Payout Destination Intelligence
Signals about where money leaves to: destination age, sharing across accounts, destination type, ownership match, inbound fan-in and network intelligence, scored at every payout and withdrawal.
What it measures
Payee and Counterparty Risk asks whether the third party a customer is paying is risky, which is the scam question. Payout destination intelligence asks a different question: when value leaves an account to the account holder's own destination (a withdrawal, seller payout, cashback cash-out or bonus payout), is that destination really theirs, and is it behaving like a cash-out point? On P2P and RTP the two overlap, so use both.
| Feature family | Example features | Main thing it catches |
|---|---|---|
| Tenure | Days since the destination was added to this account; first-seen date platform-wide; destination changes in the last N days; time from add to first payout | Redirection just before a payout |
| Sharing | Distinct accounts using the destination; how many are unrelated (not a known household); share previously closed for fraud | Farms, rings, mule aggregation |
| Type | Prepaid or reloadable card (from BIN attributes); account at a newly onboarded or high-risk institution; crypto exchange or self-hosted address; gift card or store credit; P2P handle; email-keyed wallet | Liquidity and irreversibility |
| Ownership | Name-match tier (match, partial, no match, unavailable) against the verified customer; how ownership was verified; destination owner vs. KYC identity | Third-party destinations |
| Inbound fan-in | Distinct payers or senders into the destination, where you can see them (on your platform, or via consortium); first-time payers; credits followed by quick outflows | Mule collection points |
| Network and consortium | Account open or closed status and age at the bank; bank-contributed account history; fraud-reported flags; network receiving-account risk scores | Fresh mule accounts; known-bad destinations |
| Context | Rail requested vs. this account's history (instant vs. standard); balance being withdrawn vs. normal; risk events in the recent window (Account Change Events) | Cash-out urgency |
Destination types compared
| Destination | Reversibility once paid | Can you verify ownership? | Typical concern |
|---|---|---|---|
| Bank account via ACH | Partly (return windows, recalls) | Yes: validation plus name match | Newly opened accounts; mule accounts in the mule's own name |
| Bank account via RTP or FedNow | Effectively irrevocable | Yes, before first use | Speed. Receiving banks may hold or reject. |
| Debit card via push-to-card | Effectively irrevocable | Partly: network name-inquiry services | Prepaid BINs; cards shared across accounts |
| Prepaid or reloadable card | Effectively irrevocable | Weak | Farm aggregation; hard to tie to an identity |
| P2P handle or email-keyed wallet | Low | Indirect (through handle and email risk) | Handle isn't account; display names vary |
| Crypto exchange or address | None | Exchange accounts are KYC'd at the exchange; self-hosted addresses aren't | Final exit for scams and ATO; category-level analytics only |
| Gift card, store credit, partner points | None | None | Instantly resold (Gift Card Fraud) |
Crypto exits are worth separate treatment. The FBI's IC3 counted more than 13,400 complaints involving cryptocurrency kiosks in 2025, with about $389 million in losses, up 58% from 2024.
Why it matters
The payout is where you last hold the money (Withdrawal and Payout Controls). In Payout Redirection, the attacker often makes no unusual transaction at all. They change one destination and let your scheduled payout run. The destination is often the only anomalous element. Destinations are also reused: a ring has many accounts but far fewer cash-out points, so destination sharing exposes Multi-Accounting and Fraud Rings and Collusion that per-account signals miss.
Regulation is pushing the same way from the receiving side. Nacha's 2026 fraud-monitoring rules require RDFIs to run risk-based processes on incoming credits, and flag activity involving new, dormant or mule accounts. Phase 1 took effect March 20, 2026 for large RDFIs; Phase 2 extended it to all RDFIs in June 2026. FINRA's account takeover notice (RN 21-18) describes broker-dealers watching withdrawals to newly established bank accounts.
