Article
9 min read
Posted by Sara Seguin on Apr 17, 2023
Do faster payments mean faster fraud?
Until 2017, the fastest payment method in the US was wire or ACH, which takes an average of 1-3 business days to clear and settle. Even same-day ACH usually takes several hours and has similar constraints to standard ACH payments, such as cutoff times and no operation hours outside of bank business hours.
This delay in payment — even if just for a maximum of a few days — presents challenges for both consumers and businesses and, more broadly, goes against society’s increasing evolution towards instant experiences for everything from ordering a pack of paper towels to getting a car to the airport to opening a bank account.
In an article for Forbes, Ginny Chappell, senior vice president of digital payments at FIS, summed it up, “We have entered a new era of instancy. Every organization must understand the business case for real-time payment and how it adds value. There are many great examples of high-value/high-impact use cases that we are seeing applied very broadly. Real-time payments can be very empowering for consumers and small business by improving choice and increasing visibility of cash.”
Enter The Clearing House’s RTP Network, which they introduced in November of 2017. It was the first core payments infrastructure in the US since The Clearing House introduced ACH in the 1970s and the first real-time payment method in the US. It has changed payments significantly, enabling money movements within seconds, any time of the day, any day of the year.
This summer, we are looking ahead toward a new real-time payment method: FedNow. FedNow, which is expected to launch in July 2023, is The Federal Reserve’s response to the Clearing House’s RTP Network. But how will this fit into the modern payment landscape, and what do all of these faster payment methods mean for fraud? Let’s take a closer look at some common payment methods:
What is an ACH payment?
An ACH payment is a payment that is processed through the Automated Clearing House Network. These payments are processed in batches at specific intervals throughout the day. ACH payments are a cost-effective payment method and are a popular payment method for business payroll, B2B vendor payments, and paying bills online.
ACH processing speed
ACH payments usually take 1-3 business days to finish processing. However, they do have expedited options, such as ACH NextDay and ACH SameDay, that speed up the processing time for a higher cost per payment.
Still, no matter which type of ACH payment you use, there are no transfers after that day’s business hours, on weekends, or over bank holidays.
Fraud & ACH payments
The added time that it takes ACH payments to process allows the paying party more time to recognize if there’s a problem with the transaction, providing the opportunity to request a reversal of the transaction if identified quickly.
The National Automated Clearing House Association (NACHA) outlines rules for returns on payments if an error is noticed on the originating transaction. Reversals must be submitted to the bank within 24 hours of noticing the error, no later than five banking days after settlement, and for one of the following reasons:
Duplicate payment
Incorrect payment recipient
See AlsoWhat Is a Nonmember Bank?Incorrect payment amount
Payment date earlier than intended (ACH debit only)
Payment date later than intended (ACH credit only)
In addition, NACHA also has guidance when a Receiving Depository Financial Institution (RDFI) has the need to process a return. The reason codes and return timeframes can vary between Originating Depository Financial Institution (ODFI) and RDFI. It is the responsibility of the financial institution to ensure the returns are submitted in accordance with NACHA guidelines.
The short timeframe of return on an originating transaction can be challenging for financial institutions to recover the funds if not identified timely. Making it imperative for financial institutions to be monitoring their ACH transactions.
What is a wire transfer?
A wire transfer moves funds directly from one account at a financial institution to another. Wire transfers are processed individually. Transaction fees vary depending on the bank, but typically range between $25 - $30 per transaction for transfers to an account within the US and $45 - $50 for transfers going outside the US. This can be a popular payment method for a high-value one-time payment to family or friends.
Wire transfer processing speed
Wire transfers are typically processed faster than ACH payments. While most wire transfers can be completed the same day — sometimes within a matter of minutes — they are not considered a real-time payment because it could take up to two days for a wire transfer to settle. Similar to ACH, wires are not processed after-hours, over the weekend, or on bank holidays.
Fraud & wire transfers
Wire transfers are considered to be a form of payment that is irrevocable. Therefore, once the money is sent, the sender only has the ability to request a return of the funds if they are fraudulent or part of a scam.
The receiver is not obligated to return the funds when a wire recall is submitted. This makes it incredibly challenging for clients and banks to recover funds when a fraudulent wire is processed. And that challenge increases if the funds are sent internationally.
To help mitigate, financial institutions can integrate their wire processing system into their fraud detection application in an effort to interdict suspicious wires before they are sent. In addition, establishing a strategy to monitor incoming wires should also be top of mind.
