APP Fraud After PSR: Why Communication Evidence Now Matters
By Eren Bahadir Pehlivan, Founder of ADORASEC
Haziran 2026
The UK’s approach to authorised push payment fraud has changed.
This article uses the UK PSR reimbursement framework as one concrete example. The wider lesson is not limited to the United Kingdom: when people are persuaded to act on fraudulent instructions, institutions in any market need better evidence of what was communicated before harm occurred.
For years, much of the public conversation focused on whether victims should be reimbursed after being tricked into sending money to criminals. That question remains important. But reimbursement frameworks also make another question harder for institutions to avoid:
What evidence can a firm show about the communications it sent before harm occurred?
In the UK, as one example, APP fraud losses remained highly significant in 2024, with UK Finance reporting losses of £450.7 million. The PSR reimbursement framework, introduced in October 2024, has made prevention, evidence and institutional accountability much more closely connected.
This is not only a reimbursement question. It is a communication question. It is a consumer-understanding question. It is an operational-evidence question.
When a customer is persuaded to act on a fraudulent instruction, the institution may need to understand more than the transaction itself. It may need to understand what the customer was told, how they were warned, whether the warning was meaningful, and whether the customer had a trustworthy route to respond.
That is where the communication layer starts to matter.
Reimbursement changed the risk conversation
The PSR reimbursement framework was designed to strengthen consumer protection, and rightly so. Authorised push payment fraud can be devastating, especially when criminals exploit trust, urgency, vulnerability or institutional impersonation.
But reimbursement also changes the institutional conversation.
A firm can no longer think only in terms of detecting fraud at the transaction stage or reimbursing the customer after loss. It must also consider the quality and evidence of what happened before the transfer.
Was the customer communication clear? Was it delivered through a channel the customer could safely trust? Was there evidence of engagement or non-engagement? Was the customer given a safer route to verify the message or instruction?
These questions sit at the intersection of fraud prevention, customer communication, operational controls and evidence.
In any accountability-focused environment, prevention and evidence are no longer separate conversations.
The problem with “we sent a message”
Many institutions can prove that a message was sent.
That is not the same as proving that meaningful protection was provided.
A message sent through SMS may be technically logged as delivered by a provider. But the institution may still not know whether the customer read it, understood it, trusted it or ignored it.
The customer may have received similar messages from legitimate institutions and fraudsters alike. The message may have arrived late at night, during stress or at a moment when careful judgment was unlikely. It may have used urgency, warnings or instructions that resemble the very patterns scammers exploit.
If an institution sends a warning through the same type of channel that fraudsters use to impersonate institutions, the warning may be technically real but behaviourally confusing.
The issue is not whether institutions should warn customers. They should.
The issue is whether sending a warning through an unverifiable channel should be treated as enough.
Consumer understanding makes the communication question sharper
In the UK, the FCA Consumer Duty is one example of a framework that places importance on consumer understanding and good customer outcomes. In other markets, the exact regulatory language may differ, but the underlying principle is similar: communication cannot be treated as a box-ticking exercise.
A firm should not only ask whether information was sent. It should ask whether the communication was likely to support a customer in making an informed decision.
That matters in fraud contexts.
An urgent message may technically warn the customer while also reinforcing the behavioural pattern used by scammers: act now, trust this sender name, respond quickly, do not pause.
A stronger communication model should reduce that confusion.
For selected high-trust messages, institutions need a route where the user can recognise the sender as verified, the institution can record delivery and reading, and the customer can respond inside a controlled environment.
What a verified communication layer changes
A verified institution-to-consumer communication layer changes the evidence model.
Instead of sending a high-trust message through a spoofable channel and hoping the customer interprets it correctly, a verified route can give institutions a controlled way to reach registered users and record what happens next.
In practical terms, this means a message can be created by an approved institution, routed through a controlled delivery layer and received inside a dedicated user application. The customer sees the institution, the message and any response options in one place. Where a response is required, a simple tap can record it.
The aim is not to make the user experience heavier. The aim is to make the trusted action simpler.
For vulnerable, elderly or less technical users, this matters. A secure system that is difficult to understand will not protect the people who need it most.
Important institutional messages should be checked in a verified place, not acted on through an unverifiable SMS.
Why SMS evidence is limited
SMS remains useful because it is familiar, low-friction and widely available.
But SMS was not built to provide institutional trust or auditability.
It does not reliably prove that the displayed sender is genuine. It does not provide a full read record. It does not provide structured response evidence. It does not give users a consistently safe place to verify high-trust messages. It can be imitated by criminals using similar language, urgency and sender presentation.
That does not mean SMS has no role.
It means SMS should not be the only route for messages where impersonation risk, customer vulnerability or evidential need is high.
A firm may be able to show that it sent an SMS. But that may not answer the more important question:
Did the customer receive a clear, trustworthy and auditable communication that supported a safer decision?
Silence can be a signal
One of the most overlooked parts of communication evidence is non-response.
If a customer does not read or respond to an important notification, that should not be invisible. It may indicate that the customer is unavailable, disengaged, confused, vulnerable or potentially at risk. It may also indicate that a process should not continue without further checks.
In ordinary SMS communication, silence is often treated as absence of information.
In a verified communication layer, silence can become useful operational evidence.
A non-response can help an institution decide whether to pause, escalate, use another contact route or avoid assuming that the customer has understood the warning.
What better evidence should look like
A stronger institutional communication layer should generate evidence at the message level.
For each relevant notification, an institution should be able to show the verified sender, the message content, the recipient reference, the time sent, delivery status, read status, response status, selected response, non-response and the time between delivery, reading and response.
This kind of record does not eliminate fraud. No responsible system should claim that.
But it changes the evidential position. It gives institutions a clearer record of customer communication and gives users a safer route for messages that should not depend on unverifiable SMS.
It also allows institutions to distinguish between a customer who received and understood a message, a customer who received it but did not respond, and a customer who may never have meaningfully engaged with it at all.
The missing evidence layer
Authorised payment fraud is not only a transaction problem. It is often a persuasion problem.
That persuasion frequently begins before the payment instruction, inside a communication channel. If that channel cannot verify the sender, cannot reliably evidence reading and cannot record structured response, then the institution is missing an important part of the prevention picture.
The next phase of fraud prevention should not only ask: did we detect the fraud?
It should also ask: did we communicate in a way the customer could safely trust, and can we evidence that communication?
That is why communication evidence now matters.
The UK PSR framework is one example of why this conversation is becoming sharper. The principle is broader: institutions need more than warnings. They need trustworthy channels, clear user behaviour and records that show what happened before harm occurred.
ADORASEC is developing a verified institution-to-consumer communication layer designed to reduce reliance on spoofable SMS for selected high-trust messages. It supports verified institutional notifications, delivery/read/response evidence and simple user-facing trust signals.
For institutional, policy or pilot discussions: adorasec.com