How to collect it
- Stable destination keys. Turn every destination into a resolvable entity: a hashed routing-plus-account key, the processor's card fingerprint or token (never the raw PAN), a normalized wallet email or P2P handle, a crypto address plus chain, a gift card program plus ID. This is Entity Resolution work, and it's the foundation of everything below.
- Destination events. Log added, verified (method and result), edited, removed, first payout, returned, recalled. Keep platform-wide first-seen timestamps.
- Reference data. BIN attributes (prepaid, commercial, issuer country) and routing-number institution data.
- Ownership checks. Bank account validation and name match (Bank Account Ownership Verification). For cards, network name-inquiry services. Visa's Account Name Inquiry is positioned for card onboarding, pre-transaction checks, and payouts and push payments. It returns per-name and overall match results, and isn't a sanctions or AML screen. In the UK, Confirmation of Payee is the comparable bank-account name check. Pay.UK reported 2 billion checks by March 2024.
- Network and consortium data. Bank-contributed account status and history services, shared fraud-reported destination lists, and network receiving-account scores (Consortium and Data Sharing, Credit Bureau and Consortium Signals). Mastercard extended its Consumer Fraud Risk scoring to receiving banks in September 2024. It reported a 60% average improvement in early identification of high-risk mule accounts in offline tests, a vendor claim.
- Rail-level tools. FedNow participants can keep their own negative list of account and routing pairs to block sending to, receiving from, or both. Since June 2025 they can also set segment-level dollar and velocity thresholds.
- Feedback. Returns, recalls, confirmed fraud and customer "I didn't get paid" claims flow back into destination reputation within minutes (Fraud Labeling and Feedback Loops).
How to use it
- Score tenure, rail and amount together. A first payout to a destination added during a risk-event window, on an instant rail, for a larger-than-usual balance, is among the riskiest events on any payout platform. Hold or step up.
- Apply person-level limits through the destination. Thirty accounts paying out to one bank account is one entity, so enforce limits and holds on the destination cluster (Entity Link Analysis, Velocity and Exposure Limits).
- Act on ownership tiers. No match on a new destination means verify before release. A partial match calls for a policy decision by segment.
- Score changes in destination type. An account that always paid to a verified bank and suddenly asks for a prepaid card, crypto or gift card is a context change worth scoring, even when the destination is clean.
- Watch the receiving side too. When your customer's account is the destination, fan-in from unrelated senders followed by fast outflows is mule behavior (Fast In Fast Out Patterns, Playbook - Money Mule Detection Members). ICBA's 2026 guidance calls incoming wires followed quickly by transfers to crypto exchanges or money services businesses the clearest sign of a mule account.
- Propagate confirmed-bad destinations. A destination confirmed in one case should hit every account linked to it (Negative Lists and Deny Lists).
Industry lens
| Industry | Typical destination | What to watch |
|---|---|---|
| Brokerage and Investing | Bank account in the customer's name (ACH or wire) | New bank link before liquidation and withdrawal; wires to third parties; destination shared with other customers |
| Neobanks and Consumer Fintech | External linked accounts; P2P and RTP | Newly linked external accounts used for full-balance transfers; your own accounts as fan-in collection points |
| Payments and P2P | Push-to-card, P2P handles | Prepaid BIN concentration; handles reused across senders; instant rail first use |
| Cashback, Coupons and Rewards | Bank, email-keyed wallet, gift card | Many reward accounts cashing out to few destinations; gift card selection after a destination change |
| Online Marketplaces | Seller bank or debit card | Payout destinations shared with banned sellers; change just before a large payout; payout before the claims window closes (Seller Onboarding and Reserves) |
Strengths and limitations
Strengths: The exit is a chokepoint that every monetized fraud passes through. Destinations are scarcer than accounts for attackers. The signal works when the identity and device layers have been defeated. And it compounds with scale and with consortium coverage.
