Peer-to-peer, or P2P, payment apps are built to move money between people quickly. That convenience is why they work for splitting a dinner bill. It is also why a scammer likes them. The sources used here do not describe how fast any particular transfer settles, so treat speed as a general feature of these apps, not a guarantee. What they do show is how impersonation works and what one federal regulator found when it looked at a large app's fraud handling.
How impersonation sets up a P2P scam
Impersonation is the common thread. The Federal Trade Commission says scammers pose as many kinds of organizations, including reputable charities. A message that appears to come from a group you already trust is not proof that it does.
One pattern is the prize claim. A scammer may tell a person they won a charity-sponsored sweepstakes because they donated in the past. The detail makes the message feel personal. A prior donation becomes the hook, and the supposed win becomes the reason to act.
The sources do not lay out the step-by-step flow of a typical scam, such as how first contact happens or how the payment is requested. So this article does not claim one. What the FTC material does support is narrower: the contact may arrive as a call, text, or email, and it may name an organization you support.
What regulators found about one app's fraud handling
In January 2025, the Consumer Financial Protection Bureau (CFPB) found that the operator of a large P2P app failed to take timely, appropriate measures to prevent, detect, limit, and address fraud on its platform. Its order dated January 16, 2025 required up to $120 million in refunds and other redress to consumers, plus a $55 million penalty paid into the bureau's victims relief fund.
The CFPB said the operator closed reported fraud cases without opening an investigation the law required. It said the company told users who lost money to ask their banks to reverse transactions, and then denied those reversals. Investigations were described as woefully incomplete.
The bureau also said the operator used the card network chargeback process as a substitute for its own duties under the Electronic Fund Transfer Act and Regulation E. And it said customer service had no live telephone agents. The result, according to the CFPB, was fake customer service lines through which consumers' information was stolen.
What Regulation E covers, and what the sources leave open
The CFPB says Regulation E applies to P2P and mobile payment transactions that meet the definition of an electronic fund transfer. That includes transfers made through a debit card, ACH, or a prepaid account. An electronic fund transfer is a transfer initiated through an electronic terminal, telephone, computer, or magnetic tape to debit or credit a consumer's account. The rule covers accounts established primarily for personal, family, or household purposes, including checking, savings, and prepaid accounts.
Several questions remain unanswered by the material reviewed. It does not explain how error-resolution rights differ between a payment you sent to a scammer and an unauthorized transfer. It gives no dollar limits on consumer liability. It offers no timelines for reporting a problem to a bank, an app, or an agency. Those details matter, so ask your bank or credit union directly and read the CFPB's Regulation E FAQs.
For background on fraud types, the OCC maintains a Fraud Resources section that includes a page on imposter scams. Check it alongside the FTC's guidance on mobile payment apps.
Red flags to watch for before you pay
The sources point to a short set of warning signs.
- A call, text, or email from someone claiming to represent an organization you support, saying you won a sweepstakes or prize.
- A customer service number that is not the app's official support channel.
- Claims that an app protects you from unauthorized transfers, or offers a phone line to report them, when the company does not actually provide that help.
The second flag comes straight from the CFPB's finding. Fake support lines were used to steal consumer information. If you need help, find the support contact inside the app or on the company's own website. Do not use a number from a message that reached you first.
The third flag is easy to misread. The concern is not that apps never protect users. It is that a promise of protection means little if the company does not deliver the reporting channel and investigation it describes.
If you suspect you have been targeted, contact your bank or credit union promptly. The sources reviewed do not give a reporting deadline, so do not wait to find out whether one applies to you.
