Blog post: Online security
Hello and welcome to Scam Or Reliable!
Blog post: Online security
Forced approval fraud relies on a simple idea: making the victim believe they need to approve an operation in order to stop it. The banking, identity or payment app being used is genuine, which makes the trap particularly convincing. The scammer does not necessarily bypass technical security; instead, they manipulate the person into authorising the action themselves. The danger therefore comes less from the app than from the emergency scenario built around it.
The scenario often begins with an alarming contact, usually a call or message presented as coming from the bank, an anti-fraud service or a digital identity service. The person on the phone claims that a suspicious operation is in progress and that immediate action is required to cancel it, block it or secure the account. While the victim remains on the line, a genuine approval request arrives on their phone: a push notification, SMS code, biometric confirmation or approval within an app. If they accept it, they do not block the operation; they authorise it.
The central element of this fraud is the confusion between approval and protection. An approval is used to confirm an action, not cancel it. The scammer exploits this ambiguity by speaking quickly, giving precise instructions and preventing the victim from taking the time to read the screen. The trap works all the better because the request appears in a familiar app that has been installed for a long time and is associated with legitimate operations.
A typical variant follows four stages: alarming contact, psychological pressure, an approval request, then confirmation by the victim. The most common pretext is that fraud is already in progress and that approval is required to stop it. In reality, the action displayed corresponds to a transfer, login, signature or access that the scammer is trying to obtain. The victim believes they are protecting their money when they are actually granting the authorisation the scammer needs.
The strength of the scheme lies in the presence of a legitimate tool. Seeing a notification from your bank or an identity app immediately inspires trust, especially if the caller knows the name of the institution or presents themselves as an adviser. Stress then plays a decisive role: when you believe an account is under attack, you read the details less carefully and are more likely to follow instructions. The urgency imposed by the caller reduces thinking time, which increases the risk of error.
The situation can also become complicated afterwards because the operation may technically have been approved by the account holder. In the UK, some Authorised Push Payment scam victims may be covered by mandatory reimbursement rules, depending on the payment and circumstances, but reimbursement is not automatic in every situation. In the US, the applicable protections depend in particular on whether the electronic transfer is considered authorised or unauthorised and on the precise circumstances of the transaction. In all cases, prevention remains the best way to avoid a lengthy and uncertain situation.
Another factor strengthens the effectiveness of the trap: the fake adviser may use a number that appears to match the bank or a known service. This caller ID impersonation, often called spoofing, gives the contact an appearance of legitimacy. The victim may then assume that the call is genuine, even though the number displayed is never sufficient proof of the caller’s identity. The right reflex is to hang up and call back only through an official channel.
An approval request received without any recent voluntary action on your part should be treated as suspicious. The safest rule is to approve only something you initiated yourself a few seconds earlier and whose contents you understand precisely. A legitimate bank or identity service should never ask you to approve an operation you did not initiate in order to supposedly block fraud. If the caller insists that you remain on the line while confirming it, the risk increases significantly.
The approval screen should be read as an authorisation document, not as a simple technical formality. Check the service concerned, the requested action, any amount and the beneficiary whenever this information is displayed. If even one element does not correspond exactly to what you have just done, refuse it. Some applications also display additional warnings around unusual approval requests, as this type of situation is frequently associated with fraud attempts.
The wording used by scammers often follows the same patterns, even though it varies depending on the country and service. The common feature is turning an authorisation action into an apparent protection measure. The more urgent the wording sounds, the more important it is to slow down and regain control. A legitimate contact will accept that you hang up and verify the situation yourself.
The mechanism remains the same from one country to another, but the tools targeted and the wording used change. In the UK, the scam commonly takes the form of bank impersonation, sometimes involving caller ID spoofing. The caller may claim that fraud is in progress and ask the victim to approve a payment or transfer in their banking app, disclose a one-time passcode or even move money supposedly to protect it. Some variants also involve remote-access software or a supposed “safe account”. The essential rule remains the same: never approve a transaction or security action you did not initiate yourself simply because a caller says it will stop fraud.
In the US, the scam may involve banking apps, verification codes and services such as Zelle. A fraudster impersonating the bank may claim that a suspicious payment or transfer needs to be cancelled, then ask the victim for a verification code or instruct them to approve or send a real payment as a supposed security measure. The Federal Trade Commission warns that a genuine bank will not ask customers to transfer money to protect their account or provide a verification code to a caller.
The first useful action is to end the interaction. Hanging up does not make a genuine banking problem worse; on the contrary, it allows you to escape the pressure imposed by the caller. Do not approve the notification, provide the code received, follow a link or install remote-access software. Verification should then be carried out only through the official app already installed or the number shown on your bank card, never through a number provided by the caller.
If an approval has already been given, contact the bank quickly through an official channel. The objective is to report the operation, ask what measures can be taken on the account and keep a record of the exchange. Messages received, screenshots, call times, displayed numbers and transaction descriptions can help document the situation. Avoid deleting evidence, even if it seems secondary.
Reporting depends on the country and the circumstances, but the principle remains the same: notify the institution concerned and keep the available evidence. In the UK, Report Fraud (UK) can be used to report fraud and cybercrime. In the US, the Federal Trade Commission’s ReportFraud.gov (US) can be used to report scams and fraudulent activity. Taking these steps does not guarantee reimbursement, but it allows you to react in a structured way and limit possible further consequences.
An approval is used to authorise, never to block or cancel. This sentence summarises the heart of forced approval fraud. If you did not initiate the action yourself, there is no reason to confirm the request. The right reflex is not to try to determine whether the caller sounds credible, but to regain control by ending the communication.
Fraudsters try to trap the victim in a rapid sequence: alert, instruction, approval. Breaking this sequence is often enough to make the attempt fail. Reading the screen, refusing pressure and using an official channel are simple but decisive actions. They protect against both fake bank advisers and the misuse of identity or payment applications.
Forced approval fraud does not rely on an obvious flaw in the application, but on manipulation of the account holder. The trap consists of presenting an authorisation as a protective action, using language that is urgent yet apparently reassuring. Remembering that no approval you did not initiate should ever be accepted already prevents most of the risk.
To strengthen your reflexes, you can consult our practical guide to the right anti-fraud habits or explore useful steps in more detail with our advice for understanding and reacting to fraud. If you have received an SMS, email or message pushing you to approve an operation, the suspicious message analyser can also help you identify warning signs before acting.
