Real-time fraud decisions for instant payments

More than 100 jurisdictions have fast payment systems, 15 of them in Latin America, according to the Bank for International Settlements. In the Gulf, Saudi Arabia launched sarie in February 2021, with transfers under SAR 20,000 credited to the recipient straight away. The UAE followed with Aani on 16 October 2023, which processes payments 24 hours a day, seven days a week, and lets a customer pay someone using only their phone number. Brazil's Pix works on the same principle.

Speed and convenience are the purpose of these systems, and fraudsters value them for the same reasons. A phone number in place of an account number makes it easy to pay someone you have never met. Round-the-clock settlement means that a scam at two in the morning completes at two in the morning, while the fraud team is at home.

In their December 2025 report, the European Banking Authority and the European Central Bank found that strong customer authentication remains effective against the fraud it was designed for, especially on cards. They also found that new types of fraud are rising, particularly the manipulation of payers. For credit transfers, customers bore about 85% of fraud losses in 2024, mainly because scams tricked them into making the payments themselves.

The same pattern applies to instant payments. When the genuine customer opens the app on their own phone, passes every check and sends the money to a scammer, authentication has worked as intended and the payment is still fraud. Catching it needs evidence about the situation around the payment: who is being paid, how the payment compares with what this customer usually does, and what happened in the session before it.

Every scheme and channel leaves the sending institution a short window to answer. Treat that limit as a design input from the start. Then separate the work that must happen when the payment arrives from the work that can be prepared beforehand.

Keep the live calculation small and test it at peak load. A model that is accurate on average but slow on salary day will push decisions past the time limit, and the usual fallback at that point is to let the payment through.

A choice between approve and decline forces a trade between losses and friction for good customers. A wider set of responses lets you match the action to the risk and to the customer.

Step-up check

Ask for a further confirmation when the device or session looks unusual.

Payee-specific warning

Describe the risk that fits this payment, for example a first transfer to an investment platform or a caller who claims to be from the bank.

Short hold

Pause a high-risk payment for a few minutes while the customer is contacted, and tell them why.

Cooling-off for new payees

Delay or cap payments to a payee added in the same session.

Lower first-time limits

Start a new payee on a lower limit and raise it once earlier payments have gone through without a complaint.

Track how each response performs. A warning that customers click through every time adds friction without protection, and should be rewritten or replaced.

Scam proceeds usually land first in mule accounts, which pass the money on, often within minutes. A mule account receives before it sends, so the best moment to find one is on arrival. Typical signs are an account opened recently, incoming payments from many unrelated senders, and money leaving almost as soon as it lands.

Regulators expect receiving institutions to carry part of the burden. Under the UK reimbursement rules in force since 7 October 2024, the sending and receiving firms split the cost of reimbursing scam victims 50:50, according to the Payment Systems Regulator, which also publishes how much scam money each of the largest receiving firms took in. In Brazil, the Central Bank's enhanced special return mechanism for Pix, MED 2.0, follows the money through the accounts it passes on its way and became mandatory for all participants on 2 February 2026.

Score incoming payments and new accounts with the same care as outgoing ones. A mule stopped before its first outbound payment protects every customer who would have paid into it.

Some fraud will get through, so the claims process belongs inside the fraud programme. In the first period of the UK rules, from October 2024 to June 2025, customers made 126,000 claims and received back 88% of the money they claimed, and firms resolved 84% of claims within five days, the Payment Systems Regulator reported in October 2025.

Each claim is also a confirmed example. Feed confirmed scams and mule accounts back into your models and rules within days, and check which response, if any, the payment received before it went through.

Decision time at the 99th percentile

The slowest one per cent of decisions at peak load is what threatens the scheme limit.

Share answered within the scheme limit

Count timeouts and fallbacks separately from approvals.

Fraud value per million moved

Split by type, keeping scams the customer authorised apart from account takeover.

Step-up and warning outcomes

How many customers complete a step-up or go ahead after a warning, and how many of them later report fraud.

Scam claims and reimbursements

Count, value and time to resolve, as sending and as receiving firm.

Mules found before first outbound payment

The share of confirmed mule accounts stopped while the money was still in them.

Keep these measures on one page. Falling losses with rising complaints, or steady speed with growing fallbacks, only show up when the numbers sit side by side.

1. 1
   Which signals do we compute live, and which could be prepared in advance?
2. 2
   What happens to a payment when the decision runs past the time limit?
3. 3
   Which responses besides decline do we use today, and how often does each one stop fraud?
4. 4
   Do we score incoming payments and new accounts, or only outgoing ones?
5. 5
   How many days pass between a confirmed scam or mule and an update to our models and rules?
6. 6
   Can we see speed, losses, claims and customer friction on the same page?

Mantika Argus decides each payment from what the customer did before it and gives the reason in plain words.