RTP fraud moves money in seconds, with almost no way to reverse it once sent
Real-time payment (RTP) fraud is faster and harder to stop than traditional payment fraud because the money leaves your account in seconds, not days. With a credit card or ACH transfer, you have time to dispute the charge or recall the payment. With RTP—which includes systems like FedNow, The Clearing House's RTP network, and similar instant payment rails—the funds are in the recipient's account before you notice the transaction happened. Once there, recovery is nearly impossible without the receiving bank's cooperation, and many banks have no obligation to help.
Traditional payment fraud (card fraud, ACH fraud, wire fraud) relies on delays built into older systems. A credit card company can reverse a charge within 120 days. An ACH transfer can be recalled within one business day. A wire transfer, once sent, is gone—but at least you had time to notice and call your bank before it left. RTP removes that window entirely. The transaction settles in real time, meaning the money is already in another account, often at another bank, before your phone even alerts you.
The difference matters because it changes who bears the risk, how fast you have to act, and whether you can recover anything at all.
Key Takeaways
- RTP fraud settles in seconds, so the money is already in the recipient's account before you see the transaction, making reversal nearly impossible.
- Traditional payment fraud (card, ACH, wire) has built-in delays that give you time to dispute or recall—RTP has no such window.
- Banks are not yet required to refund RTP fraud the way they are for credit card fraud, so your protection depends on your bank's policy, not federal law.
- RTP scams often use social engineering or account takeover rather than stolen card numbers, because the attacker needs access to your actual bank account to initiate the transfer.
- Your only real defense is preventing the fraud in the first place—authentication, monitoring, and refusing to send money to new recipients without verification.
Why RTP fraud is harder to stop than card fraud
Credit card fraud has built-in consumer protection because card networks (Visa, Mastercard) and card issuers are required by federal law to limit your liability and reverse fraudulent charges. Under the Fair Credit Billing Act, you can dispute a charge within 120 days, and the card company must investigate. During the dispute, you do not have to pay. Most card issuers reverse fraud within 10 business days.
RTP fraud has no such requirement. The Federal Reserve and The Clearing House have published guidelines for RTP fraud handling, but they are not law—they are recommendations. Your bank may choose to refund you, or it may not. Some banks have committed to covering RTP fraud losses up to a certain amount, but others have not. If your bank decides the fraud was your fault (because you were tricked into authorizing the transfer), they may refuse to refund you at all.
The speed is the core problem. By the time your bank sends you a fraud alert—which may take hours or days—the receiving bank has already credited the account. The money is no longer in transit; it is sitting in someone else's account. Reversing it now requires the receiving bank to freeze the account, investigate, and send the money back. Most banks will not do this without a police report, a court order, or proof that the account is controlled by a criminal. Even then, if the money has been withdrawn or transferred again, recovery is impossible.
How RTP scams target you differently than traditional fraud
Card fraud and ACH fraud often start with a stolen card number or account number—data breached from a retailer, a phishing email, or a data broker. The attacker does not need access to your actual account; they just need the number. You discover the fraud when you see a charge you did not make.
RTP fraud almost always requires account takeover or social engineering. The attacker either has your login credentials (from a phishing email, malware, or a password breach), or they have tricked you into sending the money yourself. A common RTP scam works like this: you receive a call or email from someone claiming to be your bank, a government agency, or a trusted company. They tell you there is suspicious activity on your account and ask you to log in to verify. You do, and they now have your credentials. They log into your real bank account and initiate an RTP transfer to an account they control. The money is gone in seconds.
Another version: the attacker calls and tells you that you have won a prize, been selected for a loan, or need to pay a bill immediately. They ask you to send money via RTP to "verify your identity" or "secure the funds." You log into your bank, initiate the transfer yourself, and by the time you realize it was a scam, the money is already in their account.
The key difference is that you are often the one sending the money, not the attacker. This makes it much harder to dispute, because your bank can argue that you authorized the transfer. With a card or ACH fraud, the attacker initiated the transaction without your permission. With RTP, you often did it yourself—just under false pretenses.
