Imposter Scams: P2P’s Growing Problem

Peer to peer payments networks are wrestling with the fallout triggered when users send money to a scammer. Solutions won’t be easy.

In the world of digital payments, there’s a scam born every minute. The latest scam is conning consumers to send money via a peer-to-peer payment network to a criminal posing as a trusted entity, such as a charity, a government agency, or a friend.

Regardless of whom the criminal is impersonating, the goal of the outreach—which can occur via email, text, or even a phone call—is to get the victim to feel enough affinity with the imposter to authorize a payment from his bank account to the scammer’s account. By the time the victim realizes he has been scammed, there is nothing the network can do to make the situation right because the victim authorized the payment.

Also, because the victim’s account data was not compromised by the criminal, the monetary loss to the consumer cannot be classified as fraud. In the credit and debit card world, by contrast, fraud opens the door for the victim to be reimbursed.

Such scams, known as imposter scams, are posing a growing problem for P2P networks as criminals are increasingly using these systems as a conduit to receive funds from duped consumers. The problem is also forcing the networks to step up their efforts to educate consumers about scams.

In at least one case, a network has acted to reimburse consumers who have been scammed to prevent the erosion of consumer confidence in the network. Zelle, the peer-to-peer payment network operated by Early Warning Services LLC has been issuing refunds since June to consumers duped by imposter scams.

Zelle’s decision to make these reimbursements represents a major about-face for the network. It had previously maintained to lawmakers it was unreasonable to require financial institutions in the network to refund money to consumers who authorized a payment, even if they were tricked by scammers.

“Imposter scams tend to be under-reported because of the psychological barrier of being a victim,” says Suzanne Sando, senior analyst, fraud and security, for Javelin Strategy and Research. “Zelle reimbursing consumers victimized by imposter scams is an important precedent that can’t be overstated, because it takes the mental load off consumers that have been scammed and shows that no one should be blaming the victim for falling prey to an imposter scam.”

Not surprisingly, the threat of regulators or Congress imposing their own set of safeguards around P2P scams most likely played a big role in Zelle’s decision to reimburse scam victims, payment experts say.

‘A Level of Trust’

In 2023, Cash App and Venmo, the peer-to-peer payment services from Block Inc. and PayPal Holdings Inc., respectively, came under scrutiny from four U.S. senators, including Sen. Elizabeth Warren (D-Mass.), a member of the Senate Committee on Banking, Housing, and Urban Affairs, over their fraud-protection efforts.

The inquiry was based on letters the senators had received from consumers about P2P fraud and scams. The information requested from Cash App and Venmo followed a 2022 request by Warren and seven other senators for information from Early Warning regarding fraud and scams on Zelle.

“The threat of regulation can be enough to force self-imposed accountability among the P2P networks to get ahead of any potential regulation,” says Cleber Martins, head of payment intelligence and risk solutions for ACI Worldwide. “The United States lags other countries when it comes to the regulation of real-time payments.”

That lag can seem stark. In June 2023, the United Kingdom, for example, published the Payment System Regulator, a policy statement that created a reimbursement requirement for imposter scams, also known as app or push-payment fraud, that take place over real-time payments networks. The policy requires the sending and receiving networks to evenly split the cost of the reimbursement to the consumer.

“Canada and Brazil are moving in the same direction when it comes to accountability,” Martins adds.

The move toward reimbursing victims is considered by some payment experts as necessary for maintaining consumer confidence in P2P networks, since imposter scams have provided criminals a way of beating a P2P network’s fraud defenses. And the advent of faster payments only makes the problem more acute.

“With imposter scams, [the idea of] keeping the bad guys out of the network or a consumer’s account is moot, because the scam convinces the consumer to authorize the payment, which removes the need for the criminal to breach the network,” Martins says. “As real-time payments become more common, these types of scams are going to become a bigger problem.”

Finding a way to circumvent a P2P network’s fraud defenses may be the challenge for fraudsters. The reward is the immediate receipt of funds in their account.

“The payoff [for criminals] is strong because of the speed at which they can get cash or cash equivalents. There is also a level of anonymity to it, as you don’t have someone using a stolen credit card at a physical location,” says TJ Horan, vice president of product management for the credit-scoring company Fair Isaac Corp (FICO). “In addition, it’s possible to drive most of the activity from low-cost international locations.”

