It doesn’t start with a breach. It starts with a message. A cloned agent, a fake payment prompt, a player who thinks they’re topping up their account – until the funds vanish. No malware. No credentials stolen. Just trust, exploited.
This is the new frontier of fraud. Authorized Push Payment scams aren’t just clever, they’re alarmingly effective. Hard to detect, harder to reverse, and often invisible until support lines light up with complaints.
And here’s the part that matters. Regulators are paying attention. So are banks. And if you’re not, you’re already behind.
What follows isn’t just another fraud explainer. It’s a breakdown of what’s really happening, what’s coming next, and what the most switched-on operators are doing about it.
How Betting Fraud Has Evolved
Fraud in online betting has multiple forms, each with different tactics, targets, and consequences. The table below provides a comparative view of the most prominent threats facing operators today, from longstanding risks to more recently adopted tactics:
iGaming Fraud Threat Matrix
| Fraud Type | How It Works | Player Impact | Operator Risk | Detection Difficulty | Emerging or Existing? |
|---|---|---|---|---|---|
| APP Fraud | Scammers trick players into sending money via legitimate payment platforms | Loss of funds, decreased brand trust | Reputation damage, increased support load | High | Emerging |
| Card Chargeback Fraud | Fraudulent disputes over legitimate transactions | Disputed charges | Financial losses, administrative burden | Moderate | Established |
| Account Takeover (ATO) | Stolen or phished credentials used to hijack accounts | Loss of access and funds | Bonus exploitation, fraudulent payouts | High | Established |
| Fake Betting Apps | Clone apps that imitate legitimate platforms | Financial loss, identity theft | Brand impersonation, loss of user trust | High | Emerging |
| Bonus Abuse | Multiple fake accounts used to claim welcome bonuses | Inflated player metrics | Wasted marketing spend, skewed analytics | Low | Established |
| Emulator & Device Spoofing | Virtual devices bypass location and KYC checks | Rarely noticeable to players | Compliance issues, scalable fraud | High | Emerging |
| Affiliate Fraud | Fake installs or clicks generate illegitimate CPA payouts | No direct impact | Reduced marketing ROI | Moderate | Established |
| Social Engineering via Messaging Apps | Impersonators scam users on Telegram/WhatsApp by posing as official agents | Direct payment scams | Player loss, reputational fraud exposure | High | Rapidly emerging |
Five years ago, fraud in iGaming was unsophisticated, consisting largely of cloned cards, chargebacks, bot-driven bonus abuse, and so on. In a nutshell, operators knew what to look for and what to block. But the playbook has changed. What we’re seeing now isn’t just an evolution in technique. It’s a shift in psychology.
APP fraud, short for Authorized Push Payment fraud, isn’t about breaching defenses. It’s about convincing the player to open the door. There is no malware or hijacked logins. Just trust, redirected. Whether it’s a fake betting app or a Telegram ‘agent’ asking for a top-up, the scam works because it feels legitimate. And that’s precisely what makes it so dangerous.
In 2023 alone, APP fraud drained £459.7 million from UK customers, much of it linked to scams run through messaging apps and social media platforms. The Times reports that APP-related scams are growing at over 20% year-over-year, outpacing almost every other fraud sector.
But this is bigger than one tactic. The fraud hitting operators now blends social engineering, mobile deception, and payment manipulation. Players are being targeted before they even reach the platform via cloned apps, spoofed identities, and support impersonators. And because users approve the transaction, legacy fraud tools don’t even blink.
That’s the shift. Fraudsters aren’t breaking in. They’re being let in. For operators, that changes everything. It’s no longer enough to stop the bad guys. The challenge now is spotting them before the player can’t tell the difference.
PSPs Fighting Back to Maintain Trust
APP fraud has exposed some uncomfortable realities about the payment infrastructure many operators rely on. In reality, it wasn’t built for APP fraud. It was built for speed, convenience, frictionless onboarding, fast deposits, and instant withdrawals. And for years, that worked – until it didn’t.
Now, fraudsters are slipping through undetected not because they’re hacking the system but because they’re mimicking legitimate users, and the rules of the game are changing. Payment providers, once focused on throughput and uptime, are shifting priorities. The new mandate isn’t just to process money. It’s to qualify intent.
That shift is being felt in real time, at the point of payment and onboarding, and the invisible layers in between.
