Payout Redirection

What it is

Payout redirection is the most common exit of Account Takeover (ATO) on platforms that pay money out to customers: marketplaces, gig and creator platforms, cashback apps, brokerages and payroll-connected accounts. Its distinguishing feature is that the attacker often makes no unusual transaction. They change one setting and let the platform's own payout process do the rest. Transaction-level models trained on "unusual payments" can miss it completely.

It's distinct from:

• ACATS out (ACATS Transfer Fraud), where the whole account moves to another firm rather than cash to a destination.
• Reward redemption theft (Loyalty and Rewards Redemption Fraud), where the balance is converted (to gift cards or partner points) rather than redirected. In practice the two often happen together.
• Direct-deposit diversion at an employer or benefits portal, where the source account is compromised elsewhere and your platform receives diverted pay. You see the receiving side as mule behavior.

How it works

In outline, the attack has four steps:

1. Access. Any ATO entry: Session Hijacking and Infostealers is especially common because there's no login event, and so is Account Recovery Abuse.
2. Change the destination. Add a bank or card, replace the primary one, or change the email tied to a wallet-based payout.
3. Trigger or wait. Request an instant payout, or let the weekly ACH run. Patient attackers wait for a high-balance cycle.
4. Exit. The receiving destination is often a mule account or a reloadable card, frequently shared across many victims.

Transaction footprint

Common variants

Where it shows up

• Marketplaces. The seller's pending balance is the prize, and payout timing relative to buyer claims matters. See Online Marketplaces and Seller Onboarding and Reserves.
• Cashback and rewards. Balances build up for months without the owner checking them. Cash-out destinations (bank, PayPal-style wallets, gift cards) are the control point. See Cashback, Coupons and Rewards.
• Brokerage. Bank-link changes before withdrawals are a classic ATO pattern. FINRA's ATO practices notice describes confirmation calls to the phone number on file when a withdrawal goes to a newly established bank account. See Brokerage and Investing.
• Neobanks. The receiving side of payroll diversion, plus outbound linked-account changes. See Neobanks and Consumer Fintech.

Impact

• Direct loss is one payout cycle per compromised account, or more if the change isn't noticed. Marketplace losses may double: the seller has to be made whole and buyers' claims still arrive.
• Earners and sellers depend on payouts for income, so a missed payout causes real hardship and escalations.
• Destinations reused across victims point to Money Mules and Fraud Rings and Collusion. Nacha's 2026 rules require receiving institutions to run risk-based processes to spot suspicious incoming credits, including ones landing in new, dormant or mule accounts. See Nacha Rules and ACH Risk.

Red flags

• Payout destination changed shortly before a payout, especially with a new device or contact change (Account Change Events, Device Fingerprinting)
• New destination with no ownership or name match (Funding Source Signals, Payment Instrument Signals)
• A destination attached to other unrelated accounts (Entity Link Analysis, Payee and Counterparty Risk, Payout Destination Intelligence)
• Switching from standard to instant payout right after the change (Fast In Fast Out Patterns)
• Redemption or cash-out of balances that sat untouched for a long time (Promo and Reward Redemption Patterns)

Prevention and detection at a glance

Emerging variants and adversary adaptation

• As platforms offer push-to-card and instant-rail payouts, attackers choose them to get ahead of detection and returns. Treat "first instant payout after a destination change" as one of your riskiest events. See Real-Time Payment Rail Fraud.
• Infostealer-fed session replay means destination changes increasingly happen with no login and no fresh authentication. Re-authenticating at the change is the most effective single control. See Session Hijacking and Infostealers.
• As blocklists on bank accounts and cards improve, attackers rotate through more destinations (fresh prepaid cards, newly opened mule accounts, wallets), so velocity of new destinations across the platform becomes a signal.
• Nacha's fraud-monitoring rules (Phase 1 effective March 20, 2026; Phase 2 June 22, 2026 in practice) push receiving banks to watch credits into new and mule accounts. Expect more freezes and returns, and plan for recall coordination.
• Payout destinations held by AI agents or aggregators (Agentic Commerce Fraud) are likely next. They add another layer between the account holder and the money, and ownership verification has to reach through it.

Related mechanisms

• Account Takeover (ATO): the hub
• Session Hijacking and Infostealers and Account Recovery Abuse: common entries
• Loyalty and Rewards Redemption Fraud: the redemption-side counterpart
• Real-Time Payment Rail Fraud: instant payout rails
• Money Mules: where redirected payouts land
• Multi-Accounting: farmed accounts paying out to shared destinations

Real-world examples

• FINRA Regulatory Notice 21-18 describes broker-dealers monitoring withdrawals to newly established bank accounts and calling a phone number on file to confirm.
• Case Study - DraftKings Credential Stuffing (2022): customer funds withdrawn after accounts were taken over.

Sources and further reading

• FINRA Regulatory Notice 21-18: withdrawals to newly established bank accounts; confirmation calls; adaptive authentication on bank changes
• Nacha fraud monitoring rules, Phase 1: RDFI monitoring of credits into new, dormant or mule accounts; phased effective dates
• Nacha new rules page: Phase 1 March 20, 2026; Phase 2 June 22, 2026 in practice
• FBI IC3 PSA I-112525-PSA: fast movement of funds to criminal-controlled accounts after ATO
• FinCEN Financial Trend Analysis: Identity-Related Suspicious Activity: compromise typologies, including transfers to attacker-controlled accounts