Real-Time Payments Fraud Guide: Rail-by-Rail Controls for FedNow, Faster Payments, Pix, RTP and UPI

Real-time payments settle in seconds and cannot be pulled back by the sender's bank, so a fraud decision that arrives after the payment is sent arrives too late. Instant payment rails now run around the clock in the US, UK, EU, Brazil and India, with per-payment limits reaching $10 million on the US networks. This guide sets out the fraud controls that work on irrevocable rails: transaction limits, payee checks, real-time scoring, payment holds, mule detection on the receiving side, and the rail-specific rules and tools each scheme provides. It is written for fraud, payments and risk teams at banks, payment service providers and fintechs, and for executives who own instant payment risk. The scam types themselves are covered in the Authorised Push Payment (APP) Fraud Guide. Rails are listed alphabetically, and the order is not a ranking.

Key takeaways

• The decision has to happen before the money moves. On instant rails the only reliable control point is the sending institution's pre-authorisation decision, so scoring, payee checks and holds must all fit inside that window.
• Most losses are authorised, not stolen. In 2024 payment service users bore about 85% of EEA credit transfer fraud losses, mainly from scams that tricked them into paying, so controls must protect customers from themselves as well as from attackers.
• Limits are a fraud control, not just a liquidity setting. FedNow lets participants set account activity thresholds by customer segment, and network limits are a ceiling, not a target.
• Receiving banks now share the loss. UK reimbursement rules split APP scam costs 50:50 between sending and receiving firms, which makes mule detection on inbound payments a direct financial priority.
• Use the legal room to slow down. UK firms may delay an outbound payment until the end of the fourth business day where they have reasonable grounds to suspect fraud, and Brazil's Pix return mechanism can trace funds beyond the first receiving account.

Why instant payments change the fraud problem

Card payments have chargebacks and batch payments have time to review. Real-time payments have neither. The euro SEPA Instant Credit Transfer scheme, for example, gives the recipient's bank no more than ten seconds to confirm that funds are available, around the clock (ECB). Once credited, funds can be moved onward to other accounts or converted to cryptocurrency within minutes.

The attack itself usually starts elsewhere: phishing or social engineering (ATT&CK T1566) that leads to account takeover or a convinced victim, ending in financial theft (T1657). The payment rail is where the loss becomes final.

Rail-by-rail rules and tools

Each rail provides different network-level tools. Know what your scheme gives you before building your own.

FedNow Service

The Federal Reserve raised the FedNow network limit from $500,000 to $1 million in 2025, alongside new account activity thresholds that let participants set value and velocity limits for each customer segment, for example a higher cumulative total for established business customers than for new retail accounts. The default transaction limit stayed at $100,000. In November 2025 the network limit rose again to $10 million, the Federal Reserve added ScamClassifier model forms to its fraud reporting so participants can describe scams consistently, launched an Exception Resolution Service for participants to resolve disputes and information requests directly, and announced a pilot of a network intelligence tool that would let senders pre-check a receiver account before paying. Treat the pilot as subject to change.

Faster Payments

Under the Payment Systems Regulator's rules, payment service providers must reimburse victims of APP scams made over Faster Payments or CHAPS on or after 7 October 2024, up to £85,000 per claim, with an optional excess of up to £100 that cannot be applied to vulnerable customers. Claims must be made within 13 months, and the exceptions are complicity and gross negligence, which the PSR describes as a high bar and which does not apply to vulnerable consumers. Sending and receiving firms split the cost 50:50. Separately, the Payment Services (Amendment) Regulations 2024, in force from 30 October 2024, let a firm delay an outbound payment where it has reasonable grounds, established by the end of the business day after receipt, to suspect fraud or dishonesty by someone other than the payer. The delay can last until the end of the fourth business day after receipt, and the payer must be told the reason and what is needed by the end of the next business day, unless the payer may be complicit or telling them would be unlawful (FCA FG24/6). See the Confirmation of Payee and Payee Verification Guide for payee name checks.

