The Outlier Lab

Payee and Counterparty Risk

Risk of the party receiving value (newness to the sender, reputation across your customer base, ownership consistency and known-bad associations), evaluated at payout, transfer and refund decisions.

What it measures

PerspectiveExample features
Sender–payee relationshipFirst payment to this payee; days since payee added; prior successful payments; amount relative to past payments to them
Payee reputation (platform-wide)Number of distinct senders in the last N days; inbound fan-in from unrelated senders; prior fraud/scam reports naming the payee; pass-through behavior on the payee's own account (if on-platform)
Ownership consistencyPayee name matches account holder name (confirmation-of-payee style checks); for payouts, destination owned by the account holder
Payee typeCrypto exchange / virtual asset service provider, crypto kiosk operator, gift card merchant, money transmitter, precious metals dealer, newly opened account at a neobank
Known-bad associationsAppears on internal negative lists, consortium fraud lists, or law-enforcement/peer shared intelligence
Context labelsMemo or reference text ("taxes", "fees", "safe account", "investment"); payment purpose selected by the customer

Why it matters

When the customer authorizes the payment, identity and device signals are clean by construction, and the payee is often the only anomalous element. FTC data puts 2025 reported consumer fraud losses at $15.9 billion, with bank payments the largest aggregate loss method and cryptocurrency second; investment scams alone exceeded $7.9 billion. FinCEN's pig butchering alert flags transfers to virtual asset service providers by customers with no prior crypto activity, wires labeled as taxes, fees or penalties, and an abrupt switch from small transfers to large wires to parties with no prior history. FinCEN's elder exploitation advisory flags money sent to people the customer has never met in person, and checks or wires with memos like tech support, winnings or taxes.

Payee risk also matters for third-party fraud: in Payout Redirection, the destination is the newly added bank, card or wallet; in marketplaces, a seller's payout account shared with previously banned sellers (Seller Non-Delivery and Fake Listings).

By industry, the payees to watch are new P2P recipients with high fan-in in Payments and P2P; outbound wires and instant transfers to new beneficiaries at neobanks; withdrawals to a newly linked bank or outbound transfers to another firm in brokerage; gift-card delivery addresses and payout accounts shared across reward accounts in cashback and rewards; and seller payout destinations in marketplaces.

How to collect it

  • Internal payee graph: every beneficiary (account/routing, card token, wallet ID, email/phone handle, crypto address) as an entity with all senders linked. This is your strongest asset and must be built in-house.
  • Name verification: confirmation-of-payee style services and bank-data networks (where available in the US) to check beneficiary name against account holder.
  • Consortium and network data: shared fraud-reported account lists and payee risk scores from payment networks and industry consortia (Consortium and Data Sharing).
  • Blockchain analytics for crypto destinations, at category level (exposure to scam-associated or high-risk services).
  • Customer-provided context: payment purpose prompts and memo text, which also support scam interventions.

How to use it

  • New payee + high amount + irreversible rail is the base pattern; add Transaction Pattern Anomalies (first-ever wire, savings liquidation) and Scam Victim Indicators (live call, coached behavior) to separate scams from legitimate first payments.
  • Fan-in detection: a payee receiving first-time payments from many unrelated senders is a mule or scam collection account. Act on the payee (flag, hold, report) as well as on each payment.
  • When the payee is your own customer (you are the receiving institution), combine this with Fast In Fast Out Patterns on the payee side.
  • Graduated friction: warnings tailored to the payee type, cooling-off delays on first payments to high-risk payee categories, and confirmation calls for large first-time transfers (Payee Confirmation and Payment Friction, Customer Education and Scam Warnings).
  • Feed confirmed scam reports back into payee reputation within minutes instead of waiting for the monthly model retrain.

Strengths and limitations

Strengths: effective against authorized scams where other signals fail; platform-wide view compounds with scale; directly actionable at the payment decision.

Limitations: collection accounts are often short-lived, so reputation is thin on first use; name-check coverage is incomplete in the US; coached victims may give misleading payment purposes, and the first hop is frequently a legitimate, regulated destination. Payee signals can be degraded by fresh accounts and layering, so combine them with sender-side behavior and network analysis rather than relying on lists.

False positives and fairness

  • Legitimately large first-time payments: first rent to a new landlord, down payments, tuition, contractor deposits.
  • Legitimate crypto investors buying from regulated exchanges.
  • Popular small businesses and individuals with high fan-in (tutors, sellers, sports clubs, community organizations).
  • Remittances to family abroad, which can look like "money sent to someone never met in person" to a naive rule.
  • Older adults making legitimate gifts to family.

Privacy and compliance considerations

Sharing payee intelligence across institutions is enabled in the US by voluntary information-sharing frameworks such as Section 314(b) for eligible institutions; use the appropriate legal basis. Holds and delays on payments must align with Reg E, network rules and disclosures. Scam-related SARs should use FinCEN key terms where applicable (e.g., FIN-2023-PIGBUTCHERING; EFE FIN-2022-A002). See BSA-AML and SAR Filing and Regulation E and Unauthorized Transfers.

Mechanisms it helps detect

Authorized Push Payment (APP) Scams · Impersonation Scams · Investment Scams (Pig Butchering) · Elder Financial Exploitation · Money Mules · Payout Redirection · Real-Time Payment Rail Fraud · Seller Non-Delivery and Fake Listings · Gift Card Fraud

Scam Victim Indicators · Payout Destination Intelligence · Entity Link Analysis · External Intelligence Feeds · Fast In Fast Out Patterns · Payee Confirmation and Payment Friction · Negative Lists and Deny Lists · Withdrawal and Payout Controls · Playbook - Scam Intervention Members · Playbook - Payout and Withdrawal Risk Members

Sources and further reading