AI Fraud in Payments: Deepfakes, APP Scams and UK Refund Data

In 2025, people in the UK lost £221.5 million to investment scams paid by bank transfer. That was 40 percent more than a year earlier and the largest single category of authorised push payment fraud, according to UK Finance's 2026 fraud report. Over the same period, losses from criminals posing as police officers or bank staff fell 18 percent, and CEO fraud halved. The pattern tells you a lot about where artificial intelligence is changing payment crime. The old trick of a phone call pretending to be your bank is getting harder. The new trick, an ad, a chat, a dashboard showing fake gains, scales beautifully with generative tools.

This piece looks at the best public dataset on payment scams anywhere, the UK's, to show what AI is doing to fraud, how the world's first mandatory scam reimbursement regime is performing, and which defences are actually working.

What makes AI fraud different

Most payment fraud used to be unauthorised: a stolen card, a hacked login. Banks got very good at spotting it. Authorised push payment fraud, or APP, is different. The account holder makes the payment themselves, because they have been persuaded. No password is broken. The bank sees a legitimate customer, on a known device, sending money.

AI makes persuasion cheap. A criminal network that once needed fluent English speakers on phones can now generate polished messages, fake trading platform screens and convincing personas in any language, at any volume. The foreword to the UK Finance report, from fraud analytics firms BioCatch and Nasdaq Verafin, says criminals are using AI to refine impersonation scams and to produce deepfakes during account opening, with synthetic identities and "selfie injection" attacks used to beat identity checks. Their data from nine UK institutions showed scam attempts up 62 percent in 2025. They name agentic AI as the next likely force multiplier, a theme we cover in agentic payments.

The UK numbers, by scam type

Total UK fraud losses reached £1.28 billion in 2025, up 4 percent, across more than 4 million confirmed cases. The split between the two kinds of fraud is the real story. Unauthorised losses fell 5 percent to £703.4 million, while banks prevented £1.68 billion, about 70p of every pound attempted. APP losses rose 19 percent to £576.4 million across 248,070 cases.

Two things stand out. First, investment scams are low in volume and very high in value: under 15,000 cases produced almost two-fifths of APP losses. Second, the scams that are growing are those built on long, content-heavy engagement over social media and messaging, exactly where AI cuts the criminal's cost. UK Finance found 66 percent of APP cases started online, accounting for 32 percent of losses, while telecoms were behind 17 percent of cases but 28 percent of losses. Phone-based scams are rarer but bigger.

The PSR's December 2024 platform study, using 2023 data from the 14 largest UK banking groups, found that Meta's platforms were involved in 54 percent of scam incidents and 18 percent of losses. Facebook alone appeared in 44 percent of purchase scams. That is where the fight increasingly sits: not in the bank's payment screen, but in the feed where the victim first meets the fraudster.

Where deepfakes actually show up

The public conversation about deepfakes focuses on dramatic cases, such as a cloned executive on a video call ordering a transfer. Those happen, but the UK data suggests they are not where most money is lost. CEO fraud, the classic business email or video impersonation, was only £5.6 million in 2025 and falling.

We see three places where synthetic media is doing real damage:

• Investment ads. Fake endorsements and fabricated news clips that steer people to bogus trading platforms. UK Finance links the investment surge to fraudulent adverts and social posts promising large returns, often in crypto assets.
• Account opening. Deepfaked selfies and synthetic identities used to open mule accounts that receive and move scam proceeds. This is the least visible use and arguably the most important, because every APP scam needs a receiving account.
• Romance and relationship scams. AI-generated photos, chat and voice notes sustain a persona for weeks. Romance losses rose 23 percent.

The deepfake that costs the most is not the fake CEO. It is the fake customer opening a mule account.

How the UK reimbursement regime works

On 7 October 2024 the UK became the first country to make scam reimbursement mandatory for an entire payment system. Under the Payment Systems Regulator's rules, firms must refund victims of APP scams sent over Faster Payments up to £85,000, with an optional £100 excess. The cost is shared between the sending and the receiving firm. That last part is the clever bit: banks that host mule accounts now pay for them.