Financial institutions can help to detect fraudulent wires that are being received, and it will help them not only be good stewards of the ecosystem, but also quickly identify accounts that are receiving fraudulent wires.
What is RTP?
The RTP Network is the first real-time payment system in the US. RTP is processed by The Clearing House (which is also responsible for processing ACH payments). RTP payments are processed individually and are settled instantly into the recipient’s bank account.
RTP is not offered by all banks, and most banks that offer RTP only offer it to commercial clients who enroll. Transaction fees are low for RTP, with most transactions only costing a few cents.
RTP processing speed
RTP is the fastest payment option available at the moment (though this will change when FedNow launches later this year). The funds are instantly transferred from one account to another. RTP provides the opportunity for clients to send funds 24x7x365.
Fraud & RTP
While RTP’s processing speed makes it nearly impossible to stop a payment once it begins processing, fraud has not actually been widespread with RTP because it is not readily accessible to the public.
There are extensive fraud controls in place when sending an RTP, such as multi-factor authentication (MFA) and other step-up verification methods to verify a payment before it is sent.
Most banks that offer RTP only offer it to commercial clients who enroll to use it, so there is a lot of structure upfront to prevent fraudsters from even having access to RTP in the first place. But the diligence must continue. Financial institutions must continue to be diligent on their controls and upfront processes, including accessibility to RTP.
What is FedNow?
FedNow is the newest real-time payment method. Scheduled to launch in July 2023, it is The Fed’s answer to The Clearing House’s RTP Network. Similar to RTP, FedNow payments will be processed individually and settled instantly. They will have a similar cost per transaction (a few cents per transaction).
FedNow processing speed
FedNow payments will now rival RTP as the fastest payment method in the market. The funds will be instantly transferred between bank accounts with the ability to process transactions 24x7x365.
Fraud & FedNow
Similar to RTP, FedNow payments will be instant and irreversible. Having strong fraud controls at onboarding, as well as controls set up to flag account takeover (ATO) during your ongoing monitoring, will be key to stopping fraudulent transactions before they begin processing. Real time monitoring of these payments is also an important step to be taking to ensure transactions can be stopped prior to being sent.
The Fed has said FedNow was built with fraud management as a high priority, and they plan to roll out additional anti-fraud measures in 2024 (months after the planned launch of FedNow).
How are RTP and FedNow different?
Other than the transaction limit (RTP’s $1 million and FedNow’s $500K), the main difference between FedNow and RTP is the networks’ ownership. The Clearing House operates RTP — a banking association and payments company owned by the largest banks — and FedNow is operated by the Federal Reserve Bank.
How do peer-to-peer (P2P) payment methods like Venmo and Zelle fit into the mix?
In recent years, apps such as Zelle, Venmo, and CashApp have become popular for people to send money back and forth to their friends and family. These payments are “real-time” or “instant” for money transferred within that app’s system, and once you transfer funds to another person’s app wallet, it is irreversible. This has sparked a lot of attention on these apps’ responsibility when it comes to compliance and protecting its users from fraud.
When these apps first launched, they used ACH to transfer funds from a user's app wallet to their bank account. Now, many P2P apps use a mix of RTP and ACH payments to transfer money from the app wallets to a bank account.
Do faster payments mean faster fraud?
The short answer is yes. With faster payment rails comes faster fraud. And just like with all the other new technologies that have emerged in the financial services industry over the past several years, fraudsters will continue to adapt and figure out new ways to exploit these new technologies.
How can you prevent real-time payment fraud?
I always recommend starting with robust onboarding fraud controls. If you can keep bad actors out of your system from the jump, they won’t be able to exploit your real-time payment methods. Bring multiple data sources together to build a complete picture of each applicant. Use step-up verification methods on riskier applicants before onboarding them — this will make it harder for bad actors to get through your system while minimizing friction for good customers.
From there, set specific ongoing monitoring rules to flag behaviors consistent with account takeover or other suspicious activity. Some examples would be if a new account changes its personally identifiable information (PII) in the first three months, if someone is logging on from an unknown device or location, if someone is sending a large sum of money to an account that they have not previously interacted with, or if a client is performing transactions which are not consistent with prior behavior.
Use automated interdiction to contain threats in real-time — at a transaction level (holding or rejecting payments), account level (freezing accounts), or login (blocking logins). Leverage step-up verification methods for riskier transactions and ensure you have the right controls in place to continue monitoring your strategies so that you can be proactive in making changes.
