The State of Payment Fraud in Asia

Southeast Asia is the world's fastest-growing real-time payments market. By 2028, regional real-time payment volumes are projected to exceed USD 11 trillion. Cross-border QR corridors already link six of the ASEAN region's economies. In Indonesia and Vietnam, hundreds of millions of people accessed formal financial services for the first time through a mobile wallet, not a bank branch.

Fraud has kept pace. Singapore lost SGD 913 million to scams in 2025, a fall from the SGD 1.1 billion peak of 2024, but nothing close to a recovery. The Philippines sees fraud touch 13.4% of all digital transactions, more than double the global average, with economy-wide losses estimated at USD 8.29 billion annually. Hong Kong, although not strictly part of Southeast Asia, is heavily integrated within the region and recorded HKD 9.15 billion in deception losses in a single year.

The dominant response across the region has been consumer-facing with awareness campaigns, One Time Password (OTP) hygiene messaging, public education. These are not wrong, but they are addressed to the wrong problem.  

There is no country in Asia that has a standalone dedicated Confirmation of Payee (CoP) or Verification of Payee (VoP) scheme equivalent to the UK's PSR-mandated CoP or the EU's EPC VoP scheme. What exists are payee name display and verification features embedded within instant payment and proxy-based transfer systems, these serve a similar anti-fraud purpose but operate as an overlay feature rather than a formal interbank scheme governed by a dedicated rulebook. These features are often also not supported by liability regimes ensuring incentives to protect citizens against scams reside with financial institutions and their technology infrastructure.

The Philippines represents the clearest regional break from the consumer-education default. The Anti-Financial Account Scamming Act (AFASA) moves liability onto financial institutions and mandates real-time payment fraud prevention mechanisms, a structural response to a structural problem. Its limitations, and what it would take to close them, are examined in detail in Part 2.

Fraud at this scale is not a failure of consumer vigilance but a failure of payment infrastructure and fraud syndicates are engineered for the gaps between jurisdictions. The regulatory frameworks chasing them, however well designed, all stop at the border.

It is a regional problem met with national solutions. Closing those gaps requires cross-border standards and cooperation. But the ASEAN region is not a unified bloc, and regional solutions in this part of the world always require local translation. That tension runs through the four forces driving fraud that this article examines.

An Industrial Scale Supply Side

The fraud threatening Southeast Asia's payment systems is not diffuse or opportunistic. It has an address. Scam compounds operating across Myanmar's Kokang region, Cambodia's border zones, and Laos' Golden Triangle Special Economic Zone form the industrial base of a significant proportion of regional fraud. Largely run by organised criminal networks and many with roots in Chinese criminal syndicates. These operations employ, and in many cases traffic, tens of thousands of workers to run fraud at scale. The UN Office on Drugs and Crime has documented the infrastructure extensively.

This is why domestic enforcement keeps hitting a ceiling. When Hong Kong police dismantle a mule network or Manila prosecutors charge a money laundering syndicate, the operators remain untouched across a different border in ungoverned territory. AI has lowered the barrier further. The HKD 200 million deepfake fraud in Hong Kong in early 2024, in which fraudsters replicated a CFO and colleagues via AI video to authorise a wire transfer, is no longer an exceptional capability. It is a commodity tool available to compound operators running dozens of concurrent fraud campaigns.

The aggregate regional loss figures in Philippines USD 8.29 billion annually, Hong Kong HKD 9.15 billion in 2024, Singapore SGD 913 million, are in large part the output of this supply chain.

A Payments Integrity Problem Treated as a Consumer Education Problem

Across the region, public responses to surging fraud losses have defaulted to the consumer: teach people to spot phishing, warn them about OTP requests, publicise scam hotlines. The instinct is understandable, but it is also structurally insufficient.

The attack surface is not consumer behaviour; it is the payment system itself. Funds move before any institution with authority to intervene has meaningful visibility. There is no widespread pre-payment mechanism to confirm that the account receiving funds actually belongs to the entity named as the beneficiary. In markets where verification schemes exist, like in the UK, Australia with Confirmation of Payee (CoP) Or Europe’s Verification of Payee (VoP) this check happens before the payment is authorised. Across most of ASEAN states, what exists is name display, showing the account holder’s name to the sender rather than name-matching: a formal check that the name provided matches the account on record, at the time of payment initiation.

Vietnam illustrates the cost. According to the GFTN/Visa VEEI report published in early 2026, one in three Vietnamese consumers hesitates to use digital payments not because they lack awareness of fraud, but because they have no mechanism to verify where their money is going or recover it once sent. That is a payment infrastructure problem. Awareness campaigns cannot fix it.

The Philippines enacted in 2024 The Anti-Financial Account Scamming Act (AFASA) and operationalised through BSP Circular 1213 to 1215 which moves liability onto institutions, mandating real-time automated fraud monitoring. Through Circular 1215, it establishes a structured process for tracing and temporarily holding disputed funds across every institution in a payment chain, with a 30-day hold window and mandatory cross-institution coordination. These are meaningful instruments, but they operate after a payment has moved.  