The results so far are better than critics predicted. The PSR's first snapshot showed 86 percent of money lost was returned in the first three months, around £27 million across about 46,000 claims. By Q1 2026 the reimbursement dashboard recorded about 86,500 in-scope claims, £72.6 million refunded, 89 percent of reimbursable claim value returned, and 82 percent of claims closed within five business days. Only about 2 percent were rejected for lack of consumer caution.

The independent evaluation by Frontier Economics, published in July 2026, estimated APP losses over Faster Payments fell about 21 percent after the rules came in, roughly £73 million a year, and that the overall reimbursement rate rose from 54 to 65 percent. It found some displacement to channels outside the rules, but not enough to cancel the gain.

How to square a 21 percent fall with UK Finance's 19 percent rise? They measure different things. Frontier estimates what losses would have been without the policy. UK Finance counts all APP losses, including those outside Faster Payments, which carried about 80 percent of APP value in 2025. Fraud still grew. It grew less than it otherwise would have.

A worked example: one investment scam claim

Consider a retired teacher in Leicester who sees a polished video ad for a trading platform, opens an account, and over six weeks sends five Faster Payments transfers totalling £12,000. The dashboard shows a growing balance. When she tries to withdraw, she is asked for a "release fee".

1. She reports the scam to her bank. Under the rules, the claim is in scope because the payments went over Faster Payments to a UK account, and she reported within 13 months.
2. Her bank applies the £100 excess. The refundable amount is £11,900.
3. The sending and receiving firms share that cost. The receiving firm, which opened the account into which her money first landed, carries half the exposure. That gives it a direct incentive to catch the next deepfaked account application.
4. If she had instead paid by card into an overseas crypto platform, or sent funds from her own account to a crypto exchange first, the claim would most likely fall outside the scheme. That channel shift is exactly what the regulator is now examining.

The example shows both the strength and the gap of the model. It works well where every hop is a domestic bank transfer. It works poorly when the money leaves the system, which is where professional fraud networks are moving. For safe-transfer basics see our guide to money transfer scams.

The defences that are working

Banks are fighting AI with data. The most effective tools in the UK report are less glamorous than deepfake detectors:

• Confirmation of Payee and in-journey warnings, which check the account name before money moves and interrupt payments that match scam patterns.
• Behavioural signals, which look at how a customer types, hesitates or switches apps during a call, often a sign someone is being coached.
• Mule disruption. The UK Finance intelligence unit disrupted 12,438 money mules in 2025.
• Telecom signals. A scheme called Scams Signal passes real-time mobile network data to banks, flagging when a customer is on a long call with an unknown number while making a payment. A trial with a major platform improved fake-ad detection by 30 percent.
• Branch interventions. The Banking Protocol, where staff call police when a customer seems coerced, prevented £58.8 million in 2025.

The common thread: none of these tries to detect whether a video is fake. They look at the payment context instead. That is the right bet. Detection of synthetic media is an arms race banks will not win. Context, such as a new payee, an unusual amount, an active phone call and a freshly opened receiving account, is much harder for an AI to fake at scale.

Why instant payments raise the stakes everywhere

Every country building fast account-to-account rails faces the same problem. Instant, irrevocable payments are wonderful for users and for fraudsters alike. India's UPI, Brazil's Pix and the US FedNow service all move money in seconds, which is also the time a scammer needs. We compare those systems in instant payments around the world.

The UK model, where liability is shared between the bank that sends and the bank that receives, is now the reference point other regulators study. Its lesson is simple. Put the cost where the data is. Receiving banks see the mule account. Platforms see the fake ad. Telecoms see the call. Fraud falls when each of them pays for what they miss.

What to watch next

• December 2026: the PSR's policy roadmap schedules a formal consultation on changes to the reimbursement rules, including claims unresolved after 35 business days and treatment of investment returns.
• Late 2026: a PSR publication on the platforms and services fraudsters use most, covering 2024 and 2025 data, which will show whether Meta's share has moved.
• May 2027: the PSR's decision and revised legal directions, with implementation within six months.
• Mid-2027: UK Finance's next annual report, the first full test of whether investment-scam growth slows.
• Ongoing: agentic AI. As software agents start initiating payments, the question of who authorised a transfer becomes legally harder. See our coverage of AML and sanctions compliance.

This article explains public fraud data and regulation. If you think you have been scammed, contact your bank immediately using a number you find yourself, not one given to you by the caller.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →