P2P payment fraud is the misuse of person-to-person payment apps to trick someone into sending money to a criminal. Attackers often use stolen identities, impersonation, or account takeover to authorize transfers, then move funds quickly through trusted channels, making recovery difficult. It often overlaps with social engineering and identity compromise.
What P2P payment fraud is doing beneath the surface
P2P payment fraud turns ordinary peer-to-peer transfers into a fast-moving loss event. The core problem is not the app itself, but the attacker’s ability to appear trusted long enough to get the victim to approve a transfer or to move funds through an already-compromised account.
This is why the fraud is so effective: the payment rail is designed for speed, convenience, and immediate settlement, while the victim often sees a familiar name, a routine transfer flow, or a convincing message rather than an obvious intrusion.
How P2P fraud differs from ordinary payment misuse
P2P fraud usually relies on social engineering, impersonation, or account takeover rather than payment-card mechanics. A criminal may pose as a friend, family member, employer, platform support agent, or business contact, then use urgency, pressure, or deception to push a transfer that the victim believes is legitimate.
That difference matters because the “authorisation” often comes from the user, not from a stolen card number or a broken checkout flow. In practice, the abuse sits at the intersection of identity compromise, scam psychology, and the transfer model of the payment app.
For organisations that handle money movement, P2P fraud is best understood as a trust failure, not just a payments issue. The same trust cues that make person-to-person transfer convenient also make it attractive to criminals who want a quick, low-friction cash-out path.
Why the fraud is hard to unwind once the money moves
P2P transfers can be difficult to reverse because funds often leave the victim’s account quickly and may be dispersed through additional accounts before a dispute is raised. That speed narrows the response window and makes recovery dependent on rapid detection, escalation, and coordination with the platform or financial institution.
Fraudsters also benefit from scale. Once they have a convincing story, a stolen identity, or access to a compromised account, they can repeat the same play across many victims with little technical overhead. The result is a high-volume scam pattern that is operationally efficient for the attacker and expensive for the defender.
In practice, the strongest controls are those that reduce trust abuse, disrupt account takeover, and make abnormal transfer behaviour easier to spot before funds are gone.
What organisations and users should verify
Exposure review starts with knowing which employees, customers, or accounts can send money through P2P channels, how those accounts are protected, and which devices or sessions can authorise transfers. That inventory should be paired with review of impersonation paths, suspicious login activity, and any payment workflow that allows urgent or out-of-band transfer requests.
Users should verify the sender through a separate channel before sending money, especially when a request is urgent, unexpected, or emotionally pressured. Organisations should make sure employees know how to verify payment instructions and report suspicious transfer requests quickly.
For a broader view of fraud patterns that overlap with P2P abuse, Top 10 Online Fraud Attacks is useful because it places account takeover, deepfakes, SIM swap, and scam-driven transfer abuse in one operational picture. When the fraud is framed as a payment problem, teams may miss the upstream identity and social-engineering signals that made the transfer possible.
How response and prevention should be organised
P2P fraud response should focus on speed: stop further transfers, preserve evidence, and alert the payment provider as soon as suspicious activity is confirmed. Where the abuse came from impersonation or a convincing fake request, the response team also needs to determine whether the same lure is still active and whether other recipients are likely to be targeted.
Prevention works best when organisations combine user verification habits, account protection, transfer monitoring, and clear escalation paths for suspected scams. The highest-value control objective is to make it harder for attackers to turn trust into immediate money movement.
For payment-specific guidance, the Payment Fraud Guide is the most direct internal reference for the wider fraud landscape, while Authorised Push Payment (APP) Fraud Guide helps explain why scam-enabled transfers are so difficult to reverse once the user has approved them.
Risk and Threat Considerations
P2P payment fraud creates a direct financial loss risk, but the bigger issue is that it exploits trusted transfer channels and human judgement at the same time. When attackers obtain account access or persuade a victim to authorise a transfer, recovery can be slow or impossible.
Failure mechanism: The attacker either impersonates a trusted party or compromises an account, then uses urgency and routine transfer behaviour to get money moved before the victim or the platform can intervene.
Impact: Funds may be dispersed quickly, disputes become harder to resolve, and the same identity or transfer path can be reused for further fraud.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | P2P fraud often begins with account takeover of staff or operators. |
| IA-5 — Authenticator Management | Fraud commonly succeeds when passwords, tokens, or sessions are stolen or abused. | |
| Recommendation — Require strong user authentication for payment access and review abnormal sign-in activity. Protect and rotate authenticators, tokens, and sessions used to approve money movement. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | P2P fraud depends on excess or misused access to accounts and transfer functions. |
| Recommendation — Restrict payment actions to approved roles and remove unnecessary transfer privileges. | ||
| MITRE ATT&CK | T1566 — Phishing | Impersonation and scam lures are common entry points for P2P fraud. |
| T1111 — Multi-Factor Authentication Interception | Account takeover behind P2P fraud often involves capturing or bypassing authentication controls. | |
| Recommendation — Map scam lures to phishing patterns and tune detection for impersonation-driven transfer requests. Monitor for MFA bypass and session abuse that could enable fraudulent transfers. | ||
Practitioner Guidance
Why practitioners should care: P2P fraud is often treated as a consumer scam, but for banks, fintechs, and payments teams it is also an identity and transaction-risk problem. The practical question is whether the organisation can detect abnormal transfer intent early enough to interrupt the payment.
What to watch for: Urgent payment requests, first-time payees, unusual device or session behaviour, and a sudden shift in transfer amount or recipient are all signals that deserve scrutiny. If the request arrives with social pressure or a story that discourages verification, treat that as a control warning rather than a customer-service issue.
Practitioner takeaway: The best defence is not just stronger payment controls, but faster challenge and verification when the request itself looks socially engineered.
Related resources from NHI Mgmt Group
- How should payment teams balance compliance and fraud controls in APAC P2P systems?
- What risk management controls reduce payment fraud on P2P platforms?
- What breaks when payment fraud controls assume a human is always the actor?
- Who is accountable when fraud starts on social media or SMS and ends in a payment?