What 2026's Instant-Payment Fraud Changes Mean for Your Money

On July 20, 2026, a New York state judge denied "in its entirety" a motion to dismiss the attorney general's lawsuit, which alleges that Early Warning Services, the company that runs Zelle, let scams spread on its network. A month earlier, on June 19, 2026, Nacha's fraud-monitoring rules for ACH payments reached every bank on that network. Neither changes what happens if a scammer persuades you to send an instant payment yourself. Federal law generally does not require your bank to refund it, and the recipient can usually move the money within minutes.

Key takeaways

Three names come up most in US instant payments. The Federal Reserve runs FedNow, The Clearing House runs RTP, and Early Warning Services runs Zelle. FedNow and RTP each cap a single payment at $10 million, and payments on both are final once sent.
Regulation E protects you when someone else moves money out of your account. That includes a scammer who tricked you into handing over a login or one-time code. If you tell your bank within two business days after learning the login, code or card was stolen, the most you can be charged is $50. It generally does not cover a payment you sent yourself because someone lied to you.
Zelle's rules require banks to reimburse "certain qualifying imposter scams," but Zelle does not publish what qualifies. FedNow and RTP publish no rule requiring consumer refunds for scams.
Most of the 2025–2026 changes add fraud-detection tools for banks rather than refund rights for consumers. A 2025 request for public input from the Fed, OCC and FDIC drew more than 250 comment letters. We found no proposed rule from it as of October 3, 2026.
Report fast. In 2025 the FBI's Recovery Asset Team started its "Financial Fraud Kill Chain" freeze process in 3,900 cases and helped freeze $679 million of $1.16 billion in attempted theft, about 58%. The FBI says that when you discover a fraudulent transfer, "time is of the essence."

This article is general education, not legal advice. Your account agreement and the facts of your case decide what you can recover.

What it means for you

If you use Zelle or your bank app's instant transfer: transfers that someone else makes without your permission are covered, with deadlines (see the Regulation E section). Payments you send yourself after being deceived usually are not, apart from Zelle's limited impostor rule.

If you're paying someone you've never met: the US has no network-wide name check like the UK's Confirmation of Payee. Treat any new payee as unverified until you have confirmed them some other way (see "Where the controls break down").

If you run a small business: Regulation E does not cover business accounts. Your rights come mostly from your account agreement and the network's rules. For FedNow, that also means UCC Article 4A, a commercial law for funds transfers. Since June 19, 2026, Nacha's rules have also required every business that originates ACH payments to have risk-based fraud-monitoring procedures.

If you are an older adult, or help one: calls from someone posing as the bank who asks you to move money "to protect it" are a pattern the FTC specifically warns about. A lower daily transfer limit, account alerts, and the National Elder Fraud Hotline (833-372-8311) help most (see the checklist at the end).

Who runs US instant payments

The table shows who operates each system and how final a payment is, checked against each operator's own documents as of October 3, 2026. Banks connect to these networks, and your bank decides which one your app uses.

System	Operator	Per-payment cap	Can a payment be reversed?	Published scam refund rule
FedNow	Federal Reserve Banks	$10 million network cap since November 2025. Each bank's default is $100,000, and banks can raise or lower it.	No. Transactions are "final and settled in real time." Banks can send a request for return, which the receiving bank can refuse.	None published
RTP	The Clearing House, owned by large banks	$10 million since February 9, 2025	No. The rules call RTP an "irrevocable credit transfer system." Banks can send a request for return of funds.	None published
Zelle	Early Warning Services, owned by banks	Set by your bank or credit union	Zelle says money sent "is often unrecoverable"	"Certain qualifying imposter scams"; criteria not public

The Fed raised the FedNow cap from $500,000 to $1 million on June 24, 2025, then announced the $10 million limit effective November 2025. The $100,000 default and the "final and settled" wording come from the FedNow Service Operating Procedures (April 2026). RTP's limit went from $1 million to $10 million on February 9, 2025. The "irrevocable" wording comes from the RTP Operating Rules effective June 10, 2022, the latest public version available.

Zelle is its own network, and it partly overlaps with RTP. Since February 2021, participating banks can clear and settle Zelle payments over RTP. Zelle's limits FAQ tells users to ask their bank or credit union about sending limits. The bank's limit on your account matters far more than any network cap. A scammer cannot take more than your bank lets you send in a day.

