The Outlier Lab

Customer Education and Scam Warnings

Contextual, in-flow warnings and targeted education that interrupt scams at the moment of payment, plus why generic awareness campaigns rarely move loss numbers.

What it is

In victim-authorized fraud, the customer passes every identity check. Authentication, device and behavior all look normal because they are normal. The only remaining control is the customer's own judgment. Customer education and scam warnings try to restore that judgment at the decision point.

Losses are large and rising. The FTC reported that consumers lost over $12.5 billion to fraud in 2024. Investment scams were the largest category at $5.7 billion, followed by impostor scams, and losses paid by bank transfer or cryptocurrency exceeded all other payment methods combined. The FBI's IC3 reported $20.9 billion in losses for 2025. Investment fraud led at $8.65 billion, and reported losses for people over 60 reached $7.7 billion, up 59% from 2024.

Two very different things share this label:

ApproachWhat it isEvidence of impact
General awarenessEmails, blog posts, campaigns, "we will never call you" bannersWeak on its own. Helps with recognition, but rarely appears in loss metrics.
In-flow, contextual warningsSpecific warnings triggered by risk signals at the payment, payee-add or destination-change decision pointStronger, especially when specific, interactive and paired with a delay or human contact

This note is mostly about the second.

What it stops (and what it doesn't)

Works best when:

  • The warning matches the scam script the customer is in ("Did someone claiming to be from our fraud team ask you to move money? We will never do that.").
  • It's triggered by risk (Scam Victim Indicators, new payee, unusual amount, crypto destination) and shown only to customers who trip those signals.
  • It asks the customer to do something: answer a purpose question, wait, call back on a known number.
  • It's paired with a delay that gives the customer time to talk to someone outside the scam.

Struggles when:

  • The victim has been coached by the scammer to expect and dismiss warnings, which is common in impersonation and investment scams.
  • Warnings are generic, frequent and dismissible with one tap.
  • The scam is in a late, deeply groomed stage. Human outreach, trusted contacts and holds are needed (Trusted Contact and Senior Investor Holds).

Design considerations

Risk targeting. A warning on every transfer trains customers to click through, so trigger warnings on signals: new payee plus large amount, first crypto purchase, payee flagged in consortium data, purpose mismatch, an active phone call during the session, or a recent contact change (Scam Victim Indicators, Payee and Counterparty Risk, Remote Access Tool Detection).

Purpose questions. "What is this payment for?" with scam-relevant options (investment opportunity, someone from our bank asked me to, buying goods online, paying a family member) lets you route to a tailored warning. The answer itself is a signal. Scammers coach answers, so treat it as one input among several.

Specific copy. Name the script. "Scammers pretend to be from our fraud team and tell you to move money to a 'safe account'. We will never ask you to do this." works better than "Be careful of scams."

Escalation. Friction should rise with risk:

  1. Inline note (low risk)
  2. Interstitial warning plus purpose question (medium)
  3. Typed confirmation of the warning, plus a delay (high)
  4. Hold plus outbound contact from a trained agent (very high), possibly involving a trusted contact

See Payee Confirmation and Payment Friction.

Human outreach. In high-risk cases, a trained agent calling the customer, asking open questions and naming the scam pattern is the most effective intervention for groomed victims. Script it, train for it, and give agents authority to hold (Playbook - Scam Intervention Members, Support Team Fraud Training).

Known-channel callbacks. Teach customers to hang up and call the number on your website or card. Make sure your own outreach never asks for credentials, OTPs or money movement, so the rule stays simple.

GenAI-era impersonation. Voice cloning and deepfakes make "it sounded like my grandson" or "it was the bank's number" unreliable (Generative AI and Deepfake Fraud). Education should teach verification by callback, and families can agree a code phrase.

Sellers and recipients. Marketplace sellers face overpayment and fake-payment scams. Warn when messages contain off-platform payment requests (Seller-Targeted Scams (Fake Payment and Overpayment)). Customers also need education about not becoming Money Mules ("job" offers to receive and forward funds).

Testing. Run A/B tests or holdouts on warning designs. Measure abandonment by risk band and later confirmed-scam outcomes rather than click-through (Experimentation and Champion-Challenger).

Industry lens.

