A push payment is one the payer starts by sending money to the payee. It is the basis of most real-time transfers and, because the payer authorizes and initiates it themselves, the foundation of authorized push payment fraud.
What is a push payment, in plain English?
A push payment is money that the payer sends. The customer decides to pay, enters the recipient's details, and pushes the funds out of their own account. Bank transfers, instant payments, and real-time rails all work this way. Nobody reaches into the payer's account; the payer authorizes and initiates the whole thing.
That design is fast and clean, but it comes with a catch: once the funds land in the recipient's account, there is usually little recourse. Unlike a card charge, there is no built-in chargeback to reverse a push payment the customer regrets. What the payer sends, the payer has generally sent for good.
This is exactly the property scammers exploit. In authorized push payment fraud, the criminal does not steal credentials or forge anything; they trick the genuine customer into pushing the money themselves. Because the payer authorized it, the transaction looks legitimate, and the finality means the money is hard to recover.
Push versus pull payments
What changes | Push payment | Pull payment |
Who starts it | The payer sends the money | The payee draws from the payer's account |
Examples | Bank transfers, instant and real-time payments | Card charges, direct debits, subscriptions |
Recourse after | Little to none once received | Chargebacks and return rights |
Main fraud risk | Scams that trick the payer into sending | Unauthorized debits and mandate abuse |
What it looks like in practice
In practice
A customer is convinced by a convincing message that a payment to a new supplier is urgent and legitimate. They open their banking app, set up the new payee, and push a large transfer themselves. Every step is authorized by the real account holder from their usual device.
There is nothing to reverse afterward, because the customer sent the money willingly and it settled instantly. The only place the bank could have intervened was before the send, where the new payee, the unusual amount, and the urgency together should have triggered a warning. On the receiving end, the funds hit a mule account and were gone within minutes.
Why it matters to operators
Push payments invert the usual fraud playbook. There is no chargeback to lean on and no post-transaction window to review, so detection has to move before the send. That means behavior scoring, payee-risk checks, and step-up friction applied to exactly the payments that look manipulated, because once the money leaves, the game is over.
It also splits the work across both ends of the transfer. Watching the sender is not enough when the funds vanish on receipt, so spotting mule accounts on the receiving side becomes just as important. On push rails, the receiving institution is frequently the last party able to freeze the money before it disappears.
What to watch in the data
- New payees. A first-time recipient paired with a large or urgent transfer is a core push-payment red flag.
- Urgency signals. Payments made under pressure or during a live call often mean the payer is being coached by a scammer.
- Out-of-pattern amounts. A send well above the customer's normal behavior warrants a step-up before it clears.
- Fast onward movement. Received funds that are forwarded within minutes point to a mule cash-out.
- Fresh receiving accounts. Newly opened accounts pulling in transfers from strangers are classic mule indicators.
Quick questions
What is the difference between a push and a pull payment?
In a push payment the payer sends money to the payee. In a pull payment the payee draws funds from the payer's account under a mandate or stored card. Push has little recourse; pull offers chargebacks and returns.
Why is there so little recourse on push payments?
Because the payer authorized and initiated the transfer, and on instant rails it settles as final. There is no chargeback mechanism to reverse it the way there is with a card charge.
How does APP fraud relate to push payments?
Authorized push payment fraud is push-payment fraud by definition. The scammer tricks the genuine customer into pushing the money themselves, so the transaction is authorized and hard to reverse.
Where should controls sit for push payments?
Before the send: behavior scoring, payee-risk checks, and step-up friction on suspicious transfers, plus mule detection on the receiving side. Post-transaction review is generally too late.
Why do mule accounts matter for push payments?
Because funds land and are moved on almost instantly. Catching the receiving mule account is often the only remaining chance to freeze the money after a fraudulent push payment.
Are all real-time payments push payments?
Most consumer real-time transfers are push payments, initiated by the payer. That combination of speed, finality, and payer initiation is exactly what makes real-time rails attractive to scammers.
Go deeper
- EMVCo ↗ — Maintains the EMV chip and 3-D Secure specifications for card payments.
- PCI Security Standards Council ↗ — Security standards for handling cardholder data, including PCI DSS.