FedNow and Instant Payment Fraud: What US Financial Institutions Must Know

Every payment rail carries fraud risk, but instant payments carry it differently. The traditional fraud playbook assumes a window of time exists between when a payment is initiated and when the money is truly gone. That window is where detection happens, where suspicious transfers get held, where recalls get filed. Instant payments collapse that window to nothing, and in doing so, they force a fundamental rethink of how fraud detection has to work.

FedNow, the Federal Reserve's instant payment service, has moved that shift from a European and UK concern into the center of US compliance. For the financial institutions connecting to it, the operational question is no longer whether to modernize fraud controls but how fast. What follows breaks down what FedNow actually is, why instant settlement rewrites fraud risk, the specific fraud types targeting these rails, and the pre-settlement controls that now separate institutions that catch fraud from those that merely document it.

The urgency is not theoretical. Adoption has accelerated sharply since launch, with more than 1,600 participating organizations connected as of January 2026 across the country and transaction volumes climbing quarter over quarter. As instant payments move from a niche capability into a mainstream expectation, the institutions that treat fraud controls as an afterthought are the ones that will absorb the losses, because on these rails the losses are effectively unrecoverable once they occur.

The following topics are going to be covered in this article;

1. What Is FedNow?
2. Why Instant Payments Fundamentally Change Fraud Risk
3. Fraud Types Targeting FedNow and Instant Payments
4. How to Detect Fraud on Instant Payment Rails: Pre-Settlement Controls
5. FedNow vs RTP vs ACH vs Wire: Comparison Table
6. The Fed's Fraud Prevention Tools for FedNow
7. Regulatory Landscape: What's Required for FedNow Participants
8. How Sanction Scanner Helps FedNow Participants

1. What Is FedNow?

FedNow, launched July 2023, is the Federal Reserve’s instant payment service that allows US financial institutions to send and receive payments in real time, 24/7/365. Unlike the Automated Clearing House (ACH), which settles in batches and generally clears next day, or Fedwire, which runs during business hours, FedNow settles in seconds and is available around the clock, including weekends and holidays.

There are some things that are especially important for compliance audiences to know. FedNow is an interbank settlement system; it moves money between financial institutions, not between consumers. Participation is voluntary, and thousands of institutions have already chosen to connect. It supplements rather than replaces existing rails such as ACH, Fedwire, and Real-Time Payments (RTP). The Clearing House's RTP network has been live since 2017, and FedNow is effectively the Fed's answer to the same need for real-time settlement. Most importantly for anyone building fraud controls, FedNow is a settlement system, not a fraud detection system. The responsibility for catching fraud sits entirely with the participating institution, not the rail itself.

2. Why Instant Payments Fundamentally Change Fraud Risk

Three properties separate instant payments from every rail that came before, and each one reshapes the fraud problem.

The first is speed. Settlement happens in seconds, not hours or days. With ACH, next-day settlement gives an institution 12 to 24 hours to detect and recall a suspicious transaction. A wire settles same-day but only during business hours, and it comes with recall mechanisms. FedNow settles in seconds, and once settled, the funds are immediately available. The practical effect is that the fraud detection window shrinks from hours to milliseconds. That compression is not a marginal change in degree, it is a change in kind. A detection model that runs overnight, a queue an analyst clears in the morning, a phone call to confirm an unusual transfer, all of these assume time that no longer exists. Any control that cannot render a decision in the fraction of a second before settlement is, on an instant rail, purely retrospective. It can explain what happened, but it cannot stop it.

The second is irrevocability. There is no chargeback, no recall, no undo. ACH has return mechanisms under National Automated Clearing House Association (NACHA) rules, including a 60-day window for unauthorized returns. Credit cards have chargebacks. Wires allow recall requests through SWIFT Global Payments Innovation (gpi). With FedNow, once a transaction settles, it is final. No built-in reversal mechanism exists, and recovery depends entirely on the receiving institution voluntarily freezing and returning the funds, which itself requires detecting the fraud at the receiving end before the money moves on. This inverts the usual burden of fraud recovery. On legacy rails, the sending institution retains some leverage after the fact, because a return or recall can still claw funds back. On FedNow, the seding institution has no such lever, and the only party positioned to stop the loss is the receiving institution, which has its own customers, its own priorities, and no obligation to act quickly. That structural gap is precisely what mule networks are built to exploit.

The third is round-the-clock availability. Fraud does not wait for business hours. Traditional rails see most of their activity during the day, when compliance staff are on duty. FedNow makes a 3 am Saturday payment just as possible as a 2 pm Tuesday one, and fraud operations deliberately exploit off-hours when human oversight is thinnest. Automated detection has to run continuously, because the fraud does. This has a staffing dimension that institutions often underestimate. Building a detection model that scores payments around the clock is one problem; ensuring that the small share of payments flagged for human review can actually reach a qualified reviewer at 3am on a holiday weekend is another. Fraudsters time their attacks precisely to the windows when the answer to that second question is weakest, which means an instant payment program is only as strong as its coverage during the hours no one wants to staff.

3. Fraud Types Targeting FedNow and Instant Payments

Instant rails do not create entirely new fraud so much as they sharpen the fraud that already exists. Four types dominate.

Authorized push payment (APP) fraud is the single largest fraud type on instant payment rails worldwide, a pattern UK Faster Payments data has demonstrated for years. The victim is manipulated into authorizing a real-time payment to an account the fraudster controls. Because the victim authorized it, controls built to catch unauthorized transactions never fire. Because FedNow settles instantly, no recall window exists. And because the victim sent the money willingly, there is no chargeback to fall back on.

Second is account takeover with instant cash-out. A fraudster gains access to a victim’s account via credential stuffing, SIM swapping, or phishing. Before FedNow, an account takeover followed by a wire transfer meant same-day movement during business hours, with recall still possible. Now, the same takeover followed by an instant transfer means the funds are gone in seconds, at any hour, with no recall.

Mule account abuse is the third. Fraudsters open or recruit mule accounts at participating institutions, where fraud proceeds arrive instantly and get dispersed across multiple accounts within hours, then converted to crypto or cash. The mule cycle of receive, disperse, and exit that once took 24 to 72 hours can now complete in a fraction of that time, which means receiving institutions have to spot mule patterns in near-real-time or lose the trail entirely.

First-party, or friendly, fraud rounds out the list. A customer makes a legitimate FedNow payment and later claims they never authorized it. Unlike credit cards with their chargeback process or ACH with its return mechanism, FedNow has no built-in dispute resolution, which leaves institutions to build their own dispute processes for instant payments.

4. How to Detect Fraud on Instant Payment Rails: Pre-Settlement Controls

The central insight for instant payments is that post-execution detection is simply too late. Every meaningful fraud control has to operate pre-settlement, in the milliseconds between initiation and settlement. That constraint reshapes the entire detection stack.

Real-time fraud scoring comes first. Every outgoing FedNow payment needs to be scored for fraud risk before it executes, drawing on the customer's behavior profile, the payment context (whether the beneficiary is new, the amount unusual, or the timing odd), device and session signals, velocity checks, and geographic analysis. The scoring engine then decides in an instant to approve the payment through straight-through processing, hold it for review, or reject it. A healthy target is straight-through processing for 95% or more of payments, leaving only about 5% for human review. The catch is that the 5% has to be reviewed in minutes rather than hours, or the payment experience deteriorates for legitimate customers. This creates a genuine tension that every instant payment program has to resolve deliberately. Score too aggressively and legitimate customers get their payments held, eroding the very speed that makes the rail valuable and driving complaints. Score too leniently and fraudulent payments slide through to irreversible settlement. The sweet spot is not a fixed threshold but a continuously tuned balance, one that shifts as fraud patterns evolve and as the institution learns which signals genuinely predict fraud in its own customer base rather than in the industry at large.

Behavioral baseline monitoring works alongside scoring. Machine learning models learn each customer's normal payment behavior, and deviations raise the risk score. A first-ever instant payment, an unfamiliar recipient, an amount well above the customer's historical pattern, a payment initiated at an unusual hour, or a payment made while the customer is simultaneously on a phone call, which is a common coaching indicator for APP fraud, all elevate scrutiny.

Beneficiary risk assessment adds a pre-settlement check on the receiving side. Before the payment executes, the sending institution can screen whether the beneficiary is sanctioned, whether they are a known politically exposed person, whether the beneficiary account has been flagged across the network through the Fed's Network Intelligence API, and whether the beneficiary name actually matches the account name, a check the Fed is piloting. Layering sanctions, Politically Exposed Persons (PEP), and adverse media screening onto this step turns a fraud control into a combined compliance-and-fraud check.

Velocity and pattern rules complete the stack. Configured specifically for the instant payment context, these rules catch multiple FedNow sends in rapid succession, escalating payment amounts to the same new beneficiary, or a first instant payment from a customer who has never used real-time rails before.

5. FedNow vs RTP vs ACH vs Wire: Comparison Table

For compliance officers who want a single reference point, the table below sets the four major US rails side by side. Note that FedNow's transaction limits changed substantially through 2025: The default credit transfer limit sits at $100,000, institutions can configure it upward, and the network maximum was raised to $10 million effective November 2025 to match RTP.

