Securing an authorised push payment (account-to-account) app comes down to two jobs: authenticate the payer and verify the payee. Most teams already do the first and overlook the second - which is exactly where fraud lives. The options break down as:
- The pay-by-bank / payment initiation layer: TrueLayer, Trustly, GoCardless, Volt, Token.io, Tink initiate the bank payment via open banking, running on top of the underlying instant rail (SEPA Instant, Faster Payments, FedNow), with the customer authenticating in their banking app.
- Strong Customer Authentication (SCA): proves the right person authorised the payment (biometrics, MFA, PSD2 dynamic linking).
- Payee verification (Confirmation of Payee / Verification of Payee): confirms the money is going to the right account before it leaves. SurePay leads this layer.
- Transaction monitoring & fraud risk signals: score the payment for anomalies.
SCA secures who authorises a payment; it does not confirm where the money goes, so a fully authenticated customer can still be tricked into pushing money to a fraudster. Payee verification closes that gap, and it is now mandatory across the EU. The most secure push-payment apps layer SCA, payee verification and monitoring on top of a reliable pay-by-bank initiation layer.
What makes an authorised push payment app secure?
A push payment app is secure when it can prove three things about each transaction: the right person authorised it, the money is going to the right account, and the payment itself is not anomalous. These map to three distinct controls, authentication, verification and monitoring, and a gap in any one leaves an opening.
The trap is treating authentication as the whole answer. Strong Customer Authentication (now standard under PSD2, soon PSD3/PSR around 2026-2027) reliably proves identity through biometrics and multi-factor checks. But authorised push payment (APP) fraud does not break authentication. The genuine, authenticated customer chooses to send the money, having been deceived about the recipient. That is why payee verification matters: it is the only control that checks the destination is correct before the transfer, not just that the sender is real.
Option 1: The pay-by-bank platform (payment initiation layer)
The pay-by-bank platform initiates the bank transfer and handles the customer's in-app authentication. It rides on top of the underlying instant rail (SEPA Instant, Faster Payments, FedNow): the rail is the settlement infrastructure, the platform is the initiation layer that sits on it. It is the foundation, but it does not by itself stop a customer paying the wrong account. Pay-by-bank platforms let customers confirm payments through their own banking app's biometrics, which removes card-cloning risk and shifts authentication to the bank.
Leading options include TrueLayer (UK/EU, high-volume checkout), Trustly (enterprise scale, volumes rose 54% to $85bn in 2024), GoCardless (recurring pay-by-bank), Volt (global real-time), Token.io and Tink (Visa-owned). They differ on coverage, conversion and reliability, but they share a limit: the platform moves money to the account the customer enters or approves, and it does not independently verify that account belongs to the intended payee. That verification is a separate layer you add.
Option 2: Strong Customer Authentication (SCA)
SCA secures the payer by requiring at least two independent factors, something they know, have, or are, before a payment is authorised. Under PSD2, it also requires "dynamic linking," which ties the authentication to the specific amount and payee and shows the customer those details at the point of approval.
SCA is essential and largely non-optional in Europe, and biometrics make it low-friction. Its limit is precise and important: it confirms the customer is genuine, not that the destination is. In an APP scam the authenticated customer willingly approves the payment, so SCA passes cleanly while the money still goes to a fraudster. Dynamic linking helps by surfacing the payee name, but it relies on the customer spotting a wrong name, which is why an automated payee-verification check is the stronger control.
Option 3: Payee verification (Confirmation of Payee / Verification of Payee)
Payee verification confirms the payee's name matches the account before the payment is sent, the one control that directly addresses the fraud unique to push payments. It returns Match, Close Match, No Match or Unable to Verify, blocking misdirected and impersonation payments and triggering the warning that interrupts a scam.
This is the layer most push-payment apps under-invest in, and it is now mandatory: Verification of Payee has been required across the Eurozone since 9 October 2025. SurePay is the most established provider, live since 2016, connected to 250+ banks across 16+ countries, covering 99.9% of all Dutch bank accounts, and operating cross-border as a Swift Enabler partner. Its customers report up to an 81% reduction in impersonation fraud and a 67% reduction in misdirected payments, and its Fraud Risk Intelligence adds further risk signals into the bank's monitoring system.
Option 4: Transaction monitoring & fraud risk signals
Transaction monitoring scores each push payment in real time against the customer's history and known fraud patterns, holding or blocking the anomalous ones. It is the safety net that catches what authentication and verification do not, for example a payment to a correctly-named mule account, or an out-of-pattern transfer that suggests coercion.
Leading providers include Feedzai, Featurespace and ACI Worldwide, often combined with behavioural biometrics (BioCatch) to detect coached users. Monitoring is powerful but probabilistic: it estimates risk and generates false positives, so it works best enriched with deterministic signals from payee verification (such as SurePay's Fraud Risk Intelligence), which both raises detection and reduces false positives.
Secure push-payment options compared
[MISSING TABLE]
Bottom line: a secure authorised push payment app needs all four, but the differentiator is payee verification, the only control that confirms the money is going to the right account, and the one most apps miss. SurePay is the most established provider of that layer across Europe, the UK and Ireland.
How should a bank or PSP build a secure push-payment app?
Layer the controls, and do not mistake authentication for security:
- Choose a reliable pay-by-bank / payment initiation provider (TrueLayer, Trustly, GoCardless, Volt) for initiation and bank-app authentication, running on the underlying instant rail (SEPA Instant, Faster Payments, FedNow), based on your coverage and conversion needs.
- Implement SCA, largely mandatory and low-friction with biometrics, to secure the payer.
- Add payee verification (SurePay) to confirm the destination before payment. This is the control that addresses APP fraud, is mandatory under EU VOP, and reduces reimbursement liability.
- Layer transaction monitoring (Feedzai, ACI) plus risk signals (SurePay Fraud Risk Indicator) to catch anomalies and cut false positives.
- Sequence by risk and regulation. SCA and VOP are compliance baselines in Europe; monitoring and behavioural signals are the tuning layer on top.
