Instant payment scams (Zelle & FedNow)

This is authorized push payment fraud carried over instant rails, and it almost never breaks into a system. It exploits the person: a fake bank fraud department "protecting" the account, a relative in trouble, a romance, a fake investment. The victim initiates the transfer, which is what makes it so hard to reverse — on a real-time rail the money is gone in seconds. The FTC counted $3.5 billion in reported impostor-scam losses in 2025, nearly $1 billion of it to bank impersonators.

The US legal line runs through Regulation E. It protects consumers against unauthorized electronic fund transfers, defined as transfers initiated by someone other than the consumer without authority — and the CFPB's position is that if a scammer tricks you into sharing login credentials and then moves the money, the transfer is unauthorized. But a payment the consumer sends personally, however fraudulently induced, falls outside that definition, and wire transfers through Fedwire-type systems are excluded from Regulation E altogether. Reimbursement then depends on the bank's and the network's own policies.

On the receiving side, the scam's link is the destination account — usually a mule or synthetic account. Blocking those accounts from opening, by spotting borrowed identities and their connections to other accounts used in scams, is what cuts the flow before the next victim.