A customer receives a message that appears to come from their bank. They call the number in the message, speak to someone who sounds credible and are told to move their money to a “safe” account. The customer authorises the transfer. The payment arrives in seconds.
The fraud was not a stolen password or a technical failure. The customer was persuaded to send the money.
This is one of the difficult cases created by instant payments. The payment system has done what it was designed to do. The customer has authorised the transfer. Yet the customer may still be a victim of fraud.
As fast payments spread, the question is not only how quickly money can move. It is who should bear the loss when a payment is made under deception, and whether those rules remain clear when the money crosses a border.
When speed removes the pause
Traditional payment systems often had delays, cut-off times or business-hour limits. Those could make payments slower and less convenient, but they also left more time for a customer or institution to notice a problem.
Fast payment systems compress that window. They are designed to make funds available quickly, often around the clock. That improves the experience for legitimate payments, but it can also make it harder to intervene once a fraudulent transfer has been authorised.
Speed does not mean every payment is impossible to stop. Providers can use risk controls, warnings and delays in some circumstances. The policy challenge is to balance intervention against the promise of a fast, low-friction service.
Different jurisdictions have chosen different points in that balance.
Different rules for the same harm
In the United Kingdom, mandatory reimbursement for authorised push-payment scams has applied since 7 October 2024 to Faster Payments and CHAPS transfers between UK accounts. Eligible victims are reimbursed up to £85,000 per claim, with the cost usually split equally between the sending and receiving provider. Not every claim succeeds, and international transfers are outside the scheme’s scope.
The UK model makes reimbursement part of the payment system’s design rather than leaving every victim to an individual bank decision. It also draws a clear boundary around the protection: a transfer made to or from an account outside the UK is not covered by these rules.
The European Union has taken a more layered approach. The Instant Payments Regulation requires providers to offer verification of the payee for all euro credit transfers, whether standard or instant. The check allows customers to see before authorising a payment whether the recipient’s name matches the account information.
That is a preventive measure, not a refund guarantee. A further, narrower guarantee is expected under the new Payment Services Regulation. Providers will have to refund consumers who were tricked by someone impersonating their payment service provider, provided the victim reports the case to the police and to the provider.
The rule covers impersonation of the provider itself. It does not cover every type of scam, such as fake authorities, investment fraud or romance scams, and it is not expected to apply before approximately 2028.
Brazil’s Pix takes a third approach. Its Special Return Mechanism, known as MED, has operated since 2021 and allows funds to be blocked and returned in cases involving fraud, scams, coercion or an operational error by the payment provider.
Since February 2026, the upgraded MED 2.0 version can follow funds through several layers of accounts. That matters because fraudsters may move money onward before a victim files a complaint. A return is not guaranteed: it depends on whether the funds can still be identified and recovered.
These approaches address different points in the payment process. One focuses primarily on reimbursement after an eligible scam, another on pre-payment verification and another on scheme-level recovery procedures.
The costs of protection
More protection is not cost-free.
Warnings and verification can prevent some mistakes, but too many alerts may become routine and be ignored. Additional checks can slow legitimate payments. Reimbursement rules can create incentives for firms to invest in prevention, but they also require clear criteria for claims and responsibility.
Strict controls can create friction for customers who have done nothing wrong, while weak controls leave victims carrying losses they may have been unable to prevent. Banks and payment providers may also respond to higher fraud costs by limiting services for customers or transactions perceived as risky.
The difficult question is not whether to choose speed or safety. It is how to design controls that respond to risk without turning ordinary payments into a sequence of obstacles.
When payments cross borders
A domestic payment normally sits within one legal and operational framework. A cross-border payment may involve two payment systems, multiple providers, different currencies and different consumer-protection rules.
That makes responsibility harder to establish. Which institution investigates the scam? Which jurisdiction’s rules apply? Who communicates with the customer, and who has authority to recover or freeze funds?
A payment may cross a border in seconds, while the investigation still depends on national rules, domestic authorities and cooperation between institutions.
The distinction between domestic and international protection is particularly important in the UK. Its reimbursement scheme covers Faster Payments and CHAPS transfers between UK accounts, not international transfers. A faster cross-border rail does not automatically carry the same consumer protections as a domestic payment.
This is where the globalisation of payment rails meets the local nature of consumer protection. Payments may become international before remedies do.
What to watch
The next important date is 9 July 2027, when the EU’s obligations on instant payments and verification of payee are scheduled to apply to providers in member states outside the euro area.
The proposed EU refund protection for provider impersonation will come later. Political agreement and final compromise texts were reached in 2025 and 2026. Formal adoption is still pending; based on the compromise texts, application is not expected before around 2028.
The central question will be how narrowly the new protection is interpreted. A customer deceived by a fake bank representative may fall within the rule. A customer deceived by a fake police officer, investment adviser or romantic partner may not.
The question that remains
The next stage of fast payments will not be judged only by transaction speed. It will also be judged by what happens after a payment has gone wrong.
Payment providers will need to decide how much friction legitimate customers should accept in exchange for greater protection. Regulators will need to decide how liability should be shared between banks, payment providers, platforms and customers. Cross-border systems will need to make those responsibilities understandable before they become a crisis.
Trust will depend not only on whether money arrives quickly, but on whether customers know who will help when it should not have arrived at all.
This article was researched and written with AI assistance for FinTech Weekly. All facts are linked to their sources in the text.
