Tracing authorised-push-payment fraud funds into England & Wales

A payment clears on a Tuesday morning. By Wednesday it has passed through two accounts, been partially converted to cryptocurrency, and moved offshore. The victim – a business owner who approved the transfer believing it was a legitimate instruction – is already behind the clock.

Authorised-push-payment (APP) fraud in England and Wales is recoverable, but the recovery pathway is time-sensitive and depends on acting at the right sequence of choke points. The instruments available – Norwich Pharmal orders, worldwide freezing orders, proprietary injunctions, and Bankers Trust orders – are powerful, but each requires evidence gathered in the hours and days immediately after the fraud is discovered.

This guide sets out the practical steps, in order, for tracing APP fraud funds into England and Wales: from the first call to your bank, through disclosure orders and interim relief, to cross-border coordination where funds have already moved on.

What Is APP Fraud and Why Does England and Wales Matter?

APP fraud occurs when a victim is deceived into authorising a payment to an account controlled by a fraudster. The authorisation is the defining feature – and, historically, the reason banks resisted reimbursement. As of early 2026, the regulatory position in England and Wales has shifted, with mandatory reimbursement obligations now applying to payment service providers for qualifying APP fraud losses. But regulatory reimbursement is not asset recovery. The two processes run in parallel and serve different purposes.

England and Wales matter as a recovery jurisdiction for three distinct reasons. First, a significant proportion of APP fraud proceeds pass through UK-regulated payment infrastructure at some point, even when the ultimate destination is offshore. Second, the courts of England and Wales have developed some of the most powerful civil fraud remedies available anywhere: the worldwide freezing order, the Norwich Pharmal order, and the proprietary injunction against persons unknown. Third, those courts act quickly when the evidence supports urgency – without-notice applications can be heard within hours of lodging papers.

Does the money need to be in England and Wales at the moment of the application? Not necessarily. A worldwide freezing order, granted by the courts here, can in principle reach assets located abroad – subject to the court's jurisdiction over the defendant and the willingness of foreign courts to assist. That cross-border reach is one reason victims whose funds have already moved offshore still pursue proceedings in London.

Step 1 – The First Hours: What Must Happen Before Anything Else

The most damaging mistake after APP fraud is passivity. Banks have internal processes; those processes are not designed to be fast enough. A recall request lodged within the first two hours gives the receiving bank notice before funds are swept onward. Delay beyond that window narrows the options materially.

In practice, the first hour should cover these actions simultaneously, not sequentially:

• Call your bank's fraud line and request an immediate recall. Confirm in writing by email within the same hour. Note the name of every person you speak to.
• Screenshot or download the payment instruction that caused the transfer – the email, the message, the invoice. Do not delete anything, including obvious phishing messages.
• Identify the receiving account details: sort code and account number if domestic; IBAN and BIC if international. These are the first inputs for tracing.
• Do not contact the fraudster. Tipping off the person who controls the receiving account accelerates dissipation.

Is reporting to the police enough at this stage? No. A report to Action Fraud (the UK's national fraud reporting centre) is worthwhile for creating an official record, but it does not trigger asset freezing and rarely produces immediate investigative action. Civil remedies move faster and are under your control. Police and civil action are not mutually exclusive; run them in parallel.

The reason speed matters is structural. Funds in a receiving account typically move within hours – swept into aggregator accounts, broken into smaller amounts, converted to cryptocurrency, or wired offshore. Every transfer increases the number of jurisdictions involved and the cost of tracing. Time spent waiting is time the fraudster uses.

To understand the broader context for fraud victims in the first response phase, see our Fraud Response resource hub.

Step 2 – Preserving the Trail: Evidence You Need to Trace Successfully

Asset tracing in England and Wales is evidence-led. A court will not grant an emergency freezing order unless an applicant can demonstrate a good arguable case and a real risk of dissipation. Both limbs require documentary evidence gathered before the application.

What does that evidence look like in a typical APP fraud matter? At minimum:

• The payment instruction itself – email headers, metadata, the originating IP address where recoverable.
• Bank statements showing the outgoing transfer.
• Correspondence with the receiving institution confirming the payment landed and whether the account has been flagged.
• Any company registration details, website, or identity documents provided by the fraudster during the fraud.
• For investment fraud: platform screenshots, account statements, withdrawal-refusal messages.

In our experience, victims often discard what feels like embarrassing evidence – the message that convinced them to send the money. That is a mistake. The fraud mechanism itself is evidence of the wrongdoing and of the fraudster's intent. Keep it.

Where the receiving account is at a UK-regulated bank, a Bankers Trust order can compel the bank to disclose information about that account – who opened it, what happened to the funds after they landed, and where they went next. This disclosure becomes the foundation for tracing further. The application is typically made without notice, so the fraudster is not alerted.