Pix

Brazil's central bank amended the Pix Regulation in August 2025 to strengthen the Special Refund Mechanism (Mecanismo Especial de Devolução, MED), which returns funds to victims of fraud, scams or coercion. According to a legal summary of the change, refunds were previously limited to the first account that received the money; the update lets participants trace where the funds went next and share that information, with a self-service dispute channel required in banking apps from 1 October 2025 and tracing mandatory from 2 February 2026. Check the central bank's current Pix rules before relying on these dates.

RTP network

The Clearing House's RTP network supports payments of up to $10 million per transaction, around the clock, and has processed payments since 2017. Its ISO 20022 messages carry structured remittance and party data, which fraud and sanctions screening should use rather than ignore.

SEPA Instant Credit Transfer

The European Payments Council launched SCT Inst in November 2017, and the Instant Payments Regulation (EU) 2024/886, adopted on 13 March 2024, requires euro instant payments to be widely available. It also requires payment service providers to offer verification of payee, which checks that the payee name matches the account before the payer confirms. Most EEA losses on credit transfers now come from scams rather than unauthorised payments, according to the 2025 EBA and ECB report on payment fraud.

Unified Payments Interface

UPI payments are authenticated with a UPI PIN in an app bound to the customer's registered mobile number. The Reserve Bank of India's directions on authentication mechanisms for digital payment transactions, announced on 25 September 2025 with compliance due by 1 April 2026, set a minimum of two-factor authentication and allow issuers to add risk-based checks according to the fraud risk of each transaction. Most UPI fraud is social engineering in which the victim enters their own PIN, so payee warnings and limits for new payees matter as much as authentication.

Sender-side controls

• Segmented limits: set per-payment, daily and velocity limits by customer type, account age and channel. Lower limits for the first payment to a new payee and for newly opened accounts, as FedNow's account activity thresholds are designed to support.
• Payee verification: check the payee name against the account (Confirmation of Payee in the UK, verification of payee in the euro area) and treat "no match" and "close match" as risk signals, not just messages to the customer.
• Real-time scoring: score every payment before submission using device, session, behavioural, payee and transaction features. Session signals such as an active phone call, remote access tools or unusual typing hesitation often reveal a coached victim. See the Transaction Monitoring and Behavioural Biometrics Guide.
• Dynamic friction: match the friction to the risk. A low-risk payment goes straight through; a medium-risk payment gets a scam-specific warning ("Has someone told you to move money to keep it safe?"); a high-risk payment is held for a call-back.
• Payment holds: where the law allows, hold the payment rather than decline it. A held payment can still be released when the customer is confirmed genuine; a declined one often just moves to another bank.
• Strong authentication for new payees and limit increases: adding a payee, raising a limit and changing contact details are classic account takeover steps. Require step-up authentication and notify the customer's existing contact channels. See the Account Takeover Prevention Guide.

Receiver-side controls and mule detection

Every instant payment fraud needs a receiving account. With UK costs split between sending and receiving firms, and Pix tracing funds beyond the first account, receiving banks carry direct losses and regulatory pressure for the mules they host.

See the Money Mule Detection Guide and the AML programme and transaction monitoring guide.

Building real-time scoring that fits the window

1. Measure your latency budget: find out how many milliseconds the payment journey can spend on fraud decisions before the customer notices or the scheme times out, and design for it.
2. Precompute what you can: customer profiles, payee risk, mule lists and device reputation should be ready before the payment starts, so the live decision is a lookup and a model call, not a batch query.
3. Start in shadow mode: run new rules and models alongside production for several weeks, logging decisions without acting, and measure detection and false positive rates against confirmed fraud.
4. Roll out by segment: enable enforcement first for the highest-risk segment, such as first payments to new payees above a value threshold, then widen.
5. Design the fallback: decide what happens if the scoring service is slow or down. Failing open sends every payment; failing closed blocks every customer. Many banks fail to a lower limit instead.
6. Keep rollback simple: version every rule and model so a bad release can be reverted within minutes, and keep the previous version warm.
7. Feed back outcomes: scam reports, reimbursement claims, receiving bank reports and scheme fraud reports (such as FedNow's ScamClassifier-based reporting) should flow back into labels within days.

