P2P fraud and scam claims split payment by payment, each placed on its side of the line with the record that puts it there
Each payment placed on its side of the line, with the record that puts it there.
See one case, screen by screen ↓P2P Fraud Claims is software for dispute teams that resolve P2P fraud and scam claims, separating unauthorized from induced payments. Seven agents rebuild each payment in a claim, place it as unauthorized under Regulation E or authorized but induced under the network's imposter-scam rule and the bank's policy, and draft the outcome, the letter and the recovery request. A claims specialist confirms each placement and a supervisor approves.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
A P2P fraud claim usually mixes two kinds of payment. A payment a fraudster started, even with a passcode the customer was tricked into reading out, is an unauthorized electronic fund transfer: Regulation E makes the bank repay it, and the CFPB's Electronic Fund Transfers FAQs say so plainly. A payment the customer sent herself because someone lied to her is authorized but induced: Regulation E does not cover it, but the P2P network's imposter-scam rule, in force since June 30, 2023, and the bank's own claims policy may.
The facts that decide each payment sit in four systems: the digital banking platform's passcode and device logs, the P2P network gateway, the core banking system and the call transcript. A claims specialist copies them into case notes against a 10-business-day clock, then decides the whole claim at once. "You shared the code" becomes a wrongful denial, the recovery request reaches the receiving bank after the account is empty, and two customers with the same facts get different answers. P2P Fraud Claims puts seven agents in front of that gathering, so the specialist starts from each payment already rebuilt and placed, and decides.
Estimated split of one P2P fraud claim's specialist minutes, by hand and with the agents; gathering the facts by hand takes about 20 to 40 minutes a claim. Our estimate, kept modest.
Seven agents rebuild each payment, place it on its side of the line and draft the outcome; a specialist confirms, a supervisor approves.
On October 20, Marisol Ventura, a Corvane National Bank customer since 2009, read a passcode to a caller posing as the bank's fraud department. Three payments left her checking account ending 2207. She called the bank the next morning. Here is her claim, P2P-26-041877, screen by screen in the working solution.
The agents read the call, rebuilt the three payments and placed each one in 4.2 seconds. Payments 1 and 2, $1,650.00 to J. Collier, sit on the left: unauthorized, Regulation E covers it, confidence 0.97. Payment 3, $750.00 to "CNB Account Protection", sits on the right: authorized but induced, the network rule and the bank's policy decide, confidence 0.93.
Reg E · day 1 of 10 · due November 4 · final by December 5
Twelve events from four systems, on one timeline: the caller, her own iPhone D-21C9 and a new device, D-7F3A. The passcode was entered on the new device from an IP address in Nevada, and both payments to J. Collier started there. At 2:31 PM she sent the third payment herself, signed in with Face ID from Ohio, because the caller told her to move it to "a secure holding account".
Dana clicks a citation and the passcode log opens with the agent's lines highlighted: the code was texted to her phone ending 0418 to add a new device at 2:16:04 PM, entered on D-7F3A 37 seconds later, and the device added to her profile at 2:17:02 PM. That is what puts payments 1 and 2 on the unauthorized side.
Read only. Account and phone numbers show their last four digits. Opened by Dana Whitcomb at 9:43 AM, logged.
Dana confirms each placement, and the outcome reads per payment: reimburse $900.00 and $750.00 under Regulation E, reimburse $750.00 under the network's bank impersonation rule, $2,400.00 in all, customer liability $0.00. The consistency agent found 214 similar claims decided in 90 days, 211 the same way, and the recipient ending 6614 in 7 claims from 7 customers in 9 days.
The sign-off lists exactly what will happen: three reimbursements, recovery request REC-26-018233 for $2,400.00 to Quillon Savings Bank, and the recipient handed to Fraud. Dana sends it, and the screen tells her who approves.
You confirmed this claim, so you cannot approve it. Luis Ferreira approves.