The legal protection gap for RTP fraud
Credit card fraud is covered by the Fair Credit Billing Act, which limits your liability to $50 and requires the card issuer to investigate and refund you. Debit card fraud is covered by the Electronic Funds Transfer Act, which limits your liability to $50 if you report it within two business days, or $500 if you report it within 60 days. Wire fraud is not covered by federal law, but wire transfers are so expensive and deliberate that most people verify before sending.
RTP fraud sits in a gap. The Electronic Funds Transfer Act may apply to some RTP transfers, depending on how your bank classifies them, but it does not apply to all. The Consumer Financial Protection Bureau (CFPB) has warned banks that they should treat RTP fraud similarly to other electronic transfer fraud, but there is no law requiring them to do so. Some banks have voluntarily committed to covering RTP fraud losses; others have not.
This means your protection depends entirely on your bank's policy. Before you start using RTP, call your bank and ask: "If I am the victim of RTP fraud, will you refund me?" Get the answer in writing if possible. If your bank says no, or if they say it depends on the circumstances, you know that RTP is riskier for you than a credit card or ACH transfer.
Why RTP fraud is harder to recover from
Once an RTP transfer settles, the money is in the recipient's account at their bank. Your bank cannot simply reverse it the way they can reverse a credit card charge. They have to contact the receiving bank and ask them to freeze the account and return the funds. This requires proof of fraud, which usually means a police report.
If you file a police report, your bank can send it to the receiving bank along with a request to recover the funds. The receiving bank may then freeze the account and investigate. But if the account holder has already withdrawn the money, transferred it to another account, or used it to buy something, there is nothing to recover. The receiving bank has no obligation to refund you out of their own pocket.
Some banks have set up fraud recovery teams specifically for RTP fraud, and they may be able to recover money faster than traditional wire fraud recovery. But this is not may provide, and it depends on how quickly you report the fraud and how quickly both banks act. In most cases, if the money is withdrawn or transferred within hours, recovery is impossible.
How to protect yourself from RTP fraud
Because RTP fraud is so hard to reverse, prevention is your only real defense. Do not use RTP to send money to someone you have not verified by phone or in person. If someone asks you to send money via RTP, hang up and call the organization back using a phone number you find yourself—not one they gave you. Do not log into your bank account on a link someone sent you; always go to the bank's website directly.
Enable multi-factor authentication on your bank account, especially if your bank offers it for RTP transfers. Some banks require a second form of verification (a code sent to your phone, a biometric scan) before allowing an RTP transfer. This makes account takeover much harder. If your bank offers it, use it.
Monitor your account daily, especially if you have RTP turned on. Set up alerts for all transfers over a certain amount. If you see a transfer you did not make, contact your bank immediately—do not wait. The faster you report it, the better your chances of recovery.
If you are not using RTP, ask your bank to disable it on your account. RTP is convenient for legitimate transfers, but it is also convenient for scammers. If you do not need it, turning it off removes one attack surface.
Frequently Asked Questions
Can I dispute an RTP transfer the same way I dispute a credit card charge?
No. Credit card disputes are covered by federal law and have a 120-day window. RTP disputes depend on your bank's policy and have no legal timeline. Some banks will investigate and refund you; others will not. Call your bank now and ask what their RTP fraud policy is, so you know before it happens.
If I authorize an RTP transfer but I was tricked into doing it, can I get my money back?
Maybe. If you were socially engineered into sending the money, your bank may refund you if they have a policy covering "authorized but fraudulent" transfers. But many banks will not, because you technically authorized it. This is why prevention is so important—once you send it, recovery is not may provide.
How long does RTP fraud recovery take?
If the receiving bank cooperates and the money has not been withdrawn, recovery can take a few days to a few weeks. If the money has been transferred or withdrawn, recovery is usually impossible. The faster you report it, the better your chances.
Is RTP safer than wire transfer?
Wire transfer fraud is also irreversible, but wire transfers are expensive and deliberate, so most people verify before sending. RTP is faster and cheaper, which makes it more convenient—and more attractive to scammers. Both are risky if you do not verify the recipient first.
What should I do if my bank refuses to refund RTP fraud?
File a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB has been pushing banks to cover RTP fraud losses, and complaints help build the case for stronger protections. You can also contact your state's attorney general or banking regulator.