Tracing authorised-push-payment fraud funds into Cyprus

A payment leaves your account on a Tuesday morning. By Wednesday, the receiving account in Cyprus has already moved the funds on. That is the pattern in authorised-push-payment fraud: the money travels fast, the trail cools quickly, and every hour of inaction compounds the problem.

Tracing authorised-push-payment fraud funds into Cyprus is achievable through a structured sequence of steps – preserving evidence, engaging the receiving bank, coordinating a domestic freezing injunction, and following the onward chain through Cyprus's corporate and banking infrastructure. Recovery is not guaranteed. But a disciplined first response, taken within hours rather than days, keeps the realistic options open.

This guide covers each step in sequence: what to do now, how the tracing process works in Cyprus, what legal instruments are available, and where the genuine obstacles lie.

What is authorised-push-payment fraud and why does Cyprus feature so often?

Authorised-push-payment fraud occurs when a victim is deceived into authorising a payment to an account controlled by the fraudster. The victim's own bank executes the transfer correctly. That is what makes recovery harder than in a case of unauthorised access: the payment instruction was genuine, even if the consent behind it was not.

Cyprus appears regularly in these payment trails for several reasons. As of early 2026, Cyprus remains an attractive banking and corporate destination: it sits inside the European Union, offers access to the euro-zone payment system, and hosts a significant population of internationally owned companies and payment service providers. A fraudster can open a Cyprus-registered company, receive an inbound transfer through the EU banking network, and move the funds onward within a working day – sometimes within hours.

The practical effect is that a Cyprus receiving account is often a waypoint, not a final destination. Funds may continue to a non-EU jurisdiction, into a crypto wallet, or through a layered corporate structure. Tracing work must therefore begin at the Cyprus choke point before the onward movement occurs – or, if it has already occurred, reconstruct the chain from the Cyprus account records.

We have traced payment chains that moved through two or three Cyprus accounts in a single afternoon. Speed matters more here than in almost any other recovery context.

Step one: What to do in the first hours after you discover the fraud

The first hours after discovery determine how much of the recovery pathway remains open. Most victims lose critical time because they assume reporting to their own bank is sufficient. It is necessary – but far from sufficient.

Four actions belong in the first few hours.

• Contact your own bank immediately and ask it to issue a recall or a SWIFT urgent request to the receiving bank in Cyprus. Most banks have a fraud recall process; it is imperfect, but it can freeze the account at the correspondent-bank level before funds are swept onward. Request written confirmation that the recall has been sent.
• Preserve every piece of evidence. Screenshot the email or messaging thread, the fraudulent invoice or bank-account substitution notice, the payment instruction, and your own bank's confirmation screen. Store copies outside your email account. Evidence that exists now may not exist tomorrow.
• Do not contact the fraudster. Alerting the counterparty that you know the payment was fraudulent gives them time to move the funds and destroy records. Silence buys time for a without-notice application.
• Seek specialist advice the same day. An asset-recovery specialist or local admitted counsel in Cyprus can assess whether a domestic freezing injunction is viable before the funds move on. That assessment takes hours, not days.

Reporting to the police and to your national financial-intelligence unit is important for longer-term enforcement. But it does not freeze the money. Do not allow the reporting process to absorb the time that should be spent on civil interim relief.

For a confidential read on whether your situation is recoverable and what the next 48 hours should look like, contact info@axiomtracel.com.

How does tracing work through Cyprus banking and corporate records?

Tracing in Cyprus follows the money through two parallel channels: the banking record and the corporate record. Understanding both channels is essential, because a professional fraud operation will use a Cyprus company as the account holder – not an individual. That means tracing the payment is only the first step; attributing it to a real beneficial owner is the second.

On the banking side, the receiving account belongs to a financial institution regulated by the Central Bank of Cyprus. That institution holds the account records, the Know Your Customer documentation, and the transaction history. Those records are accessible to a claimant through a Bankers Trust order – an instrument that compels a bank to disclose information about a customer's account to support tracing. A Bankers Trust order is obtained from the Cyprus courts and served on the Cyprus bank; the bank must then disclose the account details and transaction records it holds. This disclosure often reveals the onward destination of the funds.

On the corporate side, Cyprus companies are registered with the Registrar of Companies. Beneficial ownership information – that is, information about who ultimately owns and controls the company – is held in the UBO register, which Cyprus introduced pursuant to its EU anti-money-laundering obligations. In our experience, the UBO register provides a starting point, but it is not always accurate: nominee arrangements and layered offshore structures are common in fraudulently used Cyprus entities. A more reliable picture often comes from the bank's own KYC file, disclosed under a Bankers Trust order, combined with corporate registry research.