Where the identity of the account holder is not yet known – common in layered fraud schemes – a Norwich Pharmal order compels the bank or another third party to reveal the information needed to identify the wrongdoer. These two instruments together form the disclosure backbone of most APP fraud traces in England and Wales.

How Does the Tracing Process Actually Work in England and Wales?

Tracing in a civil fraud context means following the legal and beneficial ownership of money as it moves through different forms and accounts, using recognised equitable tracing rules. It is not simply following a bank reference number. The money may change hands, be mixed with other funds, or be converted – and the tracing analysis must account for each step.

In practice, the trace proceeds in layers. The first layer is the UK bank record. Using the account details of the receiving account, and armed with court-ordered disclosure, practitioners reconstruct where the funds went after arrival. Most APP fraud proceeds pass through multiple accounts – often three to five – before reaching their first major choke point. Each hop is documented and mapped.

The second layer is conversion. Where funds have been converted to cryptocurrency, blockchain-analytics tools allow on-chain tracing that continues even across national borders. Public blockchains are transparent: transactions are visible to anyone with the right tools and knowledge, even when the identities behind wallets are not immediately apparent. Wallet clustering and attribution techniques can link addresses back to identifiable services – centralised exchanges, virtual-asset service providers (VASPs), or other regulated entities – that are then subject to their own disclosure or freezing obligations.

The third layer is the offshore leg. Where funds have been wired internationally, the trace follows the SWIFT trail. Correspondent banking relationships mean that even international wires often touch UK-regulated infrastructure, giving English courts a foothold. Where the destination jurisdiction is a recovery-cooperative forum, local counsel coordinates parallel proceedings.

We have traced APP fraud proceeds across multiple conversion events and three or more jurisdictions in a single matter. The process is painstaking, but the trail rarely disappears completely – it narrows, and that narrowing determines which remedies remain available.

Which Court Remedies Are Available – and When Do They Apply?

The remedy selected depends on what is known at the time of application. This is a decision matrix in practice, not a checklist.

Where the fraudster is identified and assets are located in England and Wales, a worldwide freezing order is the primary instrument. The application is made without notice. The court must be satisfied of a good arguable case and a real risk that assets will be dissipated. If granted, the order freezes the defendant's assets up to the claimed value, both within the jurisdiction and, with appropriate conditions, worldwide. It does not transfer ownership to the victim – it preserves the position pending judgment.

Where the fraudster is not yet identified, a proprietary injunction against persons unknown can freeze assets – including crypto wallets – held by unnamed defendants. English courts have granted these orders in APP and crypto fraud matters where the victim can demonstrate a proprietary claim to the funds. This is a powerful tool precisely because APP fraud victims often do not know who defrauded them.

Where the funds have moved to a third party who was not party to the fraud – a recipient bank, for instance – Chabra relief can extend the freezing order to those third-party assets where there is reason to believe they hold assets beneficially owned by the defendant.

A receivership is available in appropriate cases to take control of assets pending recovery, particularly where ongoing management is needed or where the defendant is unlikely to preserve assets voluntarily.

The right combination of instruments depends on the facts: how much is known, how fast the funds are moving, and what evidence can be placed before the court at the without-notice stage. A contextual bridge matters here. The steps above describe the standard pattern, but your matter turns on what is recoverable from where, and how quickly proceedings can be prepared. If funds have already moved, time matters – request a confidential case review at info@axiomtracel.com.

What Happens When Funds Have Left England and Wales?

Cross-border movement of APP fraud proceeds is the norm, not the exception. The question is not whether funds have moved – they almost always have – but how far, through what systems, and which jurisdictions retain reach.

A worldwide freezing order granted in England and Wales can in principle reach foreign-held assets. Its effectiveness depends on whether the defendant is subject to the English court's jurisdiction and whether the courts of the relevant foreign jurisdiction will give effect to the order. In many cases, parallel proceedings must be commenced locally. We routinely coordinate proceedings with local counsel in foreign jurisdictions when English-obtained orders require enforcement support abroad.

Where funds have moved into the EU, Mutual Legal Assistance frameworks and cross-border civil cooperation agreements can support disclosure and freezing requests, though the speed of civil proceedings varies considerably by member state. Common law jurisdictions – particularly those in the British Overseas Territories and Crown Dependencies – often move faster and share procedural DNA with English courts, making enforcement more predictable.

Where funds have been converted to cryptocurrency, the cross-border analysis changes. Blockchain assets have no physical location: what matters is the jurisdiction of the VASP or centralised exchange where the crypto can be accessed. A disclosure order or freezing order directed at a regulated exchange – served with appropriate legal process – can stop an off-ramp even if the underlying wallet sits in an ambiguous jurisdictional space. In some circumstances, stablecoin issuers can freeze specific token balances on appropriate legal process, providing an additional choke point.

