APP fraud
Fraud in which the victim authorises the payment to the scammer themselves, so neither strong authentication nor card chargebacks are any help.
The abbreviation is British: authorised push payment fraud. Card fraud is about someone using your details without permission; here the victim uses their own, BankID and all, because they believe the payee is their bank, their builder or a romantic interest. Instant account transfers let the money hop on to money mules before anyone notices, and there is no chargeback process to fall back on.
The UK was first with mandatory rules. Since 7 October 2024 the sending and receiving banks must split reimbursement to the victim, up to £85,000 per case. The reasoning is that banks otherwise have no incentive to stop suspicious payments. The EU's response has come through PSD3 and Verification of Payee, which at least catches fake account details.