Where funds have moved into a further jurisdiction, tracing requires a separate application in that forum. Cyprus disclosure orders do not reach accounts held outside Cyprus. A coordinated cross-border approach – Cyprus disclosure running in parallel with an application in the next jurisdiction – is the realistic model for multi-hop fraud chains.

What freezing instruments are available in Cyprus?

Cyprus follows the common-law tradition in its civil procedure and gives courts broad power to grant interim relief before a full hearing. That is significant, because it means a claimant can apply for a freezing order on the same day – or even the same morning – that the fraud is discovered.

The primary instrument is the domestic freezing injunction: a court order preventing the account holder from dissipating, moving, or dealing with the funds pending resolution of the underlying claim. The application is typically made without notice to the defendant to avoid tipping off the fraudster – the court is asked to act on the claimant's evidence alone, on the understanding that the defendant will have the opportunity to challenge the order at a later hearing. A without-notice freezing application in Cyprus can, in principle, be heard within hours of filing if the evidence is well-prepared and the urgency is clear.

Where the fraud has been operated through a company structure and the true wrongdoer is a beneficial owner acting behind that company, the court can also consider Chabra relief against third parties who hold assets on behalf of the primary defendant. This matters where the fraudster has already moved the proceeds out of the Cyprus company account into a personal account or another entity.

If the identity of the recipient is not yet fully established, a proprietary injunction against persons unknown is a further option available in appropriate cases. This instrument has been used in common-law jurisdictions – including Cyprus – in fraud matters where the account holder's true identity has not yet been confirmed through disclosure.

We coordinate closely with admitted local counsel in Cyprus; local procedure governs the filing of these applications, and local counsel must act on the ground.

What obstacles will you realistically face?

Honest advice is more useful than optimism. Several obstacles commonly arise in Cyprus-routed authorised-push-payment fraud cases, and a client who anticipates them makes better decisions.

Speed of onward movement. A Cyprus account used for fraud is rarely held dormant. Funds are swept to a further account – sometimes in a non-EU jurisdiction – within hours of receipt. If discovery comes a week after the transfer, the Cyprus account may already be empty. Tracing work then continues in the next jurisdiction, which may have less accessible disclosure mechanisms and slower courts.

Nominee and layered structures. A significant proportion of Cyprus-registered entities used in fraud operations are owned through nominee shareholders and directors, with the true beneficial owner in a third country. Establishing the real identity behind the account takes time and often requires multiple disclosure steps. The UBO register is a starting point, not a conclusion.

Cross-border coordination lag. When funds leave Cyprus into a non-EU jurisdiction – a common pattern in multi-stage fraud – the claimant faces a new legal system. Getting a freezing or disclosure order in a second jurisdiction while Cyprus proceedings are ongoing requires careful sequencing. Delay between the Cyprus disclosure result and the application in the next forum is where recovery most often fails.

That said, Cyprus does offer genuine advantages. Its courts are active in granting interim relief, its banking system is subject to EU anti-money-laundering obligations that support compliance with disclosure orders, and local counsel experienced in fraud recovery matters can move quickly when the evidence is properly assembled.

How does on-chain tracing apply when funds move into crypto from Cyprus?

A growing proportion of authorised-push-payment fraud chains include a conversion step: the funds reach a Cyprus bank account, are withdrawn – often as cash, a wire to an exchange, or a purchase of stablecoins – and then enter a crypto wallet. At that point, the fiat trail ends and an on-chain trail begins.

On-chain tracing uses the transparency of public blockchains to follow funds from wallet to wallet even when the identities behind those wallets are unknown. Blockchain-analytics tools can attribute wallets to clusters, identify when funds land at a known centralised exchange or virtual-asset service provider (VASP), and support an application for disclosure against that VASP to identify the account holder.

In appropriate cases, where funds have been converted to a stablecoin, the stablecoin issuer can freeze specific token balances on receipt of appropriate legal process. That step is time-critical: a stablecoin freeze application typically must follow very quickly after the conversion event.

The practical lesson is that a fiat-to-crypto conversion does not end the recovery process. It adds a step and requires specialist on-chain expertise – but the transparency of the blockchain means the trail does not disappear. What disappears is time. Once crypto proceeds reach a non-custodial wallet or a privacy-focused protocol, the attribution challenge increases substantially.

