Striking the right balance to combat rising APP fraud in the US

APP fraud has been steadily increasing, with losses projected to reach around $3.08 billion by 2026. This reflects a significant increase from previous years.

In response to this global challenge, Britain’s Treasury (HMT) last year published draft regulations that would allow banks to delay outbound payments for up to 72 hours if fraud was suspected.

Similar legislation has been proposed to crack down on US payment scams. But the push to implement legislation that would allow US banks to delay real-time payments (RTP) by three days if they suspect fraud has garnered a mixed response.

A more measured response, including the use of innovative fraud detection systems, would be more business friendly and still protect the consumer.

RTP and FedNow are designed for immediate transaction processing, and any proposed delays would herald a significant shift in operational standards.

Proponents of this approach argue that the additional time for banks to investigate suspicious transactions is necessary to protect consumers from scams. For instance, Britain’s Economic Secretary to the Treasury, Tulip Siddiq, highlighted that this measure aims to safeguard vulnerable communities from scammers who exploit them, suggesting that the delay could help “...break the criminal spell that scammers weave.”

Critics, however, have expressed concerns that these delays could lead to increased friction in payment processes – something banks have been working hard to minimize.

A more balanced approach with the right regulatory reforms, along with innovative fraud detection systems, would be a better option. Disrupting payment flows could lead to late fees and negatively impact businesses who rely on rapid payments for their cash flow requirements. The net result of the 72-hour delay would be a lot more anxiety and pressure on consumers and business owners alike.

Others in the industry have argued that the approach could also stifle innovation and competition within the fintech industry, which relies on efficient payment systems to thrive.

There are already a number of innovative technology solutions to fighting APP fraud, with rapid advancements being made.

Several banks have adopted Confirmation of Payee systems, which help verify that the name on a bank account matches the intended recipient's name before a payment is processed.

Financial institutions are also increasingly deploying artificial intelligence (AI) and machine learning to profile customer behavior and detect anomalies that may indicate fraud.

By using signals from other devices, it is now possible to build up advanced recommendations for risk-based authentication (RBA). For example, behavioral biometrics allow banks to learn about a customer’s transactional behavior to determine which interactions are legitimate and which should be flagged as suspicious and stopped before they happen. This helps banks pick up user behavior that is out of the ordinary, calculate the risk posed by transactions, and decide what to do about it.

The rapid payments systems are by no means complacent when it comes to protecting users. FedNow already offers some risk management controls, including negative lists, which allow banks and credit unions to block certain payments either in or out.

Regulators are also working hard to include the entire financial ecosystem in the fraud fighting solution.

The Atlanta Fed has released a report outlining some of the most effective strategies to combat APP fraud, including the importance of sharing information. The Fed’s ScamClassifier, is a voluntary tool designed for information sharing. It enhances detection and reporting as well as mitigation efforts within organizations and across the entire payments supply chain.

In addition, new National Automated Clearing House Association (Nacha) rules require institutions to establish and follow procedures for Automated Clearing House (ACH) credits received that are potentially suspicious or fraudulent. The rules aim to enable quick return of fraudulent transactions.

Unlike the UK's mandatory reimbursement rules, US banks are not uniformly required to provide reimbursement for APP fraud. While some states have begun to implement their own regulations regarding consumer protection against fraud, these efforts are fragmented and vary widely across different jurisdictions. Smaller banks have also expressed concerns about their ability to absorb these costs.

It’s clear that the US response reflects a cautious approach. It would make sense to find a way to strike a balance between good consumer-first regulation and all the benefits of rapidly advancing fraud detection technology. This is not a zero-sum game. User protection doesn't have to come at the expense of user experience. A balanced approach that doesn’t reduce the efficiency of rapid payments is optimal and will be both business and growth friendly.