Horan adds that a recent FICO survey reveals 55% of consumers surveyed believe that real-time payments are more secure than credit card transactions, and that 75% feel there are sufficient security checks.

“This invokes a level of trust with P2P payments that makes it easy for criminals to exploit,” Horan says. “Scammers have therefore been able to use technology to engage potential victims across multiple digital channels. Once the victim is engaged, the scammer has a much higher likelihood of extracting the funds.”

Making Things ‘Right’

Early Warning is keeping mum about how Zelle determines whether a consumer has fallen prey to an imposter scam. The network does not want to tip off criminals about the consumer protections it has put in place, which could provide a road map for beating the network’s defenses.

“Fraud is dynamic, and scams that persuade consumers to send money to a legitimate account controlled by a criminal are becoming more common,” says an Early Warning spokesperson. “We evolved our policy to stay ahead of the changing landscape when it comes to scams.”

Regardless of how fraudsters ply their trade, the key for networks lies in preventing consumers from falling prey to imposter scams. That key, everyone agrees, is education. In November, Zelle unveiled S.A.F.E. Squad, a consumer-education campaign about imposter scams.

The campaign includes videos and educational materials that show consumers how to protect themselves, as well as quizzes to help test their knowledge about spotting imposter scams. The campaign, developed in conjunction with Vox Media Inc., will be syndicated across Vox’s media properties.

In addition, Zelle has formed partnerships with myriad consumer organizations, including the Better Business Bureau, the National Council on Aging, and the Cybercrime Support Network, to educate consumers about scams. “There is a misnomer that imposter scams aren’t eligible for reimbursement while fraud is, and we are working to clear that up,” the Early Warning spokesperson says.

While Venmo, the P2P network operated PayPal Holdings Inc., has embarked on a consumer-education campaign about imposter scams, it has additional safeguards that can prevent a consumer from hitting the send button in response to what may be a scam.

Venmo’s tools include pop-up windows and push notifications that ask a consumer if she knows and trusts the recipient to which she is sending money. One such tool is an automatic flag, a push notification which is sent when the network has reason to believe a consumer may be transacting with a suspect party. One criterion Venmo uses for an automatic flag is whether the sender and recipient have transacted before or share friends on Venmo.

Venmo would not comment on its reimbursement policy, but the network said each disputed transaction is reviewed according to its unique circumstances. Many of the network’s educational materials direct customers impacted by a scam to reach out to a customer-service agent. The information is also outlined in Venmo’s user agreement.

“As a fintech, we take a different approach to fraud and scams, which is why we have protections other P2P networks don’t,” says a Venmo spokesperson. “Our goal is to make things right for the customer.”

CashApp did not respond to interview requests.

‘A Standard Definition’

One issue dogging the P2P networks when it comes to imposter scams is there is no standard industry definition of just what constitutes an imposter scam. That makes it harder to gauge how successful a P2P network is in fighting the scams, says Javelin’s Sando.

“Does a romance scam qualify as an imposter scam because the money was sent over a P2P network?” Sando asks. “Without a standard definition, the extent of the problems caused by imposter scams will ebb and flow.”

Romance scams occur when a criminal creates fake profiles on dating sites and apps or contacts a consumer through a social-media site such as Instagram or Facebook and strikes up a relationship with a consumer before conning him into sending money.

Going forward, payment experts agree it’s likely that all P2P networks will adopt a reimbursement policy for imposter scams or other types of scams. The challenge, says FICO’s Horan, will be standardizing the reimbursement and claim process.

“In these instances, customers have been fooled into parting with their money, which can make it challenging to decipher a legitimate fraud victim from simple regret, [or] pseudo buyer’s remorse by the consumer,” Horan says.

Payment experts also say that as imposter scams become more prevalent, P2P networks and financial institutions will upgrade their fraud defenses to identify suspicious transactions and accounts by using advanced analytics to monitor not just the sender’s account, but the recipient’s account. “Monitoring both sides of the transaction is important in the defense against scams,” says Horan.

That will require better sharing of information between the financial institutions involved in the transaction, adds Martins. Such information can include account-behavior attributes that signal the account is being used to receive money as part of a scam or fraud.

“The steps taken to address imposter scams are a good start, but more needs to be done,” says Martins. “All the P2P networks need to acknowledge the problem and their responsibility, because if they don’t, regulators will step in.”