What changed in 2025 and 2026

FedNow tools for banks. In June 2025 the Fed added "account activity thresholds," which let banks cap how much and how often each type of customer can send. FedNow also lets banks keep a "negative list" of accounts they will not send to or receive from. A network intelligence API, a data feed that shows a bank how a receiving account has behaved across the network before it pays, launched April 28, 2026 for early adopters. By November 2025 FedNow had added the Fed's ScamClassifier forms to its fraud reporting and had passed 1,500 participants.
Nacha's ACH monitoring rules. Phase 1 took effect March 20, 2026. It covered all banks that originate ACH payments, any business or payment processor that originated 6 million or more ACH entries in 2023, and receiving banks that received 10 million or more in 2023. Phase 2 took effect June 19, 2026 and removed the volume thresholds, so it now applies to all receiving banks and all non-consumer originators and processors. Covered parties must have "risk-based processes and procedures" to identify payments that are unauthorized or "authorized under False Pretenses," and must review them at least once a year, according to Nacha's rule page. ACH is not instant, but the rules now require receiving banks to watch incoming credits, including to accounts "acting as a mule" (used to receive and pass on stolen money). The rules give consumers no new refund right.
Federal regulators' request for input. The OCC, Fed and FDIC asked for public comment on payments fraud on June 16, 2025, and comments closed September 18, 2025. In February 2026 FDIC Chairman Travis Hill told the Senate Banking Committee that an interagency working group was reviewing the comments. In a May 5, 2026 speech, Fed Vice Chair for Supervision Michelle Bowman said the Board had reviewed more than 250 comments and was considering enhanced guidance. She also announced a roundtable with Treasury and the FCC. We found no proposed rule as of October 3, 2026.
Lawsuits over Zelle. The CFPB sued Early Warning Services and three of its owner banks on December 20, 2024, alleging unfair practices and, against the banks, violations of Regulation E. It voluntarily dismissed the case with prejudice on March 4, 2025, before any ruling on those allegations. New York's attorney general filed her own suit on August 13, 2025, alleging that Zelle users lost more than $1 billion to scams between 2017 and 2023. In a July 20, 2026 decision (New York County Supreme Court, Index No. 654753/2025), Justice Phaedra Perry-Bond ordered "that the motion to dismiss is denied in its entirety" and directed the company to answer the complaint. The judge also wrote that "there is not yet any finding of liability against Defendant." A Zelle spokesperson told Reuters the company intends to appeal. The claims remain allegations to be tested in discovery.

The size of the problem keeps growing. The FTC told Congress in March 2026 that consumers reported $15.9 billion in fraud losses in 2025, from 3 million fraud reports. Bank payments were the payment method with the highest total losses.

The latest full breakdown, the 2024 Consumer Sentinel Data Book, shows about $2.1 billion lost through "bank transfer or payment." That is about 38% of the roughly $5.4 billion in losses where people named how they paid. The category covers all kinds of bank transfers, not only instant ones.

Where the controls break down

Speed and finality

Instant payments are designed so the recipient can use the money right away, and that leaves no time for a fraud team to step in. A FedNow "return request" asks the receiving bank to send money back, and the operating procedures say it should be sent within 60 calendar days. The receiving bank decides whether to honor it, and it often cannot if the money has already moved on. Zelle's own safety page says that once you approve a payment, the money "is often unrecoverable."

No universal name check

In the UK, a check called Confirmation of Payee shows whether the name you typed matches the account before you pay. The US has no network-wide equivalent. The Fed offers a Payee Name Verification service that banks can use for a fee, and FedNow says it is "exploring" how to offer it for instant payments. On Zelle, the CFPB's 2024 complaint alleged that network rules required sending banks to display only the recipient's first name. The CFPB later dropped that case.

Even so, Early Warning Services wrote in its September 2025 comment letter that "confirmation of payee services should be developed."

Strong login checks can't stop a willing sender

One-time codes and fingerprint logins prove that you are the person sending. They cannot tell whether you are sending because of a lie. In the same letter, Early Warning Services argued that by the time someone opens the payment screen, "their trust is with the criminals now." Scammers also get around login checks by asking for the code itself, which is why the FTC says to never share a verification code and never move money to "protect it."

Mule accounts on the receiving end

Stolen money lands in a real bank account, often opened or rented out for the purpose, and is moved again quickly. FedNow's blocklists and data feed, and Nacha's new requirement for receiving banks, are aimed at those accounts. New York's lawsuit alleges that Early Warning Services let banks report fraud to it "long after it occurred," which allowed the same bad actors to keep scamming people. That is an allegation, but it shows where the weak point is: the receiving bank has to recognize a mule account before the money moves on.

