FedNow fraud prevention for credit unions: A guide for AML, fraud teams

Understand FedNow and its differences from other payment processes.

The FedNow Service offers various educational resources, as do other industry groups. Staying attuned to these resources will help financial institutions learn more as more institutions roll it out.

Involve the right people to create a retail solution tailored to risk tolerance and customers or members.

As they do when offering any new product or service, financial institutions will control certain aspects of their FedNow instant payments offering. The AML and fraud teams’ input is key to safeguarding new banking products from fraud.

Spell out the details.

In developing the credit union’s FedNow product, determine:

• When to begin using FedNow. Each credit union can set its implementation timeline.
• How the credit union will use FedNow. Will it be for sending and receiving? For what purposes will using the network be allowed vs. restricted (e.g., making instant payments for payrolls but not for account-to-account transfers)?
• How much can be sent. Will the credit union configure a lower transaction value limit? This can be adjusted over time using the institution’s risk policies as a guide.
• Who can send or receive. Each financial institution can set its own rules and limits regarding FedNow payments. Review members using a risk-based approach.
• How to accept, reject, or accept without posting. Credit unions would need to clarify their affected policies and procedures, especially those related to submitting an “accept without posting” status. Identify what occurs when ACWP is used and ensure compliance with Reg CC and FedNow operating procedures.

Careful product design is vital. “Even though FedNow is available 24x7x365, at the end of the day, the product being offered to the customer is a [credit union] product … and so the [credit union] gets to control how they’re going to offer that product,” Peter Tapling, a board advisor with the U.S. Faster Payments Council, said in a video interview with Information Security Media Group. Designing FedNow implementation with anti-fraud measures in place includes involving fraud and AML/CFT staff in product and capability planning, technology planning, and treasury planning.

Talk to technology partners.

Financial institutions must be able to connect to the FedNow Service, either through the core or another service provider. They will also need front-end services for members to initiate payments and receive payment requests. This can be either through their own online capabilities or an app. Analyzing incoming transactional data with robust fraud detection and AML systems is vital. Credit unions need fraud detection software capable of strong security measures, including cross-channel detection for evaluating transaction patterns across all payment types.

Review the credit union’s current tactics to fight fraud

Do you have robust user authentication methods? What are the procedures to prevent account opening fraud? Do you understand normal client behavior? Understanding normal client transaction behavior across channels and payment types helps fight fraud of all types. Collect and assess behavioral data continuously and continually verify customer contact information.

Consider boosting anti-fraud and AML/CFT protection.

Steps to increase fraud protection could include:

• Adding suspicious accounts and aliases to a watch list to block potentially fraudulent transactions before affected funds leave or enter the institution.
• Protecting your members and your credit union's reputation with fraud detection software tailored to meet your specific needs. Use a platform that provides enterprise-wide fraud case management to resolve alerts and cases quickly and efficiently.
• Reviewing and considering additional security controls for account enrollment. If a credit union will support sending requests for payments, have the controls in place to ensure it’s a legitimate company or individual and a legitimate request.
• Boosting security controls around how payments are initiated. FedNow officials have said such controls can include a pop-up message asking customers or members, “Are you sure?” before they execute the request to transfer funds.
• Educating members and member businesses on preventing fraud when using instant payments such as the FedNow Service. Remind them of best practices for handling suspicious emails and the importance of secure passwords. Encourage them to enable account alerts and verify their contact information. Reiterate that credit union staff will never ask for login information over the phone, via email, or text. Urge businesses to have two-step approval processes for certain types of payments so they can pause and validate before sending funds. Explain the importance of having employees verify the legitimacy of someone claiming to be a supplier or biller who asks for a payment or a change to payment accounts.

Most importantly, consider from a strategic perspective when the right time is for implementing FedNow. The competitive environment may pressure credit unions to a sooner-than-expected implementation. Even so, aligning processes and procedures with the credit union’s risk level will allow it to stay ahead of fraud compliance requirements. As importantly, it will limit chances for bad actors to commit fraud against credit union members.