As APP fraud shifts across payment rails and borders, banks need shared, cross-network visibility to detect scams before funds move beyond recovery.
Every June the UK does something no other major market does. It publishes its fraud losses in full. The 2026 figures tell a story the £1.28 billion headline hides. Unauthorised fraud, the technical kind, fell 5 per cent and the industry stopped 70 pence of every pound attempted. Authorised push payment fraud rose 19 per cent to £576 million, with investment scams up 40 per cent. Banks are winning the fight their defences were built for. Criminals moved to a different one, and generative AI is industrialising persuasion.
Then in July came the finding almost nobody picked up. Frontier Economics’ independent evaluation for the PSR confirmed that mandatory reimbursement works as consumer protection. In-scope losses over Faster Payments fell by around 21 per cent. The same report shows where the money went. International APP scams, outside the regime, rose from £21 million in 2023 to £60 million in 2025. Scams paid into crypto exchanges rose from around £59 million to £153 million. Fortify one rail and the losses move to the one you did not, and to the firm and the jurisdiction with the least visibility.
Network-shaped crime, node-shaped defences
A modern scam is not an event at one bank. It is a sequence. An advert on a platform, a messaging thread, a spoofed call, a device already seen at five institutions, a mule account that looked clean at onboarding, two more hops and a crypto off-ramp. The criminal sees the whole sequence. Each institution sees one frame and decides alone on the hop in front of it. You cannot detect a pattern you only ever see one frame of.
To be fair, the UK has built more than any other market. Network scoring covers around 90 per cent of account-to-account volume. The Online Crime Centre opened in April. Cifas and the telecoms Scams Signal have shared consortium data for years. It is a serious inventory, and it is a quilt. Every piece stops at the edge of a rail, a sector or a regulator.
Shared signal is not shared sight. A signal is a score someone else computed about one hop on one rail. Sight is one view of the flow across rails and institutions, held somewhere it can be acted on before settlement. The UK has invested heavily in signal. The next investment has to be in sight.
Machine speed arrived in October
For two years I have said that as agentic commerce arrives, these decisions will have to happen at machine speed. In October, that stopped being a forecast. Mastercard put agent identity scoring into production in Agent Pay. Visa’s first live agentic payments pilot was confined to pre-approved invoices, and the industry admitted that a decade of bot defences reads a 3 am payment from a cloud server as an attack. The same month, America’s largest banks reported unauthorised AI agents operating inside customer accounts and began blocking them.
Credentials and agent registries answer the question of identity. Is this agent authorised? They cannot answer the question that matters on an irrevocable rail. Should this payment, in this context, be happening at all? Identity is a property of the credential. Legitimacy is a property of the flow. Only whoever sees the flow can judge it, and intelligence compounds with every institution that joins.
What the next twelve months should do
The PSR consults in December on the next phase of its APP scams policy, including what fraud data it collects and publishes, with a decision due in May 2027 as its functions pass into the FCA. Three things should follow.
First, measure displacement. Publish out-of-scope, international and crypto losses alongside in-scope reimbursement every quarter. Measure only the rail we fortified, and we will keep congratulating ourselves while the money moves.
Second, make the receiving side about sight, not hold periods. The mule infrastructure lives there. An account that is new and clean at one bank should be known at all of them on day one.
Third, treat intelligence sharing as infrastructure, not a compliance gesture. The schemes, the Online Crime Centre and the processors already sit across institutions. They should build the sight layer so the whole market can join it, under governance banks and regulators can audit.
Reimbursement moves the loss. Fortification moves the fraud. Only visibility removes it. Trust in payments is a network property. It will be won on visibility, not fortification, and the UK is the market best placed to prove it.
Michael Wallis-Brown is Senior Executive, Growth at FIS Banking and Payments. This article is the fourth in his Control Layer Series on how trust, identity and intelligence are reorganising payments. A long-form companion paper is available from FIS.
