FedNow Fraud: Four Remedies, One Works Before Settlement

```html

That mismatch explains why America's loudest instant-payment fight is aimed at the wrong target. Proposals to import the United Kingdom's 50/50 receiver-pays split assume the loss division is still up for grabs. It is not: Regulation E already allocates every dollar along the authorized/unauthorized line. Until banks' classification practice changes, receiver-liability advocacy is theater — staged after the money is gone.

What moves outcomes happens earlier: sender-side verification, the only remedy that acts before settlement. The stakes rise as AI agents begin transacting for consumers — American Express's early-2026 framework covers erroneous purchases by registered agents, yet the word 'fraud' never appears in its announcement. Four remedies circulate in the debate. Only one works while the payment is still moving.

The instinct to "just dispute it" comes from card rails, and it does not transfer. Visa and Mastercard operate formal dispute systems — chargebacks with defined reason codes and arbitration paths — and Regulation Z gives cardholders billing-error rights inside defined windows. FedNow has none of that. The only post-send tool is a voluntary recall request, honored entirely at the receiving bank's discretion; no regulation obligates it to comply, and no regulator can force its hand. If you remember one thing from this section, make it this: the chargeback muscle memory is dead on arrival for instant payments.

Finality in Seconds

What replaces it is a legal fork defined by Regulation E. An unauthorized transfer — stolen credentials, account takeover — triggers a liability ladder tied to reporting speed. An authorized transfer — you approved the send yourself, even while a scammer impersonated your bank, your boss, or your vendor — falls outside that liability ladder altogether. Same rail, same seconds-long finality, opposite outcomes:

For the unauthorized column, the dispute machinery runs on a fixed clock: you notify your bank, which must complete its investigation within 10 business days. If it needs longer, it must issue provisional credit and extend the window up to 45 days — 90 for newly opened accounts. Notice where liability attaches: to your own sending institution. Regulation E never assigns the receiving bank a share; the receiving institution appears nowhere in the error-resolution timeline.

That absence is explicit, not an oversight. No federal rule imposes liability on a receiving institution for accepting fraudulent inbound credits. Its obligations run to BSA/AML monitoring and, if it chooses, voluntary cooperation with a recall attempt. In 2026, that gap stands exactly where it did at launch: the account that received stolen money faces no penalty for having received it.

Read the matrix top to bottom and the pattern is unavoidable: the only row where the sender keeps full liability is the authorized one, and the only lever that operates before finality is verification. Everything downstream — recall requests, provisional credit, Article 4A arguments — either does not apply or arrives after the money is already irreversibly gone.

The United Kingdom switched on the experiment the United States keeps declining to run. Under Payment Systems Regulator policy PS23/3, reimbursement for authorized push-payment (APP) fraud became mandatory rather than discretionary: payouts subject to a per-claim cap, costs split 50/50 between the sending and receiving payment services provider, and an optional customer excess. The clause that matters most for the American debate is that 50/50 split — it assigns part of every loss to the receiving bank, the institution uniquely positioned to spot and freeze a mule account before funds scatter.

The mandate reacted to a measurable baseline. According to UK Finance's Annual Fraud Report, APP scams drained a substantial sum from UK victims, of which a significant share was returned voluntarily under the industry's existing code. Two things follow from that record. First, even without a mandate, voluntary returns lifted recovery to a meaningful share of losses. Second, the regulator's move converts patchwork goodwill into a uniform obligation, which is exactly the guarantee a voluntary regime structurally cannot provide.

Read together, the receipts hand the win to the UK architecture on every recovery metric we can measure — and hand the U.S. reader a harder conclusion. Britain recovered money by statute; no equivalent statute exists here, and none is imminent. If you are still running the card-fraud reflex — dispute it, charge it back, await the refund — notice that not one of these documents contains a chargeback mechanism. Until a PS23/3 analogue crosses the Atlantic, the entire liability split is decided before you hit send: verify new payees through a second channel, treat every authorized transfer as irreversible, and stop modeling instant payments on refund behavior this rail does not have.

The Receipts

Four remedies exist for a bad FedNow send, and they are not peers: exactly one operates before settlement, which is the only moment a loss is still preventable rather than merely arguable. Score all four on deployment cost, coverage across the authorized/unauthorized split, and what the evidence actually supports, and the ranking stops being close.

Layer (a) is the only instrument aimed at the loss type that dominates instant rails: the deception-approved push. An independent-channel callback to a number you source yourself, or a payee-name match against the account details, costs minutes and intercepts the transfer while it is still reversible by simply not happening. It also attacks the scam's operating mechanism — urgency scripts collapse when the victim pauses to dial a number the caller did not provide — which is why front-loaded verification outperforms any detection run after funds have moved.

