Fraud and Scam Trends in Digital Payments Right Now
Losses have shifted from stolen card numbers to authorised push payment scams, where the victim makes the transfer themselves.
Payment fraud has changed shape. Stronger authentication made stealing card credentials harder, so attackers stopped trying to break the payment system and started persuading the account holder to operate it for them.
Authorised push payment scams
In an authorised push payment scam, the victim is manipulated into sending money themselves. Because the transfer is genuinely authorised, it bypasses every technical control and lands in a category where reimbursement has historically been inconsistent.
Recurring patterns:
- Impersonation of a bank's fraud team, telling the victim to move funds to a "safe account". No legitimate institution asks this — the instruction itself is the tell.
- Invoice redirection, where an intercepted email changes bank details on a genuine invoice, usually during a property purchase or business payment.
- Purchase scams on marketplaces and social platforms for goods that never ship.
- Investment and romance scams, which run for weeks and produce the largest individual losses.
Why the tactics work
Attackers use time pressure, authority and isolation. They tell victims not to discuss the matter with anyone, spoof caller IDs to match a real number, and reference genuine transaction details obtained from earlier data breaches. Increasingly, they use cloned voices and generated documents, which removes the amateurish signals people were taught to look for.
Defences that hold up
- End the call and dial back using the number printed on your card. Spoofing makes inbound caller ID meaningless.
- Verify bank details out of band for any payment above a threshold you set — a phone call to a known number, never a number in the email.
- Slow down on urgency. Manufactured time pressure is the single most reliable indicator of fraud.
- Use payment methods with dispute rights for goods from unfamiliar sellers.
- Enable name-checking services where offered; a mismatch between account name and payee name is a strong signal.
- Set low transfer limits by default and raise them deliberately when needed.
The reimbursement picture
Several jurisdictions have introduced mandatory reimbursement for many push payment scam victims, splitting cost between sending and receiving institutions. Protection is not universal: exclusions typically cover gross negligence, international transfers, and certain investment losses. Do not treat reimbursement rules as a substitute for prevention.
If it has already happened
Contact your bank immediately — the first hour matters most for recall attempts. Report to the national fraud reporting body. Preserve every message, number and transaction reference. Change credentials on any account that shared a password with the compromised one.
Practical takeaways
- The dominant fraud today is persuasion, not hacking.
- No legitimate bank ever asks you to move money to a safe account.
- Verify payment details through a channel the sender did not choose.
LumosPay publishes general information only. Nothing here is personalised financial, tax or legal advice.