Limits set for business needs

The $10 million caps exist so businesses can make large payments, such as for real estate or payroll. A consumer's protection is the much lower limit set by their own bank. Many people never look at that limit, and some banks let customers lower it in the app.

The Regulation E gap

Regulation E, the CFPB's rule under the Electronic Fund Transfer Act, covers consumer accounts, meaning accounts held mainly for personal, family or household use. It defines an unauthorized electronic fund transfer as one "initiated by a person other than the consumer without actual authority" that gives the consumer no benefit. Three kinds of transfer are excluded: those made by someone you gave your card, code or login to (until you tell the bank their permission has ended), those involving fraud by you or anyone acting with you, and those made by the bank or its employees. A login, code or card counts as an "access device."

When credentials tricked out of you still count as unauthorized:

The official interpretation (comment 2(m)-3) says an unauthorized transfer "includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery."
The CFPB's Regulation E FAQs apply this when a caller pretending to be your bank tricks you into giving your login, a texted code or your debit card number, and then makes the transfer. A person tricked this way "has not furnished an access device," so the exclusion for people you gave access to does not apply. Person-to-person payments are covered in the same way.
The same FAQs say a bank cannot use your carelessness to raise your liability, and cannot rely on an account agreement that waives these protections, for example one that cuts off protection if you shared your login.

The line falls at who pressed send. If you made the payment yourself, even because of a lie, it was initiated by you and is not an unauthorized transfer. The only "induced" case the official interpretation treats as unauthorized is a consumer forced to make an ATM transfer.

Payments over FedNow are governed by Subpart C of Regulation J, which incorporates UCC Article 4A, but section 210.40(b)(4) says the Electronic Fund Transfer Act prevails where the two conflict. Consumer protections therefore carry over to instant payments.

The deadlines matter. Under section 1005.6, if your card, login or code was lost or stolen, your liability for unauthorized transfers is:

Up to $50 (or less, if less was taken before you told the bank), if you tell the bank within two business days after learning of the loss or theft. The day you find out and non-business days don't count, and the window ends at 11:59 p.m., not at bank closing time.
Up to $500 if you tell the bank later. That figure is a ceiling, not a flat charge: it is up to $50 of what was taken in the first two business days, plus anything taken after that and before you reported, if the bank shows that reporting on time would have stopped it.
Unlimited for later transfers if you don't report an unauthorized transfer within 60 days after the bank sends the statement showing it. You are then liable for transfers made after the 60 days and before you report, if the bank shows that reporting on time would have stopped them. If no card, login or code was involved, you owe nothing as long as you report within those 60 days.

Under section 1005.11, the bank generally has 10 business days to investigate and must report its results within three business days after finishing. It can take up to 45 days if it gives you a provisional credit within those 10 business days, and it may hold back up to $50 of that credit for an unauthorized transfer.

For an account's first 30 days after the first deposit, the periods are 20 business days and 90 days. The 90-day period also applies to point-of-sale debit card transactions and transfers not initiated within a state. Your bank can require written confirmation of a phone report within 10 business days. If it tells you so and the confirmation doesn't arrive in time, the bank must still investigate but does not have to give a provisional credit.

A scam, minute by minute

Illustrative example. The times and amounts below are hypothetical. On a Tuesday at 6:05 p.m., a caller whose number appears to be the bank's warns of "suspicious activity." At 6:18 p.m., the account holder sends $4,800 by instant transfer to a "secure account" in another person's name. At 6:25 p.m., the receiving account sends $4,700 on to a second account. At 9:10 a.m. on Wednesday, after calling the number on the back of the card, the account holder reports the scam.

Payment to onward transfer:   6:18 p.m. to 6:25 p.m. = 7 minutes
Payment to report:            6:18 p.m. to 9:10 a.m. = 14 h 52 min = 892 minutes
Report delay vs. onward move: 892 / 7 ≈ 127 times longer
Left at the first bank:       $4,800 − $4,700 = $100

What happened	What applies	Likely result on $4,800
The account holder pressed send	Not an unauthorized transfer under Regulation E. Recovery depends on the receiving bank honoring a return request.	Possibly only the $100 still in the first account, and that is not guaranteed
Same scam sent by Zelle, with the caller posing as the bank	May count as a "qualifying imposter scam." The bank decides.	$0 to $4,800, depending on criteria Zelle does not publish
The caller got the one-time code and sent the money	Unauthorized transfer (code obtained by fraud), reported the next morning, well within two business days of learning the code was stolen	The account holder owes at most $50, so at least $4,750 comes back. The bank may hold back that $50 from any provisional credit.
Same scam in the UK, as a £4,800 Faster Payment	Mandatory reimbursement for authorized push payment (APP) fraud, up to £85,000, minus an optional excess of up to £100	£4,700 to £4,800 (the full £4,800 for a vulnerable customer), unless the customer was complicit or grossly negligent

What if, in the code case, the account holder had waited a week to report? The whole $4,800 left in a single transfer within the first two business days, and nothing was taken afterward. The $500 tier would therefore add nothing: liability is the lesser of $500 or ($50 + $0) = $50. A late report hurts most when the thief keeps taking money after the two business days, or after the 60-day statement window.

In the US, the result depends almost entirely on one question: who pressed send. The UK reimbursement scheme, run by the Payment Systems Regulator, has applied to Faster Payments and CHAPS transfers made on or after October 7, 2024. It covers individuals, microenterprises and charities.

Claims should be made within 13 months, and firms should reimburse within five business days of a claim, or up to 35 business days if they need more information. The excess and the gross-negligence exception do not apply to vulnerable customers. Credit unions, municipal banks and national savings banks are excluded. Nothing like it exists for US consumers.

Frequently asked questions

Can my bank make me file a police report before it investigates?

No. The CFPB's Regulation E FAQs say a bank must start its investigation as soon as it gets your oral or written notice. It may not delay or condition the investigation on a police report or other documents from you. Filing reports with the FTC or FBI is still useful, but it is your choice.

Can a bank hold an incoming instant payment that looks suspicious?

Yes. FedNow's fraud readiness guide says a receiving bank can respond with "accept without posting," which means it needs more information before crediting the account. It can also send a request for information to the sending bank. RTP's rules include similar request-for-information messages. These tools can delay a payment, but neither network requires a bank to use them.

Does the FTC get my money back if I report a scam?

No. Reports to ReportFraud.ftc.gov go into a database shared with law enforcement agencies. The FTC says it and other agencies use them "to investigate and bring cases, but can't resolve cases for individuals." Its guidance on Zelle and bank transfers says to report the scam to your bank right away and ask it to reverse the payment.

Does Zelle's impostor reimbursement replace Regulation E?

No. Zelle says it requires banks to fully reimburse confirmed fraud after a reasonable investigation. It also requires reimbursement for "certain qualifying imposter scams" where the customer authorized the payment, which goes beyond what Regulation E requires. Zelle does not publish what qualifies.

The CFPB's 2024 complaint, which the CFPB later dismissed, alleged that the impostor rule had applied "since mid-2023" and covered "a fraction of all induced fraud on the network." Ask your bank directly whether your case qualifies, and keep a written record of its answer.

Is a business checking account covered by the same rules?

Generally no. Regulation E applies to accounts held mainly for personal, family or household use. Business payments over FedNow fall under Regulation J and the UCC Article 4A rules it incorporates. Over RTP, they fall under the network's rules. In both cases your account agreement matters, including any security procedures you agreed to.

Read the fraud and liability sections of your business account agreement before raising your transfer limits.

Your prevention and reporting plan

Before you pay:

Verify any new payee or changed payment instructions another way, by calling a number you already had, never one from the message.
Lower your daily instant-transfer limit to what you actually use, and turn on alerts for every outgoing payment.
Treat these as red flags: a call about "suspicious activity" that ends with you moving money, a request for a one-time code, pressure to act right now, and a "secure account" in someone else's name.

If money has already left your account:

Call your bank on the number on your card or statement. Ask for a recall or return request, and if you didn't send the payment, say "unauthorized transfer" plainly. Write down the date and time.
File at ic3.gov with the full transaction details. The FBI's 2025 report says "time is of the essence" for getting funds frozen.
Report to ReportFraud.ftc.gov. Older adults, or someone helping them, can call the National Elder Fraud Hotline at 833-372-8311, Monday to Friday, 10 a.m. to 6 p.m. Eastern.
If your bank asks for written confirmation of a phone report, send it within 10 business days, or you can lose the provisional credit. Check every statement against the 60-day deadline.