP fraud has tripled in reported losses since 2022 according to FTC and Federal Reserve data, and the trajectory has not flattened.
Investment scams account for the largest share of growth. Romance imposter schemes and bank impersonation follow. What connects them is the mechanism: in every variant, the attacker impersonates a trusted institution or relationship to convince the victim to send money through a legitimate payment channel. The payment itself is real. The rails are real. The authorization is real. Only the reason for sending it was fabricated.
The FBI’s Internet Crime Complaint Center has tracked a specific variant it calls “phantom hacker” scams since 2023: layered social engineering attacks where the victim is contacted first by someone impersonating tech support, then by someone impersonating their bank, then by someone impersonating a government official. Each layer reinforces the urgency established by the previous one. By the time the victim transfers their savings to a “protected” account, they have been manipulated through three separate impersonation surfaces, each borrowing the authority of a different institution.
Why the liability question matters for brands
The regulatory debate over APP fraud liability is typically framed as a consumer protection question: should banks reimburse victims of scam-induced transfers? That framing is important, but it misses the dimension that connects APP fraud to brand protection.
Every APP fraud attack begins with impersonation. Someone pretending to be the victim’s bank. Someone pretending to be a government agency. Someone pretending to be a vendor with a legitimate invoice. The institution being impersonated does not initiate the fraud, but it provides the trust that makes the fraud work. When a customer sends money because someone convincingly impersonated their bank’s fraud department, the customer’s experience of the event is inseparable from the bank’s brand. The anger, the loss of trust, and the complaint that follows are all directed at the institution whose name was used.
As liability shifts toward financial institutions, whether through legislation, regulation, or litigation like the Zelle case, the financial incentive to prevent APP fraud at its source intensifies. Preventing the social engineering that powers APP fraud means detecting the impersonation infrastructure before it reaches the customer: the spoofed phone numbers that display the bank’s name on caller ID, the lookalike domains that host fake login portals, and the fabricated social media profiles that establish the attacker’s credibility.
Where regulation stands in 2026
The UK moved first. In October 2024, the Payment Systems Regulator mandated that payment service providers reimburse APP fraud victims up to £85,000, with liability shared between the sending and receiving institutions. The mandate created a direct financial incentive for banks to invest in fraud prevention rather than absorb losses after the fact.
The US has moved more slowly, but the trajectory is accelerating. The Protecting Consumers from Payment Scams Act, introduced as part of the bipartisan TRAPS Act in June 2025, proposes expanding the definition of “unauthorized electronic funds transfer” under Regulation E to include transfers that were authorized by the consumer but induced through fraud. If enacted, it would fundamentally reshape liability allocation across the US banking sector.
The CFPB’s own rulemaking on authorized push payment liability is active, with a final rule possible in 2026 that would formalize reimbursement obligations. The New York Zelle lawsuit is testing these questions in the courts without waiting for legislation. Australia’s Scam Prevention Framework targets financial institutions, telecommunications, and digital platforms with potential fines for non-compliance. The EU’s Third Payment Services Directive will shift liability further toward providers.
Across jurisdictions, the direction is the same: the institution that enables the payment is increasingly expected to prevent the fraud that abuses it, and “the customer authorized it” is becoming a weaker defense.
The brand protection connection
For organizations whose brands are used as pretexts in APP fraud campaigns, the exposure operates on two levels.
The direct level is reputational. Customers who lose money to someone impersonating their bank, their brokerage, or their utility company associate the experience with the brand, not with the anonymous attacker. Customer research consistently shows that victims blame the impersonated institution whether or not it was technically at fault.
The regulatory level is financial. As liability shifts toward institutions, every successful APP fraud attack becomes a potential reimbursement obligation. Organizations that can demonstrate they were monitoring for the impersonation infrastructure that powers these campaigns, the spoofed numbers, the fake domains, the fabricated profiles, establish a defensive posture that strengthens their position in both regulatory and litigation contexts. Organizations that cannot demonstrate that monitoring face an increasingly difficult argument that they took reasonable steps to prevent fraud conducted under their name.
The Bottom Line
Authorized push payment fraud has tripled in US losses since 2022, with projections reaching $15 billion by 2028. Every APP fraud attack begins with impersonation: someone borrowing the authority of a bank, a vendor, or a government agency to convince a victim to send money through a legitimate channel. The liability landscape is shifting, through UK mandates, proposed US legislation, CFPB rulemaking, and active litigation, toward holding institutions accountable for fraud conducted under their names. For organizations whose brands are the trust mechanism these attacks exploit, detecting the impersonation infrastructure before it reaches the customer is no longer just a security investment. It is increasingly a regulatory and legal requirement.
Key Takeaways
Authorized push payment fraud occurs when a victim is deceived into voluntarily sending money to an attacker through a legitimate payment channel. Unlike unauthorized fraud where the attacker moves money without consent, APP fraud victims authorize the transfer themselves, typically because the attacker impersonated a trusted institution such as their bank, a government agency, or a vendor. US losses are projected to reach $14.9 billion by 2028.
The Electronic Fund Transfer Act and Regulation E require banks to reimburse customers for unauthorized transactions but explicitly exclude transfers that the customer authorized, even if the authorization was obtained through fraud. Courts have reached inconsistent conclusions on whether common law claims can fill this gap, leaving victims with no uniform right to reimbursement.
Every APP fraud attack begins with impersonation. The attacker pretends to be the victim’s bank, a government agency, a tech support provider, or a vendor. The trust the victim places in the impersonated institution is what makes the fraud work. The impersonated organization bears the reputational damage and, increasingly, the financial liability.
The UK mandated reimbursement up to £85,000 in October 2024. The US Protecting Consumers from Payment Scams Act proposes extending Regulation E to cover fraud-induced authorized transfers. The CFPB has an active rulemaking on APP fraud liability. New York’s attorney general filed against Zelle’s parent company in 2026. Australia and the EU are implementing similar frameworks.
Monitor for the impersonation infrastructure that powers APP fraud campaigns: spoofed phone numbers displaying the organization’s caller ID, lookalike domains hosting fake login or verification portals, and fabricated social media profiles establishing attacker credibility. Documented monitoring strengthens both regulatory standing and the legal argument that the organization took reasonable preventive steps.
