Phone Scams Drive 28% of APP Fraud Losses – Why Social Engineering Bypasses Technical Controls + Video

By /

Listen to this Post

Featured Image

Introduction:

Authorised Push Payment (APP) fraud losses reached £576.4 million in 2025, a 19% increase year-on-year, according to UK Finance’s Annual Fraud Report 2026. While two-thirds of APP fraud originated online, telecommunications channels – phone calls – accounted for only 17% of cases but caused a disproportionate 28% of losses by value. This disparity underscores a critical cybersecurity reality: phone-based social engineering bypasses technical controls entirely, targeting human psychology through impersonation, urgency, and authority. As AI-enabled voice cloning becomes more accessible, organisations must rethink their fraud prevention strategies beyond traditional IT security.

Learning Objectives & Secrets:

  • Objective 1: Understand the APP Fraud Landscape – Grasp the scale of APP fraud (£576.4M in 2025, 248,070 cases) and why phone-originated scams extract larger sums per incident compared to online purchase scams.

  • Objective 2 Secret Tip: Verify, Don’t Recognise – A convincing voice, professional manner, or apparent knowledge of an organisation should no longer be treated as proof a caller is genuine. Implement mandatory independent verification using officially published contact numbers, not details provided by the caller.

  • Objective 3 Secret Tip: Challenge the Urgency – Scammers rely on pressure to act immediately. If a caller insists there isn’t time to verify who they are, that is the exact moment to stop, hang up, and verify through an independent channel.

You Should Know:

  1. The Insurance Coverage Gap – Does Your Policy Respond to Social Engineering Alone?

Many crime and cyber policies include a social engineering or fraudulent instruction insuring agreement that responds when an employee is deceived into authorising a payment. The critical variable is whether that agreement requires a network intrusion – a hack, system compromise, or malware – as a precondition for coverage.

Policies that require a network intrusion element will not respond to a phone scam where the caller never touched the client’s systems. The employee simply authorised the transfer. With phone-originated fraud producing losses nearly double its proportional share of cases, this coverage gap is increasingly exposed.

Step‑by‑Step Guide – Auditing Your Crime Policy:

  1. Locate the Policy Wording – Request the full crime or cyber policy document from your insurer or broker.
  2. Identify the Social Engineering Clause – Search for terms like “fraudulent instruction,” “social engineering fraud,” or “impersonation fraud.”
  3. Check the Trigger Condition – Does the clause require “unauthorised access,” “network intrusion,” “hacking,” or “malware”?
  4. Assess the Gap – If a trigger condition exists, the policy will not cover a phone-based social engineering attack where no system was compromised.
  5. Request Endorsement or Alternative Coverage – Work with your broker to secure coverage that responds to social engineering alone, without a network intrusion precondition.

2. Implementing Robust Call-Back Procedures

A call-back procedure is one of the most effective controls against phone-based fraud. When a payment request is received by phone, the recipient must independently verify the request by calling back a known, verified number – not the number provided by the caller.

Step‑by‑Step Guide – Establishing a Call-Back Protocol:

  1. Maintain a Verified Contact Directory – Create a secure, centrally maintained list of verified contact numbers for key suppliers, clients, and internal departments. Only numbers from this directory should be used for call-backs.
  2. Mandate Call-Back for All Payment Requests – Any request to change payment details, approve a transfer, or release funds must trigger an outbound call to a verified number from the directory.
  3. Use Independently Sourced Numbers – Never use the number provided by the caller. Obtain the number from the company’s official website, a previous invoice, or the internal directory.
  4. Document the Verification – Log the call-back attempt, including time, person spoken to, and confirmation received.
  5. Escalate Failures – If the verified contact cannot be reached or confirms the request is fraudulent, escalate immediately to the fraud response team.

3. Dual Authorisation for High-Value Transactions

Dual authorisation (maker-checker) requires at least two individuals to approve a payment or sensitive action, preventing a single compromised employee from authorising a fraudulent transfer.

Step‑by‑Step Guide – Configuring Dual Authorisation:

  1. Define the Threshold – Set a financial threshold (e.g., £10,000) above which dual authorisation is mandatory.
  2. Segregate Duties – Ensure the person initiating the payment (maker) is different from the person approving it (checker).
  3. Implement System Controls – Configure your payment or ERP system to enforce dual authorisation. For example, in SAP, use `Transaction F-02` with approval workflows; in banking portals, enable “dual approval” or “two-person control” settings.
  4. Use Out-of-Band Approval – The approval should occur through a separate channel (e.g., a different system, email, or mobile app) to prevent a single compromised session from bypassing controls.
  5. Review and Audit – Regularly audit the dual authorisation logs to ensure compliance and identify any override attempts.