6. The Fed's Fraud Prevention Tools for FedNow

The Federal Reserve has been building out its own fraud mitigation layer, and staying current on it is part of any FedNow compliance program.

The Network Intelligence API, launched April 28, 2026, for early adopters, lets a sending institution run a pre-check on a receiver account before executing a FedNow payment. It surfaces receiver account-level insights drawn from activity observed across the entire FedNow network, which is the Fed's answer to the hard problem of assessing receiver risk in real time. Institutional screening adds a complementary layer on top, because a sanctions, PEP, and adverse media check on the beneficiary covers ground the Fed's API does not.

Payee name matching is in pilot. It confirms that the beneficiary name on a payment matches the name on the receiving account, functioning as the US equivalent of the UK's Confirmation of Payee. It directly addresses the APP fraud scenario in which a fraudster supplies their own account while claiming it belongs to someone else. It is not yet live across the network.

Transaction limits are the simplest tool of all. FedNow lets institutions set per-transaction and per-day limits, and while the network maximum now reaches $10 million, an institution can and often should set far lower limits calibrated to each customer's risk profile. Appropriate limits are an unglamorous but genuinely effective fraud control.

7. Regulatory Landscape: What's Required for FedNow Participants

FedNow does not rewrite the compliance rulebook so much as it raises the stakes on executing it in real time.

On the Bank Secrecy Act (BSA)/ Anti-Money Laundering (AML) side, FedNow creates no new obligations. Existing Suspicious Activity Reports (SAR) filing, Currency Transaction Reports (CTR) reporting, and Customer Due Diligence (CDD) requirements all still apply. What changes is the operational pressure. If fraud is detected only after settlement, the SAR still has to be filed within the standard 30-day window, but by then the money is already gone, which turns the SAR into documentation rather than prevention. That reframing has practical consequences for how compliance teams allocate resources. An institution that pours effort into post-settlement investigation and SAR quality, while under-investing in pre-settlement scoring, will produce excellent paperwork on losses it could have prevented. The center of gravity for AML effort on instant rails has to shift earlier, toward the moment before funds move, even though the formal reporting obligations remain unchanged.

OFAC sanctions screening is where the timing shift bites hardest. OFAC's guidance on instant payment systems states that sanctions compliance programs must be designed to address the speed and operational characteristics of these systems, which in practice means screening must happen before settlement, not after. A real-time screening API built for sub-second response is designed for exactly this constraint.

Federal Financial Institutions Examination Council (FFIEC) examination expectations are evolving step by step. Examiners will want to know how an institution detects fraud on instant payments, which controls run pre-settlement versus post-settlement, how off-hours alerts are handled, what the straight-through-processing and false-positive rates look like, and how disputes are managed.

Nacha's new credit-push fraud monitoring rules, effective March 20, 2026, apply to ACH rather than FedNow, but they signal the clear regulatory direction for all push-payment rails. Compliance teams are well served to treat them as a preview of what FedNow-specific rules may eventually require.

8. How Sanction Scanner Helps FedNow Participants

Sanction Scanner's unified AI-native risk platform FUSION is built around the converged approach that instant payment fraud demands. Sanctions, PEP, and adverse media screening returns results in under a second, sized for the instant payment screening window. Mule detection brings fraud and AML monitoring together to catch receiving-side mule accounts before proceeds disperse. Continuous transaction monitoring covers all payment activity rather than FedNow alone. Because these capabilities live in one system rather than four disconnected tools, institutions get the single, unified view that catching instant payment fraud actually requires.

Sources

[1] Board of Governors of the Federal Reserve System. Federal Reserve Announces That Its New System for Instant Payments, the FedNow Service, Is Now Live. 2023.

[2] Federal Reserve Financial Services. FedNow Service will raise transaction limit to $10 million. 2025.

[3] Federal Reserve Financial Services. FedNow network intelligence API empowers participants to send payments with confidence. 2026.

[4] Digital Transactions. FedNow Tallies More Than 1,600 FIs in its Real-Time Payments Service. 2026.

[5] The Clearing House. Higher $10 Million RTP Network Transaction Limit Empowers New Uses. 2024.

[6] Nacha. Risk Management Topics – Fraud Monitoring Phase 1 and Risk Management Topics – Fraud Monitoring Phase 2. 2026.

[7] Office of Foreign Assets Control. Sanctions Compliance Guidance for Instant Payment Systems. 2022.

[8] eCFR, U.S. Code of Federal Regulations. 31 CFR 1020.320: Reports by Banks of Suspicious Transactions. 2025.

[9] FFIEC. BSA/AML Examination Manual: Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting. 2025.

Minhac Celik

Marketing Lead

View full profile →