Limitations: A fresh destination has no history. Mules who open accounts in their own name and later act as the customer pass name match. Prepaid cards, P2P handles and self-hosted crypto addresses make ownership hard to establish. Consortium and name-inquiry coverage is incomplete in the US. Attackers can degrade sharing signals by spreading cash-out across more destinations. Compensate with platform-wide velocity of new destinations, device and identity linkage behind the destinations, and outcome feedback from returns and recalls.
False positives and fairness
- Households. Spouses, partners, and parents paying out family members' rewards share a bank account legitimately. Model household relationships before calling a destination shared.
- Joint and business accounts fail exact name match. So do DBA names for marketplace sellers.
- Legitimate switching. A new job, a new bank or a moved salary account all look like a recent destination change.
- Unbanked and underbanked customers rely on prepaid cards. Treating prepaid alone as high risk shifts friction onto lower-income customers. Combine it with other evidence.
- Name formats. Transliteration, name order, hyphenated and maiden names, and nicknames all produce partial matches.
- Crypto-native users cash out to exchanges routinely.
Privacy and compliance considerations
Store destination identifiers as tokens or hashes. Keep raw card numbers out of fraud systems (Fraud Data Architecture). Sharing destination intelligence with other institutions needs a legal basis, such as Section 314(b) for eligible US institutions, or consortium contracts (BSA-AML and SAR Filing, Privacy and Data Use in Fraud Prevention). Nacha requires account validation for WEB debits before an account number is first used or changed. That rule is about debits, but it's a useful baseline for payout links too (Nacha Rules and ACH Risk). Holds driven by destination risk need disclosure, a reason code and an exit (Withdrawal and Payout Controls).
Mechanisms it helps detect
Payout Redirection · Money Mules · Account Takeover (ATO) · Loyalty and Rewards Redemption Fraud · Multi-Accounting · Sign-Up Bonus Abuse · Referral Abuse · Seller Non-Delivery and Fake Listings · Real-Time Payment Rail Fraud · Instant Funding Abuse (Kiting) · Fraud Rings and Collusion · Gift Card Fraud
Related signals and controls
Signals: Payee and Counterparty Risk · Entity Link Analysis · Account Change Events · Fast In Fast Out Patterns · Payment Instrument Signals · Funding Source Signals · Credit Bureau and Consortium Signals Controls: Withdrawal and Payout Controls · Bank Account Ownership Verification · Negative Lists and Deny Lists · Consortium and Data Sharing · Velocity and Exposure Limits · Kill Switches and Circuit Breakers Playbooks: Playbook - Payout and Withdrawal Risk Members · Playbook - Money Mule Detection Members
Sources and further reading
- Nacha: Fraud Monitoring Phase 1: RDFI credit monitoring; new, dormant and mule-account indicators; effective dates
- Nacha: Supplementing Fraud Detection Standards for WEB Debits: account validation before first use or change of an account number
- FINRA Regulatory Notice 21-18: withdrawals to newly established bank accounts
- Visa: Account Name Inquiry one-sheet: name inquiry for onboarding, payouts and push payments; per-name and overall results; not an AML screen
- Checkout.com: How Visa calculates ANI matches: match, partial match and no-match tiers
- Mastercard: Consumer Fraud Risk expanded to receiving banks (September 2024): network-level mule-account scoring; vendor-reported test results
- Federal Reserve Financial Services: FedNow risk mitigation features (June 2025): segment-level account activity thresholds; the $1M network limit then in force (raised to $10M on November 12, 2025)
- EPCOR: FedNow Service Negative List (2023): participant-managed block lists of account and routing pairs
- ICBA: Detecting Inbound Bank Fraud and Money Mules (August 2026): receiving-side mule red flags
- FDIC OIG: Public Service Alert on Money Mules: fan-in from unrelated people followed by fast outflows
- FBI IC3: Cryptocurrency kiosk PSA (May 2026): 2025 kiosk complaints and losses; crypto as an irreversible exit
- Pay.UK: Confirmation of Payee reaches two billion checks (2024): scale of bank-account name checking in the UK