Fraud and claims management: the records a P2P desk needs on day one

Fraud and claims management, on a bank's P2P desk, is the work of investigating customers' claims that a person-to-person payment was unauthorized, misdirected or induced by a scam, and deciding each one under Regulation E, the network's rules and the bank's own policy. Its quality is set before the first claim arrives, by which records the desk can see. Regulation E expects a reasonable review of the bank's own records, and examiners have cited banks that looked only at the payment instructions. P2P Fraud Claims, Botminds' software for dispute teams that resolve P2P fraud and scam claims, reads those records for every payment in a claim, so going live with it is mostly a question of connecting them.

This guide is for the operations and project leads who stand up or rebuild a P2P claims desk. It starts with the day-one list, then explains why each item is there and who owns it, and ends with what a bank brings to a pilot and what the solution brings.

What does a fraud and claims management team do?

On P2P payments, a fraud and claims management team takes in customers' notices of error, investigates each payment, decides it under the applicable rule, communicates the outcome, and recovers what it can from the receiving bank. It also feeds the fraud team: the accounts that received the money are often mule accounts, and a claims desk sees them first. The work runs on Regulation E's clock: 10 business days to decide or provisionally credit, results reported within three business days of the decision, errors corrected within one.

The team usually sits inside a bank's disputes or fraud operations, and its decisions touch four other functions: the supervisors who approve, the compliance officers who test, the fraud analysts who act on recipients, and the auditors who reconstruct it all for an examiner. A desk set up without those hand-offs ends up doing them by email, which is where deadlines slip.

What records must a bank review for a Reg E claim?

A bank must review the relevant information in its own records, and may not stop at the payment instructions. Regulation E's Official Interpretations are explicit: where other records the bank holds on the account could settle the claim, the investigation has to look at them, not only at the payment instructions; the systems that hold those records are mapped in Reg E software that reads your core. The same comment lists what a review might include, among them the transaction history of the account for a reasonable period before the claim, the location of the transaction or payee relative to the consumer's residence and habitual transaction area, and information held by the bank's third-party service providers that may be dispositive.

The list was written before most P2P payments existed, so it names ACH records and check numbers. Its logic carries over directly. For a P2P claim, the records that could settle a customer's claim are above all the sign-in and device records, because they answer the question Regulation E's definition of an unauthorized transfer turns on: who initiated it.

What data is needed to investigate a P2P claim?

A P2P investigation needs, for each payment, the device and session that sent it, how that device came to be trusted, the authentication used, the recipient and the recipient's history, and the customer's account of events. The Senate staff who reviewed the investigation procedures of the three largest Zelle owner banks found them uneven on exactly this point. Two of them listed evidence an investigator could use: "Bank of America and Wells Fargo provide examples of what a reasonable investigation could include, such as a review of documents submitted by the consumer, location data to establish the consumer’s pattern of behavior, or device activity." The third bank's documents, the staff found, were silent on what constitutes a reasonable investigation.

The staff's recommendation follows from that: "The CFPB should update Regulation E to provide more extensive guidance on what qualifies as a “reasonable” investigation." Until a regulator writes such a list, a bank writes its own, and the day-one checklist above is a starting point. The device record is the one most often missing from a desk's view, because it lives in the digital channel's systems rather than in the disputes team's.

Every statement on a claim opens the record it came from

What examiners faulted when a desk looked only at the payment

The CFPB's examiners have already cited P2P investigations that stopped at the payment instructions. Reviewing institutions that provided person-to-person payment services, they found that when customers reported that the intended recipient never received the money, "The institutions reviewed only whether they processed the transactions in accordance with the sender’s payment instructions and not whether the transfer went to an unintended recipient due to a token error." The institutions agreed to revise procedures, look back and remediate.

That finding is a records finding. The evidence that would have shown the error, what the network directory held for the recipient's phone number or email at the time, was available to the institution; the desk did not look at it. A go-live plan that lists the network gateway's recipient data among the day-one feeds is the direct remedy, and the same discipline applies to device records on takeover claims.

What is a claims policy?

A claims policy is the bank's written rulebook for decisions the law leaves to it: which scam payments it repays beyond Regulation E and the network rule, who may approve an exception, what each approval limit is, and how letters are worded. Regulation E sets a floor, and private network rules may add protection, but the CFPB's FAQs are clear that rules giving less protection do not count: "less protective rules do not change a financial institution’s Regulation E obligations." A policy that says "no repayment if the customer shared credentials" is, for that reason, unenforceable against Regulation E.

