Account takeover and payment scams: why the moment of decision matters

Two ways to empty an account

There are two broad ways to steal money from someone's account. In account takeover, the criminal gets into the account and acts as the customer: they log in, change the phone number or email, add a payee and move the money. In an authorised payment scam, the customer is still in control, but a criminal has persuaded them to send the money themselves, often by posing as their bank, the police or an investment firm.

From the payment system's point of view, both end the same way: a payment that looks as if the customer made it. The payment alone tells you little, so the signals that matter come from the events before it as much as from the payment itself.

Account takeover in the numbers

UK Finance's Annual Fraud Report 2026 counts card account takeover separately. In 2025 it recorded 82,030 cases and 37.8 million pounds of losses where a criminal took over another person's genuine card account, both down 10% from 2024. The same report records 104.4 million pounds of losses from unauthorised remote banking fraud across 37,646 cases, and says mobile banking fraud reached its highest case total ever reported, at 25,180.

Cifas, which runs the UK's National Fraud Database, reported in Fraudscape 2026 that more than 78,000 facility (account) takeover cases were recorded in 2025, 18% of all filings. It also reported a rise of 38% in unauthorised SIM swaps, which it linked to the availability of stolen personal data. A SIM swap moves a victim's phone number to a criminal's device, so one-time passcodes sent by text go to the criminal.

The FBI's 2025 Internet Crime Report describes the same pattern in the United States. Its Recovery Asset Team, which works with banks to freeze stolen funds, saw a rise in account takeover cases in 2025, and the report notes that a single takeover incident can involve 50 or more transactions to different accounts at several banks at the same time.

Payment scams in the numbers

UK Finance reports 576.4 million pounds of authorised push payment (APP) losses in 2025 across 248,070 cases. The mix is changing. Losses to scams where criminals pose as the police or bank staff fell 18% to 55.5 million pounds, which the report calls the lowest loss total ever reported for that type, while investment scam losses rose 40% to 221.5 million pounds.

UK Finance credits the fall in impersonation losses partly to warnings shown during the payment journey. The lesson for anyone building controls: an intervention at the moment of payment can change the outcome, but only if it arrives before the money is sent.

In Europe, the EBA and ECB 2025 Report on Payment Fraud found that manipulation of the payer accounted for a growing share of fraudulent credit transfers, from 65% to 74% of their value between 2023 and 2024. In the United States, the FTC told Congress in March 2026 that imposter scams were the most frequently reported fraud in 2025, with over 1 million reports and over 3.5 billion US dollars in reported losses.

Why the decision has to come first

Money moves faster than it used to. The EBA and ECB report notes that under the EU Instant Payments Regulation most payment providers in the single currency area have to be able to send instant payments from 9 October 2025. Once a payment has settled, getting it back depends on tracing and freezing it.

Recovery does work, but only partly. The FBI's report says its Recovery Asset Team handled 3,900 incidents in 2025 and froze 679,013,183 US dollars, a success rate it gives as 58%, and it advises victims that time is of the essence when they discover a fraudulent transfer. The rest of the money was gone.

The cheaper and more reliable point to act is before the payment: at the login from an unfamiliar device, at the change of phone number or email, at the first payment to a new payee, at the payout request. Each of these is an event you can score in real time.

Signals worth watching

For account takeover, the useful signals sit in the session and the account history. A login from a device never seen on this account, a burst of failed logins, a password reset followed quickly by a change of contact details, or a new payee added minutes before a large transfer mean little one at a time. Seen together in one session, they are hard to explain away.

For payment scams the customer's own device and credentials are usually genuine, so the signals shift to the payment: an amount out of line with the customer's history, a first payment to a new recipient, or a recipient account that is itself new or has received many unrelated payments. Strong authentication does not help here, because the real customer is the one authenticating. The ECB's December 2025 press release on the joint report says new types of fraud, particularly the manipulation of payers, will require additional and new mitigation approaches.

Often a challenge or a review is a better answer than a decline. A step-up check or a clear warning at the right moment protects the customer without blocking every unusual payment.

How FRAPE uses this

FRAPE scores logins, profile changes, payments and payouts as separate events, so the steps before a takeover are visible before the money moves. Device recognition shows when a known device appears on a new account or an unknown one on an old account, velocity counts track bursts of logins per identity, and you can challenge risky changes to email, phone or payout details.

Rules settle the clear cases, FRAPE Decision Core advises on the grey zone, and your policy decides whether to approve, challenge, review or decline. If Decision Core is unavailable, your fallback applies and the event is never approved automatically.

• How a FRAPE decision is made
• Decision Core features