Smarter Payment Checks in Real Time
In this ongoing battle, payment providers are enhancing their defenses with smarter, real-time verification tools. One such measure is the implementation of Confirmation of Payee (CoP), a system that verifies the recipient's name against the account details before a payment is processed. This additional layer of scrutiny helps prevent misdirected payments and reduces the risk of fraud.
The UK's Payment Systems Regulator has mandated the adoption of CoP across major banks, and its effectiveness is evident. According to the Payment Systems Regulator, CoP has become an essential anti-fraud tool, with over 2.5 billion checks completed since its launch in 2020.
Beyond verifying account details, payment providers are increasingly analyzing behavioral patterns to detect anomalies. Systems can establish a baseline of normal behavior by monitoring user interactions, such as typing speed, mouse movements, and transaction habits. Deviations from this baseline, like an unusual login time or a sudden large transfer, can trigger alerts for potential fraud. This approach allows for continuous, unobtrusive monitoring, enhancing security without disrupting the user experience. By combining tools like CoP with behavioral analysis, payment providers are creating a stronger defense against APP fraud.
Better ID Checks at the Gate
In many ways, the obsession with frictionless onboarding makes a lot of sense—at least, it does until fraudsters walk straight through the front door. For years, operators raced to minimize sign-up barriers in the name of conversions. But in the shadow of APP fraud, that strategy is aging badly.
Now, the smarter play is preemptive scrutiny. Real-time ID verification is fast becoming an expectation, but the real shift is in how identity is being confirmed. Facial matching isn’t just about checking a passport photo. It’s really about catching the mismatch between a player’s face and the fraudster behind the screen. Add to that open banking, and suddenly, operators can validate name, account number, and ownership all before funds are even deposited. The focus is not on slowing players down, but rather more about filtering out the ones you never wanted to begin with.
That’s where the mindset is changing. As Equals Money recently noted, inserting a little ‘healthy friction’ during onboarding doesn’t break the journey but strengthens it. Fraudsters don’t like being examined, especially in real time. High-value players, on the other hand, expect protection and generally won’t flinch if the checks feel proportionate.
Operators who strike the right balance will be safer, more trusted, more defensible, and better prepared for the growing scrutiny of identity, AML, and transaction abuse.
Industry Responses in Combating APP Fraud
Behind every tightened payment check and onboarding screen, however, is a more profound shift taking place—one that may ultimately force the entire industry to rethink where responsibility really lies.
In the UK, payment providers are now legally obliged to reimburse scam victims up to £85,000 per incident, a reform that has reframed APP fraud from a consumer problem to a commercial liability. This change has sent a clear message to banks and PSPs: prevention is no longer optional—it’s expected.
In response, we’re seeing a quiet but significant repositioning. Suspicious transactions can now be delayed by up to 72 hours, giving providers time to verify intent before the money moves. For betting platforms, the challenge lies in integrating these delays without frustrating legitimate users.
But fraud rarely starts with payments. It often begins in a message. With over 50% of APP scams traced back to social platforms like Facebook and Instagram, regulators are now calling on telecoms, tech firms, and operators to share intelligence on emerging threats. It appears that the future of fraud prevention won’t be won in isolation. It will be a team effort.
What Operators Should Be Thinking About Today
The next phase of APP fraud defense is strategic in nature, and operators need to rethink whom they trust and where the next blind spot is likely to appear.
Choosing the Right Payment Partner
The reality is that too many payment service providers still approach fraud as a back-office issue—one that’s resolved after the fact rather than prevented by design. APP scams have exposed the limits of that thinking, particularly among PSPs still relying on static controls or outdated verification processes.
For iGaming operators, the landscape is changing. Regulatory pressure, consumer expectations, and financial risk have redefined what a payment partner should deliver. In other words, fraud prevention is no longer a secondary feature but a front-line function.
This means that operators need to ask sharper questions when choosing payment providers. For instance, do they perform real-time behavioral analysis? Is identity verified through open banking or biometric data? How do they screen for payment manipulation before funds are moved?
Providers worth considering will be able to demonstrate how they apply Confirmation of Payee, adaptive risk scoring, and continuous monitoring across the entire transaction journey. As SEON’s 2024 Fraud Trends Report alludes to, the most effective fraud prevention happens before a transaction begins by analyzing intent, not just outcomes.
Adapting to Regional Risks
Fraud doesn’t scale evenly, either. Some jurisdictions have invested in advanced payment regulation and data-sharing frameworks. Others remain high-risk environments where APP scams and social engineering campaigns thrive with minimal oversight. For iGaming operators expanding across borders, treating fraud as a global constant is a strategic mistake.