For go-live, the useful test of a claims policy is whether each clause can be applied as a setting and dated. In the solution, the rules every claim is placed against are settings with versions: the confidence threshold below which a specialist decides, the network rule version, the claims policy and its sections, the share of twin claims a draft must match, approval limits, the escalation days and the letter deadline. An administrator proposes a change and the Head of Disputes approves it before it applies, so a claim decided under the old version can still show that version later.

Who owns P2P claims at a bank?

Ownership is usually split: a head of disputes owns the desk and the policy, specialists and supervisors work and approve the claims, a Regulation E compliance officer tests them, fraud operations owns the recipients, and internal audit reads everything. What matters for go-live is that each role's authority is written down before the first claim, because a P2P claim crosses all of them within a day.

The solution separates eight roles by duty. A specialist confirms and drafts; a supervisor approves up to $10,000 a claim; the Head of Disputes approves above that, every goodwill exception and every settings change; compliance tests; a fraud analyst proposes restrictions on recipient accounts and a fraud operations manager approves them; an auditor reads and exports; an administrator proposes settings and works no claims. The fraud hand-off is where records pay off a second time: the same payment data that decided the claim shows where the money landed.

Where the money landed goes to the fraud team the day the claim is decided

How long are Reg E claim records kept?

At least two years. Regulation E requires any person subject to it to keep evidence of compliance for at least two years from the date each disclosure or action was due. A bank under investigation or sued over the claims must keep the related records until the matter ends. Many banks keep claim files longer under their own retention schedules, and where a claim's evidence supports a suspicious activity report, other rules govern those records.

For a P2P desk the practical question is what "evidence of compliance" includes. It is not only the letter. It is the notice date, the records reviewed, the placement and the reason for it, the approval and the dates of each step. A desk that keeps only the outcome cannot show an examiner, two years later, that the investigation was reasonable. In the solution, every agent step and human action sits on one trail, and an auditor can build a masked export for a named examiner.

One trail of every step, and a masked export for the examiner who asks

What a bank brings, and what the solution brings, to go live

A bank brings access to its four systems, its claims policy, its letter templates and a sample of its own past claims; the solution brings the agents, the screens, the clocks, the checks and the trail. The past claims matter most. Running the solution on claims the bank has already decided shows, before any customer is affected, where the agents' placements and the bank's original decisions differ, and why. Those differences are the go-live agenda.

Where it fits and where it does not: P2P Fraud Claims works the claim after the customer reports it. It does not monitor payments before they leave or replace a fraud case-management system; it hands recipients to one. Card disputes have their own rules and their own dispute management software guide. For the screens a specialist works in all day, see Zelle dispute training, claim by claim, and for the questions to put to any vendor, claims software programs for fraud detection. The sample claims on this page start from P2P Fraud Claims.

Questions people ask

What is a fraud claim at a bank?

It is a customer's report that money left their account without their authority, or was lost to a scam, together with a request to get it back. For electronic transfers, an unauthorized one is a Regulation E error the bank must investigate and correct within set deadlines; a scam the customer authorized is handled under the network's rules and the bank's own policy.

Do device logs count as the bank's own records under Regulation E?

Yes. Records the bank holds about the account, including sign-in and device data from its own digital banking platform, are part of its own records, and the Official Interpretations also point to information held by its service providers that may be dispositive. A review that ignores them may not be reasonable.

Can a bank ask the customer for documents before investigating?

It can ask, but it cannot wait. Regulation E's commentary allows a bank to request a written, signed statement, but it may not delay starting or completing the investigation until it arrives, and the CFPB's FAQs say the same of police reports.

How long does it take to set up a P2P claims desk on new software?

It depends mostly on access to the four record systems, not on the software. Running the solution first on a sample of the bank's own past claims lets the bank test placements and letters early, and shows which connections matter most.

Who should approve a P2P claim decision?

A supervisor who did not work the claim, for every credit, denial, provisional credit and recovery request, with higher limits and goodwill exceptions reserved for the head of disputes. Separating the person who gathered the evidence from the person who signs is the control testers look for first.