Instant Payments Leave No Time to Stop Fraud

KANSAS CITY — Batch systems and card networks built delay into the product. A wire could be stopped, a card charge disputed, an ACH debit reversed. Nobody sold those frictions as fraud controls, but they worked as them. Realtime account-to-account rails are optimized for 24x7 availability, immediate funds, and settlement that is hard or impossible to unwind.

Fraudsters want the same properties. Stolen credentials are part of the design problem. The larger part is social engineering that talks a customer into authorizing a payment to a mule account, and once that push is authorized and final, the money has often left before the first support ticket is opened.

Realtime rails remove the delay that used to act as a quiet brake on fraud, and authorized push payment scams are the risk that remains.

APP scams on fast rails

In a November 2024 Payments System Research Briefing, Ying Lei Toh, an economist at the Federal Reserve Bank of Kansas City, defines authorized push payment (APP) scams as cases where fraudsters manipulate individuals into authorizing their institution to push funds to accounts the fraudsters control. Fast payment systems run around the clock and make funds available instantly or nearly so, and in most of them interbank settlement is irrevocable once the funds land. Legitimate users like that combination. So do organized scam operations, which can open mule accounts, run the deception and launder the proceeds in minutes.

As the briefing notes, US consumer protection law generally covers consumers when a payment is unauthorized. APP scams are often treated as authorized, because the customer said yes, so recovery depends on the bank's goodwill or its investigation, with no statutory chargeback right to fall back on. The dispute machinery the card networks built does not carry over to account-to-account push payments.

US person-to-person rails already show the scale. The Kansas City Fed briefing cites a July 2024 staff report from the U.S. Senate Permanent Subcommittee on Investigations: in 2023, customers at the three largest banks participating in Zelle disputed more than $206 million worth of Zelle transactions as scams, and scam victims bore more than 80 percent of the losses. Those figures cover one network in one year.

The UK made payment providers reimburse APP losses

The United Kingdom treated APP loss allocation as a question of market structure. The Payment Systems Regulator required reimbursement for Faster Payments APP scams, and in policy statement PS24/7 the PSR confirmed that from 7 October 2024, payment service providers (PSPs) must reimburse victims of Faster Payments APP scams up to £85,000 per claim. At that cap, the PSR estimated, 99.8 percent of Faster Payments APP scams by volume and 90 percent by value would be fully reimbursed when in scope. Sending and receiving PSPs broadly share the cost. Carve-outs for gross negligence and first-party fraud remain, but the default has flipped: the system absorbs most retail APP losses, which gives firms a direct reason to spend on prevention.

Customer education alone never created that incentive. Once reimbursement is mandatory, Confirmation of Payee, velocity limits, mule detection and warning screens become a cost of doing business. Firms that tracked only payment success rates now find a fraud reimbursement line on the P&L, and controls become a condition of launch.

FedNow leaves fraud control mostly to participants

The Federal Reserve's FedNow Service is a 24x7x365 instant payments service with real-time gross settlement among participants, built for speed and finality. Fraud management remains primarily the participants' job, with the network adding tools over time. Federal Reserve Financial Services has described work on network intelligence and is exploring payee name verification to help combat APP fraud. Useful as those tools are, they will not turn US law into a UK-style mandatory reimbursement regime overnight.

Banks and payment firms launching realtime send now face a set of product choices that batch ACH never forced into the same second:

The Kansas City Fed briefing divides the scam life cycle into set-up, execution and laundering, and each stage has a different owner. Banks can tighten identity checks and teach customers about mule accounts while the scam is being set up; the sending institution can warn and verify when the payment is made; and once the money is being laundered, receiving institutions and schemes can freeze funds and share intelligence. Fast payment system (FPS) schemes see network-wide flows that no single bank can. Every one of these controls adds latency or operating cost, so cost-benefit still applies, but skipping them means scam victims quietly subsidize the rail, as the Zelle loss split showed.

Realtime payments will keep expanding because faster cash flow is worth something to users, and the fraud budget is part of that product. A success rate reported without time-to-freeze, recovery rate and APP loss share leaves out a cost that batch delay used to hide.

A team that launches "send money in seconds" without a published control list has shipped an incomplete design, because finality without friction before the send is also a fraud product. Confirmation of payee, delays on first-time payees, amount caps and mule-account monitoring each give up a little speed to shrink the loss tail. The UK reimbursement rule builds that trade into PSP economics. US institutions that still leave most authorized-push losses with customers carry a political and franchise risk instead: adoption can stall if households decide instant rails are where savings vanish.