Regulation E remains the strongest post-loss tool in the U.S. stack, recovering up to the full transfer minus the two liability tiers described earlier in this guide — but only when the transfer is provably unauthorized, and that condition is precisely what a scam removes. The moment you key the approval yourself, a valid consumer authorization exists and the protection evaporates. This is where the card-fraud mental model fails hardest: FedNow contains no chargeback mechanism at all, no network arbiter standing behind a settled credit-push, so "dispute it and get refunded" describes a system that does not exist on this rail.

Courtesy recalls sit below even that bar. Because no U.S. rule assigns any liability to the receiving institution, a recall succeeds only when the receiving bank voluntarily freezes and returns money it has no obligation to touch — outcomes run inconsistently and never exceed what goodwill permits. The statutory fix, the Protecting Consumers from Payment Scams Act, has been reintroduced without passage and carries no enacted date as of 2026. Private networks are hedging meanwhile — according to The Financial Brand, Amex is explicitly described as not alone in making liability an explicit design variable — but a design choice inside one closed network is not a substitute for a rule binding receiving institutions on instant rails.

Every loss figure attached to FedNow arrives with an asterisk nobody prints: the measurement infrastructure predates the rail. American fraud-loss reporting evolved around reversible instruments — cards with chargebacks, ACH with return windows, wires with recall procedures — so the survey templates and bank taxonomies now being applied to instant payments inherit assumptions the rail violates. When consumers report a scam loss on a survey, a meaningful fraction assume card-style dispute mechanics that simply do not exist here, which inflates implied recovery expectations in precisely the direction that costs readers money.

Three gaps in the evidence base matter most. First, no public dataset crosses rail type with authorization status: the Federal Reserve publishes operating volumes, but loss attribution lives inside bank-level fraud taxonomies and Suspicious Activity Report aggregates, compiled well past the point of usefulness. Second, survivorship bias runs in a known direction — victims of authorized scams underreport at higher rates than fraud victims generally, because embarrassment suppresses filing — so the authorized share of losses is more plausibly understated than overstated. Third, the usable time series is short enough that any trend line is extrapolation wearing a chart.

Pre-Send Verification vs Post-Loss Disputes

Variance across cases is wider than any headline admits. Two victims caught by the same impersonation text can land in opposite regimes based purely on how their bank classifies the event: if stolen credentials drove the approval, the claim travels the unauthorized path; if the victim typed the approval personally, it travels nowhere. Institutions diverge too — larger banks occasionally extend goodwill reimbursements on authorized scams, while smaller credit unions almost never do, so observed recovery rates measure institutional generosity rather than any enforceable entitlement. Classifications also move after the fact: an initial denial reversed following a regulator inquiry makes every point-in-time snapshot provisional.

The verification rule itself has identifiable failure modes, and naming them honestly strengthens rather than weakens it. A second channel stops being independent when the attacker controls it — a SIM-swapped phone turns your callback into a conference call with the fraudster. Name-match checks confirm an account exists, not who controls it, so recruited mule accounts pass cleanly. Business email compromise cultivated over months produces payees whose entire history verifies, right up until the final send. None of these refute the rule; they mark its boundary conditions.

One habit converts these caveats into leverage: when a loss occurs, ask your bank which classification it assigned — authorized or unauthorized — before arguing anything else. That single question determines which liability regime applies, and it is the question consumers least often think to ask. Then audit your recurring payees against phone numbers sourced independently of any invoice or email, and date-stamp each verification, so any future dispute turns on records rather than recollection.

Two banks can sort the same scammed customer into opposite categories. Senator Elizabeth Warren's inquiry into instant-payment fraud documented institutions coding materially identical deception cases as "unauthorized" at some banks and "authorized" at others. The mechanism is structural: Regulation E's dividing line turns on authorization status — a judgment about intent, rendered by the very institution holding the disputed funds, against definitions flexible enough to admit either reading. Published reimbursement rates therefore measure classification practice as much as fraud itself. Any cross-bank league table built on those labels partially ranks paperwork discipline.

The United Kingdom's mandatory split has not yet produced evidence clean enough to answer the question American commentators import it to settle: does receiver liability deter scams, or merely socialize losses into banking fees? The Payment Systems Regulator flagged that moral-hazard risk itself in PS23/3 — guaranteed reimbursement can blunt a receiving bank's incentive to screen outbound customers. As of 2026, citing UK reimbursement rates as proof of concept means citing a hypothesis mid-trial; the post-mandate record is too young to separate deterrence from displacement.

