Payments fraud is big business, even in the best of times. According to the ABA’s 2019 Deposit Account Fraud Survey Report, there were $25.1 billion in fraud attempts in 2018, up more than 30% from just two years earlier. [1] These fraud attempts took place on all account mediums—checks, debit cards, and electronic banking transactions. [2] Although banks were effective in preventing nearly 90% of the fraud, fraudsters nonetheless made off with $2.8 billion in stolen money. [3]
And we are most certainly not in the best of times. The onset of the global pandemic and its resulting panic and uncertainty have further emboldened fraudsters. A recent TransUnion survey found that 22% of Americans have been targeted by fraud scams related to COVID-19. [4] Indeed, federal agencies such as the FBI, DOJ, and FTC have all warned that fraudsters are aggressively targeting businesses and consumers with COVID-19 related scams. [5] It is a near certainty that businesses and consumers will face more fraud attempts in 2020 than ever before.
As The Clearing House’s real-time payment (“RTP”) network gets a foothold in the United States, it too will become a target for fraudsters looking to make a quick buck. The purpose of this article is to discuss the new landscape of RTP, the potential for fraud on the RTP network, and the laws that may bear on loss allocation.
RTP Network
a. What is RTP?
In the United States, RTP is currently offered through the RTP network, a network rail operated by The Clearing House, an association of some of the largest U.S. banks. [6] According to The Clearing House, an RTP on the RTP network is one where money moves almost instantaneously from one bank account to another, and can be executed 24 hours a day, 7 days a week, and 365 days a year. RTP is a “push” payment system, meaning that payment is sent directly from the payor’s bank to a recipient’s account—the payee does not need to “pull” the funds from the payor’s account using the payor’s account information details. RTP transactions allow recipients to receive payment within seconds of the sending bank initiating the transaction. While The Clearing House has acknowledged that there may be delays for risk management or legal compliance, the general rule is that the receiving bank is required to make funds available immediately. Notably, a sending bank is not able to revoke or recall a payment once it has been authorized and submitted to the RTP network (although there is a process to facilitate bank-to-bank communication around the return of funds).
RTP transactions are ubiquitous; all federally insured depository institutions can be RTP participants today, regardless of their size. RTP is intended to provide convenience and cash flow control for customers. Customers are able to initiate payments from their existing accounts and have the ability to send and receive immediate payments, which may be particularly important for cash-constrained small businesses and consumers.
b. RTP Is Expected To Grow.
RTP made headlines last summer with the announcement by the Federal Reserve Board (“Fed”) of its proposed foray into real-time payments with FedNowsm Service (“FedNow”), a real-time payment and settlement service that the Fed hopes to launch in 2023 or 2024. Given the Fed’s interest in RTP and the push for FedNow, even before the onset of the pandemic, it was anticipated that RTP would gain significant traction in 2020 and 2021. [7]
The global pandemic has only accelerated the need for RTP adoption. The pandemic has hampered the global economy and crippled the job market. As a result, businesses are seeking certainty in their transactions—even with long-time business partners. From a health perspective, consumers and businesses alike are seeking contactless payments. This crisis has resulted in the perfect storm in making the business case for mainstream adoption of faster payments in the United States.
c. Benefits of the RTP Network.
RTP offers extraordinary convenience—as discussed above, RTP allows consumers and businesses to send payments directly from their bank accounts 24/7/365. In addition, RTP offers extensive data exchange and real-time messaging, which helps with accuracy, data transparency and customer engagement. The RTP network notifies the sender once the funds are delivered which allows the sender to better monitor its transactions.
A key benefit of RTP is its robust messaging capability, which allows for a two-way dialogue between the sender and the receiver. The RTP system clarifies payment details and provides an audit trail of all correspondence relating to the payment. This capability provides an extra layer of transparency and can serve as a fraud mitigation tool.
And, of course, there is the namesake benefit of RTP—the “real-time” nature of the RTP transaction, which allows for real-time payment and settlement for users. Given that ACH transfers can take up to three days to settle, and card payments can take much longer, it is not difficult to see the appeal of using RTP instead of other payment systems such as ACH or credit card rails.
Fraud Concerns With RTP
Although RTP offers a host of benefits and fraud-mitigation tools, it is not without its risks. RTP is susceptible to the same types of fraud attacks and scams that are commonplace in other payments systems. One need look no further than Europe, where real-time payment systems have a longer tenure than the United States, to see the impact of fraud.