Decision guidance by organisation

• Large banks: build in-house scoring with behavioural and payee features, run 24/7 fraud operations for holds and call-backs, and invest in inbound mule analytics.
• Smaller banks and credit unions: use the network's tools and your processor's scoring, set conservative default limits, and apply manual review to first payments above a modest threshold.
• Fintechs and payment apps: fast onboarding attracts mules. Put stronger controls on new accounts' outbound payments and on inbound-to-outbound speed.
• Business banking: corporate customers need higher limits, so pair them with dual authorisation and payee change controls. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.

Detection and measurement

Log every payment decision with its score, reason codes, friction shown and outcome; every hold with its release or confirmation; payee check results; and every scam claim and receiving bank report linked back to the original payment.

• Fraud loss rate: instant payment fraud losses in basis points of instant payment value, split into authorised and unauthorised.
• Detection rate at the point of payment: share of confirmed fraud value stopped or held before submission.
• False positive ratio: genuine payments held or declined for each fraudulent payment stopped.
• Hold resolution time: median time from hold to release or confirmation, within the legal limit where one applies.
• Inbound mule rate: confirmed mule accounts per thousand new accounts, and value frozen after scam reports.
• Reimbursement cost: reimbursement paid as sending and as receiving firm, where reimbursement rules apply.

See the Fraud Metrics and KPIs Guide.

Framework mapping

Common failure patterns

• Using the network limit as the customer limit: a $10 million network ceiling does not mean a new retail account should be able to send anywhere near that. Set segment limits far below it.
• Generic warnings: a single "be careful" banner is clicked through. Warnings that name the scam type the payment resembles, based on the payee and the stated purpose, work better.
• Declining instead of holding: a decline sends a coached victim to another bank with the scammer still on the phone. A hold with a call-back breaks the spell.
• Ignoring inbound payments: banks that score only outbound payments host mule accounts until the receiving share of reimbursement costs arrives.
• Treating payee mismatch as a customer problem: a "no match" result the customer overrides should raise the risk score and may justify a hold.
• Slow scam reporting routes: victims who cannot reach a human out of hours lose the minutes when funds could still be frozen at the receiving bank.

Practitioner checklist

• Set per-payment, daily and velocity limits by customer segment, well below network limits, with lower limits for new payees and new accounts.
• Run payee name checks and use "no match" and "close match" outcomes in the risk score.
• Score every outbound instant payment before submission within a measured latency budget, with a defined fallback.
• Use holds and call-backs for high-risk payments, within the legal limits that apply in each market.
• Require step-up authentication for new payees, limit increases and contact detail changes.
• Monitor inbound payments for mule patterns and freeze funds immediately on scam reports.
• Use your rail's tools: FedNow account activity thresholds and fraud reporting, UK reimbursement and payment delay rules, Pix MED, verification of payee.
• Run new rules in shadow mode, roll out by segment and keep rollback ready.
• Offer a 24/7 scam reporting route that reaches staff who can freeze funds.
• Report loss rate, detection rate, false positive ratio, hold resolution time and reimbursement cost monthly.

Standards and references

• Federal Reserve Financial Services: FedNow Service Fall Announcements
• Federal Reserve Financial Services: FedNow Risk Mitigation and Transaction Limit
• Payment Systems Regulator: APP Fraud Reimbursement Protections
• Financial Conduct Authority: FG24/6 Guidance for Firms that Enables a Risk-Based Approach to Payments
• EUR-Lex: Regulation (EU) 2024/886 on Instant Credit Transfers in Euro
• Reserve Bank of India: Directions on Authentication Mechanisms for Digital Payment Transactions
• European Central Bank: Instant Payments
• The Clearing House: RTP Network

Related NHI Mgmt Group resources: Authorised Push Payment (APP) Fraud Guide · Confirmation of Payee and Payee Verification Guide · Money Mule Detection Guide · Payment Fraud Guide · Online Fraud and Scam Statistics Guide