  6. AI Voice Cloning – The New Frontier of Social Engineering

AI voice cloning has eliminated a primary barrier to vishing (voice phishing) attacks. Fraudsters can now clone a voice from as little as a few seconds of audio, often sourced from social media, company videos, or voicemail greetings.

Step‑by‑Step Guide – Defending Against AI Voice Cloning:

  1. Educate Employees – Train staff that a familiar voice is no longer proof of identity.
  2. Implement a Family/Team Code Word – Establish a simple, non-1egotiable verification rule: any sensitive request must be accompanied by a pre-agreed code word or passphrase.
  3. Use Challenge-Response Questions – Ask questions that only the genuine person would know, such as details from a recent internal meeting or project not publicly available.
  4. Deploy AI Detection Tools – Explore emerging AI-1ative defence solutions that can detect synthetic voices in real-time.
  5. Limit Public Voice Exposure – Review and reduce the amount of voice and video content publicly available from executives and key personnel.

  6. Linux and Windows Commands for Investigating Suspicious Activity

While phone scams bypass technical systems, fraudsters often use subsequent technical means to maintain access or exfiltrate data. Security teams should be prepared to investigate.

Linux Commands:

 Check for unusual outbound connections (potential data exfiltration)
sudo netstat -tunap | grep ESTABLISHED

Review authentication logs for suspicious logins
sudo grep "Failed password" /var/log/auth.log
sudo grep "Accepted password" /var/log/auth.log

Check for recently modified files in sensitive directories
sudo find /etc /home /var/www -type f -mtime -7 -ls

List all scheduled cron jobs (potential persistence)
crontab -l
sudo crontab -l

Windows Commands (PowerShell):

 Check for unusual network connections
Get-1etTCPConnection | Where-Object {$_.State -eq "Established"}

Review security event log for failed logins (Event ID 4625)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625} -MaxEvents 50

Check for scheduled tasks (potential persistence)
Get-ScheduledTask | Where-Object {$_.State -1e "Disabled"}

Review PowerShell history for suspicious commands
Get-Content (Get-PSReadlineOption).HistorySavePath

What Undercode Say:

  • Key Takeaway 1: Phone-based social engineering is the fraud vector that technical controls cannot stop. Organisations must invest in human-centric controls – training, verification culture, and robust procedures – as their primary defence.

  • Key Takeaway 2: The insurance gap is real and potentially catastrophic. A crime policy that requires a network intrusion to trigger social engineering cover will leave organisations exposed to the very fraud that causes the largest average losses.

Analysis:

UK Finance’s data reveals a stark reality: phone scams are disproportionately effective because they exploit trust, not vulnerabilities. The 28% loss share from only 17% of cases indicates that these attacks are highly targeted and sophisticated, often involving sustained conversations that build credibility over time. Investment scams, which rely heavily on such trust-building, rose 40% to £221.5 million.

For CISOs and risk managers, the implication is clear: security awareness training must evolve from passive e-learning to active, scenario-based exercises that simulate real-world social engineering tactics, including AI-assisted voice calls. Technical teams should also work with procurement and legal to audit insurance policies, ensuring coverage aligns with the actual threat landscape rather than outdated assumptions about how fraud occurs.

The 159 fraud hotline, which has received over one million calls since 2021, represents a practical, low-tech defence. Encouraging employees to use it when pressured to act urgently can break the scammer’s spell. Ultimately, resilience depends on a culture where verification is not just encouraged but mandated, and where stopping to verify is seen as a sign of diligence, not distrust.

Prediction:

  • +1 Increased regulatory pressure, including calls for Ofcom to impose proactive fraud prevention obligations on telecoms and tech platforms, will drive industry-wide adoption of call authentication standards (e.g., STIR/SHAKEN) and mandatory scam reporting.

  • +1 The UK APP fraud reimbursement regime (introduced October 2024), which saw banks reimburse 61% (£354.3M) of APP losses in 2025, will expand to include clearer liability frameworks for telecoms and social media platforms that enable fraud.

  • -1 As AI voice cloning becomes cheaper and more accessible, phone-based social engineering attacks will increase in both volume and sophistication, with attackers able to clone executive voices in real-time to authorise large transfers.

  • -1 Organisations that fail to update their crime insurance policies to cover social engineering without a network intrusion trigger will face significant uninsured losses, potentially jeopardising their financial stability.

  • +1 The growing awareness of phone-based fraud will drive demand for AI-1ative defence solutions, including real-time voice authentication and deepfake detection, creating a new cybersecurity sub-sector focused on audio integrity.

▶️ Related Video (78% Match):

https://www.youtube.com/watch?v=EWf5b037Cxk

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eWmJgnGu – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: