The Outlier Lab

Payments and P2P

How P2P apps, wallets, push-to-card and instant rails like RTP and FedNow move money irrevocably, and why scams, ATO cash-out and mules dominate losses there.

Business model and fraud surface

"Payments" covers several different businesses with one shared property: the sender's money becomes the receiver's money faster than anyone can verify the story behind it.

ProductHow it moves moneyFinality for the senderWho usually eats fraud
Bank-network P2PBank-to-bank via a shared directory (email or phone to account)Effectively final once sentSending bank for unauthorized transfers under Reg E. Mostly the victim for authorized scams (contested)
Stand-alone P2P / stored-value walletsInternal ledger transfer. Funded by bank, debit card or balance. Cash-out by ACH or instant push-to-cardInternal transfers are final. Funding legs may be reversibleThe app, for unauthorized transfers (Reg E) and for funding-leg chargebacks and returns
Push-to-card (card network push payments)Credit pushed to a debit card through card-network rails, often in secondsFinalThe originator, for misdirected or fraudulent pushes
Instant rails: RTP, FedNowCredit-push between banks, 24/7/365IrrevocableThe sending bank's customer, unless unauthorized
Digital wallets (tokenized cards)Card payments using a device tokenCard dispute rights applyIssuer for token fraud, merchant for CNP
Money transfer operatorsCash or account-funded transfers, domestic and cross-borderFinal once paid outThe victim, subject to MTO duties. The FTC's 2025 Walmart settlement concerned scam-induced transfers
Diagram: Funding: bank, debit card, balance, Sender app or bank, Rail: P2P network, RTP, FedNow, push-to-card, Receiving account (bank, wallet, card), Mule hops, crypto, cash, Reg E claim, scam claim, recall request

Volume on faster rails is growing quickly. In late 2024 The Clearing House's RTP network averaged about one million payments a day, and 42% of its payments ran outside business hours. RTP raised its per-transaction limit to $10M in February 2025. FedNow, launched in July 2023, had over 1,000 participating institutions by 2025 and raised its network limit to $10M in November 2025 (participants can set lower limits). Same Day ACH, which is not instant but is faster, handled about 1.45B payments worth $3.92T in 2025.

Detection has to happen before the send. On card rails you can decline, refund or charge back. On instant credit-push rails the realistic options are (1) decide before submission, (2) hold or step up at the sender, or (3) catch it at the receiver before the money moves again. A recall is a request that the receiving institution doesn't have to honor. The receiving institution's monitoring is the last line, which is why Nacha's 2026 rules require RDFIs to monitor incoming ACH credits for fraud. The same logic applies to RTP and FedNow receivers through their own risk programs.

Decision points: enrollment (directory registration of a phone or email to an account), funding-source link, first-payee creation, send decision (amount, payee, context), receiver posting and availability, onward-movement decision at the receiver, and dispute/claim intake.

What fraudsters want here

  • Irrevocability: the last hop for ATO cash-out and scam proceeds (Real-Time Payment Rail Fraud).
  • Social payment norms: P2P is built for paying people you know, so scammers pose as people you know, or as your bank (Impersonation Scams).
  • Directory trust: a phone number or email resolves to "someone", and display names can be engineered. Payee confirmation is weak or absent in the US.
  • Receiving accounts: mule accounts at any app or bank that accepts instant credits (Money Mules).
  • Reversible funding behind irreversible payouts: a stolen card or unauthorized ACH funds a P2P send, and the funding leg reverses later (Card-Not-Present Fraud, ACH Funding Fraud).
  • Claim ambiguity: "authorized" versus "unauthorized" drives who pays, which invites first-party misclaiming and also leaves real victims unprotected (First-Party Fraud).

Fraud across the customer lifecycle

StageMechanismsKey controls
Onboarding and enrollmentMoney Mules, Synthetic Identity Fraud, Account Farming and Resale, directory enrollment of a victim's phone or emailKYC and Customer Identification Program (CIP), Phone Risk Signals, Device Binding and Trusted Devices, Negative Lists and Deny Lists
LoginPhishing and Credential Harvesting, MFA Bypass and OTP Interception, SIM Swap and Port-Out Fraud, Session Hijacking and InfostealersPasskeys and Phishing-Resistant Authentication, Risk-Based Authentication and Step-Up
Account maintenanceNew device enrollment, contact changes, Account Recovery AbuseContact Change Cooling-Off Periods, Secure Account Recovery Design
FundingCard-Not-Present Fraud (stolen card funds a send), ACH Funding Fraud, Card Testing on funding endpoints3-D Secure and Card Verification, Bank Account Ownership Verification, Funds Availability Holds
Transaction (send)Authorized Push Payment (APP) Scams, Impersonation Scams, Investment Scams (Pig Butchering), Seller-Targeted Scams (Fake Payment and Overpayment), ATO cash-outReal-Time Transaction Risk Scoring, Payee Confirmation and Payment Friction, Customer Education and Scam Warnings, Velocity and Exposure Limits
Receive and payoutMoney Mules, Fast In Fast Out Patterns, Real-Time Payment Rail Fraud layeringTransaction Monitoring, Withdrawal and Payout Controls, Graph Analytics
WalletsDigital Wallet Provisioning FraudProvisioning step-up in the issuer app; see Playbook - Digital Wallet Provisioning Members
DisputeReg E unauthorized claims, scam claims, First-Party Fraud, Chargeback and Friendly Fraud on funding legsCase Management Systems, Manual Review Queues, Consortium and Data Sharing
Customer supportFake support numbers and bank-impersonation calls, agent social engineeringCustomer Support Verification Protocols, Support Team Fraud Training

Top mechanisms, ranked

  1. Authorized Push Payment (APP) Scams: the customer sends the money. In the FTC's 2025 data, bank payments had the highest aggregate reported losses of any payment method, ahead of cryptocurrency (2024: about $2.09B bank transfers versus $1.42B crypto). Liability is the open policy question in the US. The UK mandated reimbursement in 2024.
  2. Account Takeover (ATO): OTP theft through bank-impersonation calls, then a new device and fast outbound P2P or instant transfers. IC3 noted ATO cases with 50+ onward transfers across multiple banks.
  3. Real-Time Payment Rail Fraud: anything above, landing on rails where the money is gone in seconds. Merchants in the MRC's 2025 survey ranked real-time payment fraud the second most common attack, and 45% named it the next big threat in 2026.
  4. Money Mules: the receiving side of every scheme. P2P and instant credits favor mules who can move money out before any review.
  5. Impersonation Scams: "your account is compromised, move your money to a safe account", plus fake company support and government agents. Over 80,000 IC3 tech-support and government-impersonation complaints in 2025 carried losses above $2.9B.
  6. Seller-Targeted Scams (Fake Payment and Overpayment): fake payment notifications and overpay-and-refund schemes against people selling things. P2P is both the bait and the payout rail.
  7. Card-Not-Present Fraud: stolen cards funding wallets and P2P sends, with chargebacks landing on the app after the money has gone.
  8. Digital Wallet Provisioning Fraud: phished cards provisioned to attacker devices, then spent through tap-to-pay or relay.
  9. First-Party Fraud: customers who paid for goods or sent money willingly, then claim the transfer was unauthorized.
  10. Gift Card Fraud and Investment Scams (Pig Butchering): alternative scam payment paths. Payment apps see the upstream send to the scammer or to a crypto on-ramp.

Regulatory environment

Rule or regimeWhat it doesWhy the fraud team cares
EFTA / Regulation ECovers consumer EFTs, including P2P and many wallet transfers. Liability caps and error resolution for unauthorized transfers. Excludes wire-like transfers primarily between institutions or businessesUnauthorized means initiated by someone else without authority. A consumer tricked into sending is generally "authorized", which is the core of the scam-liability fight. See Regulation E and Unauthorized Transfers
CFPB enforcement and state AGsUDAAP. Reg E error-resolution complianceThe Block (Cash App) 2025 order and the dropped CFPB Zelle suit. New York's 2025 suit against Zelle's operator survived dismissal in 2026
Nacha 2026 fraud monitoringRisk-based monitoring by Originators, ODFIs and RDFIs of entries induced by fraud, including "false pretenses" (misrepresented identity, authority or account ownership)Covers ACH legs of P2P funding and payouts. Doesn't change liability allocation
RTP and FedNow operating rulesParticipant obligations, transaction limits, optional fraud tools (e.g., per-participant limits)Know your own limits configuration. It is a control
Card network rulesPush-payment and dispute rules, wallet tokenization requirementsGoverns push-to-card and wallet risk
State money transmitter laws and BSA/AMLLicensing, AML programs and SARs for non-bank payment apps and MTOsMule detection and SAR obligations
FTC ActDeceptive or unfair practices by payment providers that enable scamsThe FTC's 2025 Walmart order required anti-fraud procedures for money transfers
UK PSR APP reimbursement (reference)Mandatory reimbursement up to £85,000, split 50/50 between sending and receiving PSPsThe model that puts receivers on the hook. See Case Study - UK APP Scam Reimbursement Rules (2024)

More detail: US Regulatory Overview, Nacha Rules and ACH Risk, BSA-AML and SAR Filing, Card Network Dispute Rules.

Key metrics

MetricDefinitionNotes
Fraud loss rate by product and railLosses ÷ send volume (bps), split unauthorized vs scam vs first-partyClassification drives everything. Use a shared scam taxonomy (see Frameworks and Taxonomies)
Scam rate per million sendsConfirmed scam sends ÷ sendsReport by scam type and by payee type (first-time vs known)
First-time-payee loss shareLosses on first payment to a new payee ÷ total lossesUsually the majority. It is where friction belongs
Intervention effectivenessShare of warned or held sends cancelled, and loss avoided per interventionPair with abandonment rate among good users
Receiver-side detectionMule accounts flagged before onward move, and dollars frozen ÷ dollars received from fraudThe metric for RDFI monitoring
Recall successFunds recovered via recall or IC3 kill-chain ÷ requestedIC3 froze 58% ($679M of $1.16B) in 2025 kill-chain incidents. Your own rate is what matters
Reg E claim rate and outcomesClaims, payout rate, timeliness vs regulatory deadlinesCompliance and loss together
Funding-leg lossChargebacks and ACH returns on funded sends ÷ funded volumeSeparates funding fraud from send fraud

General definitions: Fraud Metrics and KPIs, Loss Taxonomy and Attribution.

How fraud teams are typically organized here

Payment companies tend to organize by side of the transaction and type of decision:

  • Sender risk / transaction risk: the real-time send decision, step-up and scam interventions.
  • Receiver risk / mule detection: inbound monitoring, account restriction and offboarding. Usually partnered with AML.
  • Identity and access: enrollment, device binding, ATO prevention.
  • Funding risk: card and ACH funding, card testing on funding endpoints.
  • Disputes and claims operations: Reg E, scam claims, recalls.
  • Financial crimes compliance: SARs, 314(a)/(b), law-enforcement requests.
  • Real-time decisioning engineering: latency budgets are tight. See Real-Time Decisioning Architecture.

Bank-network P2P adds an extra layer: the network operator sets shared rules and data sharing, while each bank makes its own send and receive decisions. Shared receiver-risk data is the single most valuable thing a network can provide. See Fraud Operating Model, Fraud Incident Response and Threat Intelligence and Horizon Scanning.

Industry-specific signals and controls

Signals

Controls

Members: Playbook - Scam Intervention Members, Playbook - Payout and Withdrawal Risk Members, Playbook - Money Mule Detection Members, Playbook - Account Takeover Members, Playbook - SIM Swap and Contact Change Abuse Members, Playbook - Digital Wallet Provisioning Members.

Notable public cases

  • Case Study - Zelle Scam Liability Disputes (2024-2025): the CFPB sued Zelle's operator and three banks in December 2024, alleging more than $870M in customer losses since 2017. It dropped the suit in March 2025. New York's AG filed under state law in August 2025, alleging more than $1B in losses.
  • CFPB order against Block, Inc. (Cash App), January 2025: fraud-handling and Reg E failures. $55M penalty plus up to $120M redress.
  • FTC and Walmart money transfers (2025–2026): a $10M settlement over failing to stop scammers using Walmart's money transfer services. Refunds reached about 65,000 consumers in October 2026.
  • Case Study - UK APP Scam Reimbursement Rules (2024): mandatory reimbursement and the receiving-PSP liability split.
  • Case Study - Arup Deepfake Video Call (2024): deepfake-driven authorized transfers (corporate, but the same payee-friction logic applies).
  • Case Study - DraftKings Credential Stuffing (2022): stuffing, then attacker-added payment methods, then withdrawal. The same pattern hits stored-value wallets.

Sources and further reading