Luis ticks three checks and approves. The agents credit $2,400.00 to checking ending 2207, post the ledger entries, send the letter by secure message and mail, and file the recovery request with the receiving bank. The letter reads at grade 4.5 and passed 8 of 8 checks.
Marisol's row now reads "Approved · 9:47 AM". The queue is ordered by the Regulation E clock, and each claim is drawn as a small dividing line, a dot per payment, with hollow dots where the specialist still decides. Overnight the agents read 212 new claims and placed 486 payments; 37 need Dana today.
The recipient ending 6614 is handed to Fraud with its 7 claims and $9,840.00. A Corvane checking account ending 7730, opened online on September 29, received 14 payments from 11 senders in 5 days; Owen can propose a restriction, and the Fraud Operations Manager approves it.
1 restricted item is hidden for your role
Maren sees each kind of claim with its twins and how they were decided. The 3 bank-impersonation claims that placed new-device payments as authorized were reversed in compliance testing with reason R-3, wrong rule. She draws the monthly testing sample from the same screen.
The same claim, seen by the people who decide, approve, test, chase and audit it: what their day looked like, and what it looks like now.
Seven agents rebuild each payment, place it on its side of the line and draft the outcome; a specialist confirms, a supervisor approves.
Reads the contact center transcript or the claim form, lists each payment the customer reports, writes her statement in her own words and starts the Regulation E clock from the notice date.
Rebuilds each payment from the passcode and device logs, the network gateway and the core: who started it, on which device, with what authentication, and the recipient's history.
Places each payment as unauthorized under Regulation E or authorized but induced under the network's imposter-scam rule and the bank's claims policy, citing the rule, its version and a confidence.
Finds decided claims with the same facts and the same recipient, and flags a draft that differs from most of its twins.
Drafts the provisional credit notice, the final letter or the denial at a reading grade under 8, and runs the Regulation E and UDAAP checks on every edit.
Drafts the network recovery request, files it with the receiving bank the moment a supervisor approves, tracks the answer and posts recoveries.
Counts ten business days from each notice, skipping weekends and federal holidays, tracks the 45- and 90-day finish and escalates on days 8 and 9.
Approves every credit, denial and recovery request; never one they worked. The agents propose; a named person decides.
Ask in plain words, or say what to do. Every answer points to the record it came from, then opens the screen it is about.
Why is the third payment on the induced side?
Payment 3 was started on her own iPhone D-21C9 after a Face ID sign-in from Ohio, and she added the recipient herself at 2:31 PM. She says the caller told her to move it. So it is authorized but induced. The caller posed as Corvane, so the network's bank-impersonation rule and CP-14 § 4.1 reimburse it.
Has the recipient ending 6614 shown up in other claims?
Yes: in 7 claims from 7 Corvane customers in 9 days, $9,840.00 in all, all to Quillon Savings Bank account ending 3390. It is handed to Fraud; Owen Mbeki can propose a block, and Ines Varga approves it.
Which claims run out of Reg E time this week?
86 claims are due in the next 2 business days: 41 tomorrow (day 9, escalated to a supervisor) and 45 on Monday (day 8). The closest is P2P-26-041699, Victor Lindqvist, $2,200.00, due tomorrow.
Draft the denial letter for Tamsin Rourke in plain words
Drafted at reading grade 5.1. It says she sent both $320.00 payments herself to a seller she chose, that nobody posed as a bank or agency, so the rules do not pay them back; that a good-faith recovery request went out; and that she can ask for the documents. Luis Ferreira approves it before it is sent.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules every claim is placed against are settings with versions. The administrator proposes a change, and the Head of Disputes approves it before it is in force.
| Setting | Default | Choose from |
|---|---|---|
| Placement confidence threshold | 0.85 | 0.80, 0.85 or 0.90; below it the specialist decides |
| P2P network rule set | Version 2025.2 | Imposter-scam reimbursement, effective June 30, 2023 |
| Claims policy | CP-14, version 7 | Zero liability § 2.1, bank impersonation § 4.1, purchase scams § 4.3, customers 75 or older § 4.4 |
| Twin-claims outlier | 80% of twins | A draft that differs from this share of its twins needs a reason code |
| Approval limits | $10,000 a claim | Supervisor alone up to it; Head of Disputes above, and every goodwill exception |
| Escalation | Days 8, 9 and 10 | Specialist on day 8, supervisor on day 9, provisional credit proposed for approval on day 10 |
| Letters | Within 3 business days of a decision | Secure message and mail; credit, provisional credit and denial templates |
| Retention | 5 years | BSA, 31 CFR 1010.430; longer than Regulation E's 2 years, 12 CFR 1005.13 |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, to be measured in the live solution · “estimated” = our estimate · “typical” = published figures (US Senate Permanent Subcommittee on Investigations, staff report on P2P fraud reimbursement, July 2024: the network's three largest owner banks repaid 38% of reported P2P fraud in 2023, 62% in 2019, and 12% of scam claims). Rules named: Regulation E, 12 CFR 1005.2(m), 1005.11 and 1005.13; CFPB Electronic Fund Transfers FAQs (Unauthorized EFTs, Question 5, June 4, 2021; Error Resolution, Question 4); 31 CFR 1010.430 and 1020.320(e). Corvane National Bank, Quillon Savings Bank and the people, devices, accounts and numbers named on this page are fictional: characters and sample data in the working solution.
P2P Fraud Claims is software for dispute teams that resolve P2P fraud and scam claims, separating unauthorized from induced payments. Seven agents rebuild each payment in a claim, place it as unauthorized under Regulation E or authorized but induced under the network's imposter-scam rule and the bank's policy, and draft the outcome, the letter and the recovery request. A claims specialist confirms each placement and a supervisor approves.
P2P fraud is money lost through a person-to-person payment service, either because a fraudster sent the payment from the customer's account or because a scammer talked the customer into sending it. The two are treated differently: the first is an unauthorized transfer under Regulation E, and the second is authorized but induced, decided by the network's rule and the bank's policy. One claim often holds both kinds.
Under the CFPB's Electronic Fund Transfers FAQs (Unauthorized EFTs, Question 5), a transfer started by a third party who tricked the customer into sharing access information is unauthorized. In the working solution, two payments made from a device added with a passcode the customer read to a caller are placed on the unauthorized side, citing 12 CFR 1005.2(m) and that FAQ.
Not under Regulation E, but the P2P network's imposter-scam rule has required reimbursement for qualifying bank, government and network impersonation scams since June 30, 2023, and a bank's own policy may go further. The classification agent places such a payment on the induced side and cites the rule version and the policy section, such as CP-14 § 4.1 for bank impersonation; a purchase scam the rules do not cover is drafted as a denial for a supervisor to approve.
The clock agent counts 10 business days from the notice, 20 for accounts open 30 days or less, and the 45- or 90-day finish, skipping weekends and federal holidays. It reminds the specialist on day 8, escalates to a supervisor on day 9 and proposes provisional credit for approval on day 10. It never extends a deadline.
No. The CFPB's FAQs (Error Resolution, Question 4) say a bank may not delay an investigation waiting for a police report. The intake agent never asks for one, and the letter checks block any such demand.
Yes. The specialist confirms or moves every placement with a reason code, and below the 0.85 confidence threshold the agents place nothing. A supervisor who did not work the claim approves every reimbursement, denial, provisional credit and recovery request; the agents never approve, deny or send on their own.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your claims policy, letter templates and a sample of past claims, and it goes live once every quality gate has passed. We will walk you through it on your own claims first.
Recredit the next day, and recover the loss from the bank that took the deposit.
1-min demoAPP Fraud ReimbursementEvery scam claim decided on time, the same way by every handler, with half recovered.
1-min demoWire & Instant Payment RecallEach request reaches the beneficiary bank in minutes, while there is money to freeze.
1-min demoWe'll run P2P Fraud Claims on a sample of your own past P2P fraud and scam claims.