Unmasking the Call-Merge Scam: An Emerging Vector in Authorized Push Payment Fraud

Abstract

Authorized push payment (APP) fraud occurs when a payer is deceived into initiating a payment to an account controlled by a criminal. This paper examines a reported call-merge scam pattern in which voice impersonation, caller-identity deception, requests to merge calls, and pressure around authentication or payment approval may be combined. Because publicly available datasets do not consistently classify call merging as a separate fraud type, the paper treats the call-merge scam as an emerging threat pattern rather than asserting a verified global prevalence rate. It develops a conceptual attack model, identifies human and technical risk factors, and proposes a layered response spanning telecom controls, risk-based banking authentication, artificial-intelligence (AI) decision support, incident reporting, and government policy. The proposed AI framework combines call-event metadata and payment-risk signals without requiring routine storage of call audio. A policy roadmap emphasizes privacy, explainability, independent evaluation, rapid inter-institutional response, and proportionate reimbursement. The paper concludes with a research agenda for validating the model using verified incident data and controlled usability studies.