The launch of FedNowSM by the Federal Reserve in July of 2023 is indeed a watershed event. FedNow represents the first new payment platform delivered by the Federal Reserve in over 40 years. FedNow will be the public sector instant payments capability available to all U.S. financial institutions.
While FedNow is new for the Fed, is it new for the payments landscape in the United States? The answer to that question is “no”. RTP®, the instant payment product provided by The Clearing House, has been in market since 2017. So the industry has some experience with bank-to-bank instant payments. RTP and FedNow both offer instant payment capabilities to financial institutions and will do so in parallel. At the launch of FedNow, the platforms will not be interoperable – banks will join one or both. Both platforms will offer irrevocable bank to bank payments, cleared and settled instantly, on a 24 x 7 x 365 basis. There are some differences between the platforms, but that would be the topic of a different post! For our purposes, FedNow and RTP offer similar instant payment capabilities to financial institutions.
When exploring what exposure FedNow might have to scam activity, we can look to the actual market experience with RTP. The Clearing House does not publish fraud statistics. TCH uses UK Faster Payments as a benchmark and UK Faster Payments publishes an Authorized Push Payment fraud rate of around 10 basis points. Apparently, the RTP fraud rate has consistently been well under the UK Faster Payments rate.
Why is it that RTP would have such a modest fraud rate? Here are three considerations:
- Adoption of RTP, while growing, is still relatively modest. Of approximately 9,500 financial institutions in the US insured or supervised by NCUA and FDIC, less than 400 participate in the RTP network.
- An even more limited number of financial institutions participate in RTP under a “Send” persona – allowing them to offer instant payment initiation to their customers.
- Financial institutions have been slow to make products available to their business and consumer customers providing direct access to RTP.
Taken together, these considerations render a limited attack surface for bad guys. Why would they “hunt and peck” trying to find an opportunity to exploit RTP for a scam when other ways to move their ill-gotten gains are readily available?
Whatever the fraud rate, the irrevocable nature of instant payments means that under current rules there is no structured mechanism in the network (either RTP or FedNow) for the defrauded party to get their funds returned. For reasons ranging from customer satisfaction to brand reputation to avoiding additional regulatory oversight – it behooves financial institutions to proactively address fraud related to scams.
The Federal Reserve offers FedNow to financial institutions. The Fed offers no products to consumers or businesses. When we think of the scam activity reported in the market, the vector for the fraud is typically a familiar consumer facing application. Or, as in the case of Business Email Compromise, the vector could be a financial institution which took the instruction from the victim customer. As such, the challenge is not for the FedNow network as much as it is for the individual financial institutions offering an instant payments capability via FedNow.
The U.S. is still in the early stages of instant payments adoption. The launch of FedNow will create greater awareness of instant payments and will likely raise demand and activity on both FedNow and RTP. Much of that demand will be driven by financial technology providers and by banks and credit unions who move to create new instant-enabled products. As these products become more available, instant payments will become more attractive to nefarious actors.
FedNow has positioned itself as the instant payment solution for “financial institutions of every size” and it is expected that community financial institutions will gravitate to FedNow. The greater number of institutions, over time offering a greater number of products and greater reach, will create a more attractive attack surface to fraudsters.
The Department of the Treasury announced that it participated in the FedNow Pilot and is one of the entities named as being certified for FedNow prior to launch. The Treasury’s Bureau of the Fiscal Service (BFS) disburses ~90% of federal payments, including benefit payments. BFS processed the payments that included the near one TRILLION dollars worth of benefit fraud experienced over the several years and programs related to COVID relief. There has been no announcement about which types of payments BFS will move to FedNow. But it is safe to assume that fraudsters will be paying careful attention to take advantage of this new faster way to exfiltrate their bounty.
Financial institutions would be ill-advised to use more conservative controls in the belief that FedNow is somehow a “safer” network. There will always be fraud in payments and, just like other payments customers, fraudsters like their money instantly!
Now is the time for financial institutions to establish “instant payments awareness” in their fraud and scam detection capabilities. Those participating in FedNow should pay attention to the FedNow fraud mitigation capabilities, particularly fraud reporting and the ability to establish a negative list. The latter can be very useful for FedNow participants who identify troublesome accounts. Behavior can be a leading indicator of accounts that should be on a negative list.
Programs to understand customer intent, including the ability to interdict or slow down payments, must be developed. Many of the institutions participating in FedNow will do so under a “Receive Only” Participation Type. Particularly for scam activity, the fraudster lives on the RECEIVE side of the transaction. Programs to identify and prevent mule activity can be put in place today. This is not limited to those immediately participating in FedNow. A good portion of fraud involves multiple payment channels.
So, will FedNow be immune to scams? The answer is “no”. If anything, the prospect of scams gravitating to instant payments will increase with the introduction of FedNow. Instant payments do indeed have the ability to create better money movement experiences for all stakeholders. Financial institutions are at the front line to make sure these experiences are positive.