What AFASA Philippines does not yet mandate is pre-payment verification in confirming that the account receiving funds belongs to the entity named as the beneficiary before settlement occurs. The Philippines also exited the FATF grey list in February 2025, a signal of institutional maturation. Yet fraud losses remain at 1.9% of GDP. Compliance and outcomes are not the same thing.

Thin Verification Across Large and Often Informal Economies

Much of the ASEAN region's commercial activity runs through channels with minimal verification infrastructure: messaging apps, social commerce platforms, peer-to-peer transfers. For consumers, the risk is misdirected payments and social engineering. For businesses, particularly SMBs and corporate treasury teams managing vendor payments across borders, the risk is invoice fraud and payment redirection at the point of a new or changed banking instruction.

This is the commercial exposure that mirrors the vendor fraud patterns seen in US corporate payment flows: as trade relationships shift and supply chains diversify across theASEAN region, every new counterparty onboarded is a verification gap. An instruction to update payment details, arriving by email or messaging app, carries no inherent signal of legitimacy. Without a mechanism to confirm that the account receiving funds belongs to the named entity, the control framework has nothing to check against.

Hong Kong's infrastructure points to what is possible and where the gap remains. Bank-to-bank verification capability exists within the system. But there is no regulatory requirement to surface it to the customer at the point of payment. Unlike CoP or VoP, the verification check in Hong Kong is available but not mandated. The control exists inside the system. It has not been connected to the moment that matters.

National Frameworks, Borderless Fraud

Each jurisdiction's regulatory response is meaningful within its own borders. AFASA Philippines, FINEST in Hong Kong that is now linking all 28 retail banks following its December 2025 upgrade.  

None of them has jurisdiction over what happens in the seconds after funds leave one country and arrive in another. A scam can originate in one market, route through mule accounts in a second, and launder through a third — all within the settlement window of a single real-time payment. The originating institution sees a suspicious outbound payment. The receiving institution sees a normal inbound payment. Neither has the full picture, end-to-end.

Singapore is working toward a cross-border answer. The Mutual Assistance in Criminal Matters (Amendment) Act 2024 lowered the evidentiary bar for international cooperation, removing the previous requirement to trace illicit funds to a specific foreign offence. The FRONTIER+ platform, a cross-border anti-scam collaboration mechanism now connecting ten jurisdictions including Australia, Canada, and five ASEAN region members, produced its first major operational result in April–May 2025 with seven jurisdictions, 1,858 arrests, 32,607 bank accounts frozen, USD 20 million in fraudulent funds intercepted.

That result matters. It also illustrates the ceiling of the current model. FRONTIER+ is an enforcement coordination platform. It operates after fraud has occurred. What is missing is the upstream layer, a pre-payment verification standard that works across borders, so that a payment instruction can be validated against the intended beneficiary before funds move, regardless of which ASEAN regioncorridor it traverses.

Most recently, Singapore proposed an ASEAN region-first mechanism to trace the origin of scam calls and SMS messages backwards through telecommunications networks that was endorsed at the ASEAN Digital Ministers' Meeting in January 2026. It is a telco-layer instrument, not a payment one but, the direction is consistent: trace the fraud back to its source, before the next victim is reached.

Know Your Payee (KYP): The Gap Is Real-Time Payment Fraud Prevention with Prepayment Verification at Scale  

Southeast Asia countries have built some of the world's most dynamic real-time payment fraud prevention infrastructures enabling money to move instantly, at all hours of the day. The verification layer to provide upfront protections and trust to these payments has been somewhat neglected.  

The response has been national in a problem that is regional. It has been educational in a problem that is structural and systemic. The regulatory direction of travel is correct with AFASA's verification mandate, Singapore's traceback push architecture, Hong Kong's enforcement cooperation, but each instrument operates within boundaries that fraud does not respect.

Closing the gap requires pre-payment verification at scale which is confirming that the account receiving funds belongs to the named beneficiary, across every payment corridor, before settlement. That capability needs to be common in standard and local in execution because ASEAN region's economies are substantially different from each other, and any framework that ignores that will fail at implementation, as most regional integration efforts in this part of the world eventually do.  

iPiD delivers exactly that. The largest Know Your Payee (KYP) platform provides real-time account verification across payment corridors, confirming the beneficiary before funds move. No awareness campaign stops a fraudulent payment reaching the wrong account or intercepts a scam when it matters. Verification at origination does.

Nium, a Singapore-headquartered cross-border payments platform operating across ASEAN, is already doing this, partnering with iPiD to bring payee verification to the corridors where the regional enforcement response stops short.

Subsequent parts of this series examine what that means market by market, beginning with the Philippines, where AFASA's verification trajectory represents the most developed regulatory mandate for pre-payment account validation in the region.