Localization is needed not only for content or currency but also for fraud prevention logic. That means deploying rules and transaction screening thresholds that reflect regional patterns. In mature markets like the UK, for instance, Confirmation of Payee and reimbursement liability shape how payment risk is assessed. In less regulated markets, operators may need to rely more heavily on behavioral analytics and real-time monitoring to spot payment issues.
Geo-specific fraud orchestration platforms (like SEON or Kount) can help tailor these controls. But technology alone isn’t enough. It requires contextual awareness—how players pay, how fraudsters probe, and what early warning signals look like in each market.
Balancing Speed with Security
There is no argument that speed sells in today's iGaming environment. Instant withdrawals, rapid onboarding, and one-click deposits are now standard expectations for players, not premium features. But every millisecond shaved off the user journey is a potential blind spot for fraud. The challenge now isn’t choosing between speed and security—but more about designing a system where they reinforce each other.
The answer lies in context-aware controls. Smarter operators are weighting payout speed based on risk profiles rather than applying a blanket delay or friction to all transactions. Known users with established behavior patterns can be processed almost immediately. New accounts with high-value withdrawals? They get flagged for deeper review without disrupting the wider player base.
This is where behavioral biometrics, geolocation, and session intelligence come into their own. They allow for silent authentication in the background, preserving the fluidity of the experience while quietly evaluating risk.
Done well, these systems don’t frustrate players—they build trust. This is especially true in a post-APP fraud environment, where users aren’t just looking for speed; they’re looking for safety to stay one step ahead.
The Hidden Wins in Getting APP Fraud Strategy Right
While most conversations about APP fraud focus on stopping the next scam, operators with long-term ambitions should ask the more profound questions—since the real competitive advantage lies not in following the crowd but in seeing around corners.
Take player lifetime value, for example. Every fraud incident, whether it be a stolen deposit or a hijacked payout, chips away at trust. Players rarely return after being defrauded, even if the platform wasn’t at fault. Protecting LTV, therefore, starts with protecting perception.
Then there’s the rise of tiered transaction flows. Some payment providers are already trialing systems where high-risk deposits are routed through enhanced checks, while low-risk ones pass through instantly. This split-model future isn’t far off, and operators will need to adapt fast.
However, deposits are not the only ones under scrutiny—withdrawals are now part of the same risk equation. Instant withdrawals, once a selling point, now double as a fraudster’s dream exit route. Pausing suspicious cashouts without alienating legitimate users will become a key balancing act moving forward.
On social media, impersonation layering is also emerging, which involves fake agents, cloned sites, and fraudulent KYC prompts that feel indistinguishable from the real thing. It’s a UX problem, not just a fraud issue.
To address this particular issue, operators must move beyond fraud filters and design their platforms with defensive UX in mind—using branded cues, real-time warnings, and consistent messaging to help users spot fakes before engaging. At the same time, off-platform monitoring of social channels like Telegram and Instagram is essential, as most scams begin outside the betting environment. Educating users through well-timed, contextual prompts completes the strategy by turning trust into a built-in security layer.
There’s also the untapped opportunity of pre-verification for high-value depositors—screening users before they transact, not after. Think of it as KYC for intent.
In conclusion, forward-thinking operators should remember that their PSP’s weakness can become their liability. Regulators are watching. Operators must, therefore, start asking tougher questions about the fraud policies of their payment partners. Perhaps now is the time to treat fraud prevention not as an overhead but as a competitive edge.
The End of Reactive Thinking?
APP fraud isn’t just another threat—it’s a turning point. It exposes where legacy systems fall short, but more importantly, it challenges long-held assumptions about speed, convenience, and trust.
Operators who treat fraud as an operational layer—something owned by the payments team or buried in T&Cs—are already behind. What’s required now is a more intelligent approach: a significant rethink of how risk is assessed, how identity is verified, and how trust is communicated across every interaction.
But there’s good news! This moment offers more than risk. When done diligently, it can provide a strategic advantage. The operators who get fraud prevention right will reduce losses, protect LTV, and increase conversion without compromising integrity. They will also be far better positioned to defend their brand in a market where compliance scrutiny and user expectations only move in one direction.
Legacy payment tools weren’t built for today's threats, but Altenar’s intelligent fraud controls were. Schedule a personal software demonstration of our platform now to see how we help operators manage risk, retain trust, and stay compliant.