For a practical overview of how England and Wales coordinates with foreign jurisdictions in cross-border fraud recovery, see our England & Wales jurisdiction guide.

Common Misconceptions That Cost Victims Time and Money

The myth that reporting to the bank is enough – and that all recovery firms work the same way – is worth examining directly. It costs victims both money and options.

Bank recall processes are a necessary first step. They are not a recovery strategy. Banks have obligations under Payment Systems Regulator rules, but those obligations relate to reimbursement of qualifying losses, not to the identification and freezing of fraud proceeds. Reimbursement, where it applies, does not recover the funds from the fraudster; it shifts the loss to the payment system. If reimbursement is denied or the loss falls outside the qualifying criteria, the victim needs a separate civil recovery pathway.

The second misconception is that all asset recovery firms operate similarly. They do not. A substantial and growing number of operations – often described as "recovery scams" – target fraud victims in the period immediately after a loss. They present themselves as specialist recovery agencies, sometimes claiming law enforcement contacts or proprietary tracing tools. They charge upfront fees and deliver nothing. In our experience, a genuine specialist will not demand a large fee before any investigation has begun, will not promise a specific recovery outcome, and will tell you honestly if the matter is not worth pursuing. If a firm promises recovery and asks for money before work has started, treat that as a warning signal.

The third misconception is that delay is safe. Every day that passes after APP fraud is a day during which the fraudster can move funds further, convert assets, or spend them. The window for effective intervention is widest in the first 48 hours and narrows materially after the first week. Acting quickly does not guarantee recovery – nothing does – but it preserves options that delay forecloses.

For a case study illustrating how a cross-border APP fraud matter developed after funds moved through a secondary jurisdiction, see our analysis of freezing a fraudster's assets in Estonia.

Assessing Whether Your Matter Is Worth Pursuing

Not every APP fraud loss is recoverable through civil proceedings. Honest assessment at the outset saves time and money and avoids the false hope that compounds the damage of a fraud.

The factors that support a viable recovery include: a traceable payment trail (account details, transaction references); a loss amount large enough to justify the cost of proceedings; identifiable assets in reachable jurisdictions; and speed of response in the first hours. The factors that reduce viability include: a long delay before action; funds that have been fully spent or fragmented beyond economic tracing; a defendant with no known assets; and a matter that has already passed through five or more jurisdictions without a clear choke point.

In our experience, the most recoverable APP fraud matters share two features: the victim acted quickly on their bank in the first hours, and a disclosure order could be obtained before the funds reached a conversion point. Where both conditions are met, the trace is materially easier and the interim relief more targeted.

A viability assessment is not a guarantee. It is an honest evaluation of what the evidence shows, what remedies are available, and whether the cost of pursuing them is proportionate to the likely outcome. To assess whether your matter meets those thresholds, you can request a confidential case review at info@axiomtracel.com.

Related Resources

• Fraud Response hub – practical guides covering first response, evidence preservation, and fraud typologies.
• England & Wales jurisdiction guide – how the courts here handle civil fraud claims and cross-border enforcement.
• Freezing a fraudster's assets in Estonia – a case study in cross-border APP fraud tracing and enforcement.

Frequently Asked Questions

Q: What should I do in the first hours after a fraud?

A: Call your bank's fraud line immediately and request a recall in writing, noting every detail of the conversation. At the same time, preserve every piece of evidence – payment instructions, emails, messages – without deleting anything. Do not contact the fraudster. These first actions determine whether a civil tracing and freezing application can be prepared in time. Delay costs options. A specialist can advise on the next steps within hours of being instructed.

Q: Is my loss realistically recoverable?

A: Recovery depends on specific facts: how fast you acted, where the funds went, whether a traceable trail exists, and whether assets remain in a reachable form. There is no universal answer and no honest specialist will promise one. The factors that support viability – a clear payment trail, speed of response, a loss large enough to justify proceedings costs – can be assessed in an initial case review. Recovery is conditional on those facts and on the legal tools available in the relevant jurisdictions.

Q: How do I avoid a second, recovery-focused scam?

A: Recovery scams specifically target authorised-push-payment fraud victims. Warning signs include: an unsolicited approach shortly after your fraud; a promise of a specific recovery outcome or percentage; a demand for a large upfront fee before any investigative work has been done; and claims of special law enforcement access. A legitimate asset recovery specialist will conduct an honest viability assessment, will not promise outcomes, and will explain the basis of their fees before work begins. If in doubt, request references and take independent advice before engaging.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We routinely coordinate proceedings with local counsel in England and Wales in APP fraud matters, combining disclosure applications, interim relief, and cross-border enforcement into a single coordinated strategy. Our approach begins with an honest assessment of whether a matter is realistically pursuable – before any commitment is made. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace routinely coordinates proceedings with local counsel in England and Wales; this publication does not constitute the provision of legal services in that jurisdiction. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.