While there is certainly a benefit of finality and control for the payor with a “push” payment transaction such as RTP, “push” transactions also come with certain fraud risks. For instance, push payment fraud occurs when a fraudster tricks a consumer or business into sending a payment from the victim’s bank account to a bank account owned or controlled by the fraudster. Fraudsters use social engineering tactics and impersonation scams to present seemingly legitimate requests for money. Once the victim authorizes the payment, the funds appear in the fraudster’s account in real time. Fraudsters then quickly transfer or withdraw the money. Because RTP transactions are irrevocable, and because settlement happens in real time, victims cannot reverse a payment and the funds are long gone by the time the victim discovers the scam.
In the United Kingdom, push payment fraud increased 44% in 2018. [8] In 2019, it continued to climb, with a 40% increase in the first half of the year. [9] As RTP gains popularity in the United States, it too is likely to be a target for push payment fraud. This is especially true in light of the February 1, 2020 transaction limit increase from $25,000 to $100,000. [10] Given that fraudsters can now trick victims into sending larger dollar transactions, there is a heightened incentive for fraud.
Account takeover (“ATO”) is another scam that presents risks for the RTP network, just as it does for other payment systems. In ATO scams, fraudsters obtain a victim’s personal identification information using garden-variety phishing scams or by otherwise convincing the victim to share private data. The fraudster then uses the private data to assume control of the victim’s accounts. Of course, once a fraudster assumes control, the fraudster can push payments from the victim’s account to fraudster-controlled accounts. Because of the speed at which RTP payments move, account holders who are not actively monitoring their accounts may not even know that their funds are being stolen until the funds are long gone.
Although RTP has built-in fraud mitigation technology, the technology is not foolproof. When payments are paid and settled in real-time, there is less time for banks to examine and screen for fraud. By the same token, victims also have less time to monitor their accounts and prevent the same fraudster from striking again. Moreover, because transactions can jump from account to account quickly, tracing and recovering fraudulent transactions and associated losses become exponentially harder, despite mechanisms for requesting return of funds. [11]
Governing Laws
RTP transactions are governed by three main bodies of law: (i) the RTP System Operating Rules and incorporated governing documents (collectively, the “Operating Rules”); (ii) Article 4-A of the New York Uniform Commercial Code (“Article 4-A”); and (iii) the Electronic Funds Transfer Act (“EFTA”) and Regulation E (“Reg E”). For commercial and non-EFTA consumer payments made through the RTP network [12], the rights of the participants and parties are governed by the Operating Rules and Article 4-A. By comparison, for RTP payments subject to the EFTA, the EFTA and Reg E apply and, to the extent consistent with the EFTA and Reg E, the Operating Rules and the laws of the State of New York also apply, excluding Article 4-A. [13]
Because of the different laws that may govern RTP transactions, the allocation of risk of loss can vary based on the nature of the payment (EFTA vs. non-EFTA) and the specific facts and circumstances of the transaction. At a high level, as between participating banks, in a push transaction such as RTP, the sending financial institution tends to bear the risk of loss because it is the party that is responsible for authenticating its customer and submitting the customer’s payment on the RTP system. [14] By comparison, the receiving institution plays a much more passive role—it simply accepts payment. Thus, the receiving institution tends not to bear liability. [15]
On the other hand, the loss allocation principles as between a consumer customer and the sending bank present a much more complex picture. For RTP payments covered by the EFTA and Reg E, the obligations under EFTA and Reg E would control, and cannot be varied by agreement. [16] Consequently, if the consumer notifies his or her bank of an unauthorized EFTA transaction within the designated notice periods, the sending bank may suffer the loss. Alternatively, non-EFTA payments are governed by the Operating Rules and Article 4-A, both of which allow loss allocation modification by agreement. [17] Consequently, agreements between the sending institution and its commercial customer may affect the allocation of loss and afford the parties additional clarity on their rights and responsibilities.
Conclusion
In the COVID-19 era, where social distancing and face masks are the new normal, convenient, fast, and contactless payment methods like RTP are likely to become increasingly popular. But as RTP becomes more mainstream, fraud attacks on it are likely to increase as well. Savvy banks and commercial customers can better protect themselves by having agreements in place to allocate loss and mitigate risk. Now, more so than ever before, an ounce of prevention is worth a pound of cure.