What the Data Doesn't Tell You

Third, the denominator. FTC Sentinel-style aggregates count filed reports, not incurred losses. Survey-based victimization estimates imply most victims never file — and the impulse toward silence is strongest exactly where recourse is weakest, in authorized push-payment scams, where victims correctly sense a report changes little. Official APP-loss totals therefore understate reality by unknown multiples, and the multiple is unknowable in principle: the missing observations are unobserved by construction.

Australia supplies the stress test. If liability rules were the active ingredient, years of national anti-scam programs should have pushed reimbursement rates high. According to an ASIC review of bank responses to scams, banks reimbursed customers in only a small fraction of the scam cases the regulator reviewed. The defensible reading is that confirmation-of-payee infrastructure and institutional culture — not liability mandates alone — determine outcomes, which is precisely why pre-send verification holds across every regulatory regime.

Last caution: rails do not transfer. Zelle, The Clearing House's RTP network, and FedNow operate under distinct participant agreements with different dispute, recall, and indemnification provisions. A recovery statistic measured on one instant rail predicts almost nothing about another. Read your own rail's operating rules before trusting anyone else's numbers.

Where each evidence source breaks:

None of these datasets wins, because every one of them operates after settlement. Until they mature, the only reliable control is the one that runs before it: verify every new payee through a second channel, and treat the send as final — no recall, chargeback, or receiver-bank reimbursement is coming.

What the 50/50 Split Can't Show

Path B — coded authorized. Identical facts, one difference: Dana typed the approval herself into her genuine banking app, convinced she was verifying a fraud alert. The moment she did, Regulation E left the room — the rule protects against unauthorized transfers, and a transfer the account holder initiated is authorized no matter how thoroughly the inducement was engineered. No U.S. rule assigns any liability to the receiving institution. Her remedies collapse to two discretionary ones: a recall request the receiving bank may simply decline, and whatever goodwill its fraud team extends. Since mule funds typically hop onward within hours, even a same-day recall usually finds an empty account.

Rule 3 — Assume no recovery on authorized sends. Kill the card-fraud reflex now: there is no chargeback mechanism on FedNow, full stop. A recall request travels as a courtesy message, and the receiving bank's cooperation is voluntary — meanwhile mule accounts typically layer funds onward within minutes. If a payee is unverified, split the payment into tranches to cap the blast radius (honestly: a small test send proves an account is live, not that it belongs to your intended party), downgrade to a delay-tolerant rail such as ACH or check that leaves a dispute window open, or simply decline. Declining costs nothing.

Rule 4 — Contract around the consumer gap if you run a business. Regulation E covers consumer accounts only; commercial senders live under UCC Article 4A, where loss allocation turns on whatever "security procedure" the parties agreed to in writing. Agree to nothing and the default allocation rarely favors you. Negotiate dual approval plus out-of-band confirmation — a callback to a stored number, never one supplied in the payment request — above a dollar threshold, and get the procedure signed, because the signed agreement is what makes the risk split enforceable.

Rule 5 — Watch the policy clock, don't wait on it. Track whether Congress or the CFPB ever imports a receiver-liability mandate modeled on the UK reimbursement regime described earlier. One wrinkle any such mandate must resolve: according to The Financial Brand (May 2026), as AI agents begin transacting on behalf of consumers, the core question issuers face becomes "Who authorized this transaction?" — the exact variable the entire liability framework hangs on is about to get harder to define. Until enactment, allocate all protection effort to pre-send verification and revisit claim strategy only if the law actually changes.

Concrete next step: today, pull the direct phone number for your highest-value recurring payee off a paper or PDF statement and save it under a label like "verify — never from emails." The independent channel has to exist before the next urgent request manufactures the pressure that would talk you out of using it.

Last caution: rails do not transfer. Zelle, The Clearing House's RTP network, and FedNow operate under distinct participant agreements with different dispute, recall, and indemnification provisions. A recovery statistic measured on one instant rail predicts almost nothing about another. Read your own rail's operating rules before trusting anyone else's numbers.

Where each evidence source breaks:

None of these datasets wins, because every one of them operates after settlement. Until they mature, the only reliable control is the one that runs before it: verify every new payee through a second channel, and treat the send as final — no recall, chargeback, or receiver-bank reimbursement is coming.

One Saturday Send, Two Endings

At 2:07 p.m. on Sunday, March 8, 2026, a FedNow push leaves Dana's credit union account and settles finally, in central-bank money, before she has stood up from the couch. Everything about her next ninety days was decided in the preceding twenty-six minutes — and by a single word her bank will choose afterward: authorized.