More real-time payments means more fraud. So how do you stop it?

With easy access and fast transaction speeds, balancing fraud prevention and customer experience is more important than ever.

Key takeaways:

• Real-time payment systems like RTP and FedNow are gaining popularity, promising faster, more convenient transactions for customers and businesses.
• However, these systems also create new openings for fraudsters to commit authorized push payment (APP) fraud and social engineering scams.
• Fraud prevention for real-time payments requires a multi-layered approach that includes robust onboarding processes, machine learning algorithms, behavioral biometrics, and industry-wide data sharing.
• To balance security and user experience, financial organizations see a need for “friction-right” banking that protects customers without unnecessarily impeding real-time transactions.
   

The trend towards real-time payment methods is going strong. Our newest real-time payment system, FedNow, launched in July 2023. As of June 2024, more than 800 financial institutions had adopted FedNow, a steep increase from the initial 35 organizations at launch. Meanwhile, RTP has also experienced growth, with 652 institutions adopting this system as of May for near-instant fund transfers between financial institutions.

While this rapid adoption of real-time payment systems promises faster, more convenient transactions for customers and businesses, it also creates new opportunities for fraudsters. As financial institutions decide which instant payment system to adopt, they also have to have strategic discussions about which customers will be able to use the network. However, an intentional rollout is just one facet of real-time payments fraud prevention. 

This blog post explores the rise of real-time payment fraud in systems like RTP and FedNow and their impact on fraud. It then outlines effective strategies for protecting financial services customers against real-time payments fraud while maintaining a seamless user experience.

Customers want payment options that are fast and convenient... 

When Automated Clearing House (ACH) payments were first introduced, they took several days to process, with banks handling transactions in overnight batches. However, as digital technology progressed, customers began to expect the same speed and convenience in financial services that they enjoyed in other areas of their lives, like TV streaming or package delivery. Changing expectations led to faster payment processing times and technologies—and with them, growing opportunities to commit payment fraud. In response, financial institutions and fintechs are developing and implementing new risk models tailored to real-time payments' unique characteristics.

In payments, words like “instant,” “real-time,” and “faster” tend to mean the same thing: electronic payment services that provide funds to the payee within seconds or up to a few hours of the payer initiating the transaction. Instant payments are possible thanks to real-time payment technology like RTP, FedNow, and even peer-to-peer (P2P) payment systems like Zelle.

What is RTP?

‍RTP, which stands for real-time payments, is an interbank payment system that enables instant transfers between accounts at different financial institutions. When it launched in 2017, RTP was the first new core payments infrastructure in the US in more than 40 years. According to The Clearing House, the RTP network currently reaches 65% of US demand deposit accounts (DDAs) and is accessible to financial institutions holding close to 90% of these accounts. 

Banks and credit unions within the RTP network offer faster payments, giving customers quicker access to their money, improving cash flow, and speeding up business transactions. Unlike traditional banking, RTP operates around the clock, meaning that payments can be settled anytime, day or night. This continuous availability can help businesses better manage global operations and help consumers handle urgent financial needs.

To participate in the RTP network, banks must meet specific requirements, like having federal insurance. Fintechs can take advantage of the RTP network through a sponsorship system, borrowing rails from accredited financial institutions that already participate.

Why FedNow?

In 2020, the Federal Reserve surveyed more than 2,000 businesses ranging in size from less than $1 million in annual revenue to more than $250 million to understand the market readiness for what they dubbed “faster payments,” electronic payment services that provide funds to the payee within seconds or up to a few hours of initiation by the payer. 

The Federal Reserve found that nearly 75% of micro-businesses and 60% or more of all other businesses cited managing cash flow and working capital among their top concerns (due in part to the COVID-19 pandemic). Businesses’ priorities included increasing digital or online payment options and ensuring payment timeliness, alongside increasing sales. Many respondents were already using faster payments such as same-day ACH, push-to-card, or digital wallet apps.

Within the survey group, 40% had changed banks within the prior five years, and of those, more than 80% said they would consider changing again for access to improved payment services. According to the Federal Reserve, 90% of businesses expected faster payments by 2023. 

In response, the Federal Reserve launched FedNow, an instant payment service, in 2023. FedNow intends to help financial institutions and businesses manage cash flow, improve financial visibility, and increase operating efficiency by offering instant or real-time payments. 

Recommended for you: RTP, FedNow, and Zelle… What’s the Difference?

…The problem is that fraudsters want the same thing

Fast and convenient payment avenues aren’t just good for customers—they can also work in fraudsters’ favor. Risk-wise, RTP and FedNow can both be used to commit authorized push payment (APP) fraud, which Alloy reports as the most common fraud type by volume globally. However, RTP’s transaction limit is $1 million, and FedNow’s is $500K.

Whether RTP or FedNow, real-time payments require faster fraud detection and prevention measures. That’s because real-time payments are typically irrevocable. This puts more emphasis on pre-transaction fraud prevention. 

Strategies to stop real-time payment fraud

Real-time payment systems operate around the clock, so regulators expect continuous monitoring and the ability to respond to fraud at any time. Combating fraud in real-time payments requires a layered approach:

1. Stop fraud at onboarding. One of the most critical requirements for stopping real-time payment fraud is to prevent fraudsters from onboarding into your financial organization’s system in the first place. Fraud solutions tackling identity risk can help keep bad actors with synthetic identities from making payments via your organization’s rails.
2. Use real-time interdiction when risk is suspected. Real-time interdiction allows financial institutions to pause suspicious transactions instantly for further review. This crucial step allows financial institutions to pause and review suspicious transactions the moment they're initiated instead of once completed.
3. Implement machine learning (ML) algorithms. With machine learning, institutions can improve fraud detection accuracy while minimizing false positives. That’s because sophisticated ML algorithms can process large amounts of data in milliseconds. These systems can analyze historical transaction patterns to identify fraud in real-time, adapting to new anomalies and fraud patterns as they emerge. 
4. Incorporate behavioral biometrics into your fraud detection strategy. This technology analyzes unique user behaviors such as typing patterns, mouse movements, and device handling. It can help identify suspicious activities even when traditional credentials appear valid.
5. Use MFA to introduce friction, especially for high-risk transactions. Consider using risk-based authentication, like automated step-up verification, which applies stricter security measures only when necessary based on a transaction's risk level.
6. Selectively roll out real-time payments. Rather than providing access to all client segments in a broad stroke, intentional rollouts allow for managing fraud risk without opening the floodgates.
7. Participate in data-sharing. In April, the US Treasury accused banks of not sharing enough data about fraud attacks. Financial organizations can create a more robust defense against emerging threats by pooling information about known fraud attempts and patterns. Interbank data sharing and sharing fraud information with law enforcement can help reduce fraud attacks industry-wide.
8. Double down on customer education. Educate your customers about the risks associated with real-time payments and provide guidance on how to protect themselves. The goal is to educate clients so they are less likely to become victims of social engineering scams.
9. Keep updating your strategies. Your real-time payment fraud detection strategy should evolve regularly. Review and update your fraud prevention strategies according to current fraud trends.

While implementing robust fraud prevention measures is critical, maintaining a positive customer experience is equally important. Financial institutions and fintechs should strive for a balance by leveraging passive security measures that operate behind the scenes without impacting user interactions. When additional security steps are necessary to keep customers safe, clear communication helps maintain trust and understanding. 

Recommended for you: How to stop fraud at the flip of a switch

It’s not about being frictionless; it’s about being friction-right

There’s no stopping payment fraud completely. However, by focusing on finding a friction-right balance, financial institutions can provide security and the seamless digital experience today's customers expect.

Think of it this way: the right kind of friction doesn’t deter customers from entering their own accounts. Instead, it makes customers feel safer. Friction-right banking is about adding the right security layer at the right time. It's not about removing all friction but implementing smart, targeted steps to protect customers without unnecessarily slowing down transactions.