Diagram: Payment or payee add, Scam risk signals, Proceed, Purpose question and specific warning, Answer or behavior raises risk?, Typed confirmation and delay, Hold and agent outreach, Trusted contact if appropriate

Implementation path

StageWhat it looks likePrerequisites
Crawl"We will never ask you to…" messaging in app and email; static warning on high-value transfers and crypto purchases; agent scripts for reported scamsA product owner for warnings; support training
WalkRisk-triggered warnings with purpose questions; scam-script-specific copy; delays on high-risk payments; outbound call program; A/B testing of designsScam risk signals; Rules Engine; trained intervention team
RunScam-specific models driving dynamic warnings; real-time session context (active call, remote access); consortium payee data; trusted contact integration; holdout-measured impact; warning fatigue monitoring per customerMachine Learning Models; Consortium and Data Sharing; Experimentation and Champion-Challenger

Customer friction and trade-offs

Warnings work by adding friction at the worst possible moment for a genuine, urgent payment, such as a home deposit or a family emergency. Over-warning causes fatigue and complaints. Under-warning leaves you exposed both to losses and, increasingly, to liability debates. Trade-offs:

  • Target narrowly, using the strongest signals.
  • Let customers who pass a real verification step (callback on a known number) proceed quickly.
  • Explain why: "We're asking because this matches a common scam" is better received than an unexplained block.
  • Track warning frequency per customer and cap it.

See Friction and Customer Experience Tradeoffs for pricing this friction against losses.

Measuring effectiveness

  • Scam losses (bps of outbound volume) on rails with warnings, against a holdout or pre-period.
  • Abandonment rate by risk band: high in high-risk bands, low in low-risk bands.
  • Confirmed scams among proceeded-after-warning payments. These are the misses.
  • Intervention call outcomes: payments stopped, scams confirmed, customers who proceeded anyway.
  • Warning fatigue: warnings per customer per month, and click-through speed.
  • Complaint rate related to warnings and delays.

Common failure modes

  • Generic, always-on warnings that customers dismiss instinctively.
  • Measuring click-through or views instead of loss outcomes.
  • Warnings only at payment, with none at payee add or destination change.
  • No escalation path beyond a screen for high-risk cases.
  • Your own outreach patterns (calls asking customers to "verify") that scammers can imitate.
  • Ignoring the recipient side, where mules and scam payees can be detected.

Regulatory and policy notes

  • US liability: whether institutions must reimburse scam victims for authorized payments under Regulation E remains contested. Reg E covers unauthorized transfers, and scams are generally authorized. See Regulation E and Unauthorized Transfers and Case Study - Zelle Scam Liability Disputes (2024-2025).
  • UK: the PSR's mandatory APP scam reimbursement regime (2024) is the main international reference point for shifting scam liability toward payment firms. That changes the incentive to invest in warnings. See Case Study - UK APP Scam Reimbursement Rules (2024).
  • Nacha "False Pretenses": Nacha's 2026 rules define False Pretenses for impersonation schemes (BEC, vendor and payroll impersonation) and require risk-based monitoring. Scams involving fake goods aren't covered (Nacha Rules and ACH Risk).
  • Broker-dealers: FINRA's 2026 oversight report lists training staff and customers on scams, and response plans (trusted contact notification, SARs, IC3 Recovery Asset Team), as effective practices. Proposed Rule 2166 would give a fraud delay safe harbor for all adult customers.
  • SARs and advisories: FinCEN's elder exploitation advisory (2022) and pig butchering alert (2023) list red flags that can drive warning triggers (BSA-AML and SAR Filing).

Mechanisms addressed

Authorized Push Payment (APP) Scams · Impersonation Scams · Investment Scams (Pig Butchering) · Elder Financial Exploitation · Gift Card Fraud · Seller-Targeted Scams (Fake Payment and Overpayment) · Phishing and Credential Harvesting · Generative AI and Deepfake Fraud · Money Mules (recruitment) · Real-Time Payment Rail Fraud

Payee Confirmation and Payment Friction · Trusted Contact and Senior Investor Holds · Withdrawal and Payout Controls · Funds Availability Holds · Consortium and Data Sharing · Customer Support Verification Protocols · Controls Index

Sources and further reading