To assess whether on-chain tracing is viable in your matter, contact info@axiomtracel.com.

How to judge whether your loss is realistically recoverable

Not every authorised-push-payment fraud loss is recoverable. The honest answer to that question depends on a specific set of facts, and no general guide can substitute for a proper assessment. But the factors below indicate whether the pathway is open or closed.

Favourable indicators:

• Discovery came within days of the transfer. The closer to the payment, the higher the probability that funds are still in or near the Cyprus account.
• The receiving bank is a regulated EU institution. It is subject to EU disclosure obligations and will respond to properly served court orders.
• The receiving company has identifiable registered details. Even a nominee structure can be unwound if the KYC documentation behind it is adequate.
• The amount justifies the cost of litigation and tracing. Recovery work in Cyprus involves local counsel fees, court costs, and specialist forensic input. The economics of pursuit matter.

Unfavourable indicators:

• Discovery came weeks or months after the transfer. The account is likely empty and the onward destination is obscure.
• Funds have already moved to a high-risk or sanctions-affected jurisdiction. Enforcement in those forums is significantly harder.
• The corporate structure is deeply layered across multiple offshore jurisdictions. Each layer adds cost, time, and uncertainty.

A quick viability check – before committing to legal action – is always worth the time. You can run an initial assessment at /viability-check/, or request a confidential review directly from us.

Avoiding the second fraud: recovery scam operators

One of the most painful realities in authorised-push-payment fraud recovery is the second-stage fraud. Recovery scam operators specifically target people who have been defrauded. They appear online – sometimes within days of a fraud becoming publicly known – and offer guaranteed fund return, high recovery rates, or access to secret regulatory databases. They charge upfront fees. They deliver nothing.

Real asset recovery does not work that way. We cannot and do not promise recovery. No legitimate specialist can. What we can do is trace where funds went, identify the parties who received them, and coordinate the legal instruments that have a realistic prospect of freezing and recovering those assets. Whether recovery is achieved depends on the facts of the matter, the speed of action, and the jurisdiction in which the funds now sit.

The markers of a recovery scam are consistent: upfront fees collected before any verified work begins, promises of a specific recovery percentage, claims to have already located your money, and pressure to act immediately before a "window closes". A legitimate firm charges for demonstrable professional work. It never promises a result it cannot control.

If you have been approached by a firm making those promises, treat it as a second fraud event – and report it to your national consumer protection authority alongside the original fraud.

Related resources from Axiom Trace

• Fraud Response: practical guidance for defrauded principals and referring lawyers – the full typologies and first-response library.
• Cyprus jurisdiction profile – court system, interim relief practice, and banking-sector overview.
• Case study: freezing assets in the Isle of Man – how a cross-border freezing order was coordinated across two common-law systems under time pressure.

Frequently asked questions

Q: What should I do in the first hours after a fraud?

A: Act on four fronts simultaneously: instruct your bank to issue an urgent recall to the receiving bank; preserve all evidence (screenshots, payment instructions, correspondence); do not contact the fraudster; and seek specialist advice on whether a without-notice freezing injunction is viable before the funds move on. Reporting to police is necessary but does not freeze the money. Every hour of delay in the civil track narrows the options.

Q: Is my loss realistically recoverable?

A: That depends on how quickly the fraud was discovered, whether the receiving bank account is still funded, and whether the corporate structure behind it can be penetrated. Recoveries are achievable – but they are not guaranteed. The strongest indicator of viability is speed: a matter identified within days of the transfer, where the receiving account is still active and the jurisdiction is accessible, is materially more tractable than one discovered months later. A confidential case review at info@axiomtracel.com gives you a frank assessment based on your specific facts.

Q: How do I avoid a second, recovery-focused scam?

A: Recovery scam operators – also called "reload frauds" – target authorised-push-payment fraud victims specifically. They promise guaranteed recovery rates, claim to have already located your money, and request upfront fees. No legitimate asset-recovery specialist makes those promises. A real practitioner will assess your matter, explain the realistic options, and charge for demonstrable professional work – never for a guaranteed outcome that no one can control. If an approach feels too certain, treat it as a second fraud event.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We coordinate closely with admitted local counsel in Cyprus; local procedure governs the filing of all applications in that jurisdiction. In our experience, matters that reach us within the first 48 hours have significantly more options than those that come later. We have traced funds through Cyprus banking and corporate structures in matters originating across multiple regions and industries. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in Cyprus; local procedure governs all filings. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.