Why PayNow Gen2 Needs Trust Before Money Moves

Singaporeans lost S$913.1 million to scams in 2025. In 81.8 percent of those cases, the victim authorised the transfer themselves. The money did not leave through a hacked account or a broken system. It left because the payer believed they were paying someone they were not.

PayNow Generation 2 is designed to take Singapore's instant payments rail into its next phase: smoother checkout, higher transaction limits, recurring flows, and deeper integration with business software. Every one of those capabilities makes it easier to move money. None of them, on its own, confirms who is on the other end of the transfer.

The Phase 1 report names this gap directly. As PayNow expands beyond simple push payments, it states, safeguards will need to be introduced alongside the new functionality. That is the right instinct. The question Gen2 still has to answer is what those safeguards look like in practice, and whether they arrive before funds move or after.

Three capabilities would close that gap: verifying the payee before payment, sharing fraud signals across the payments network in real time, and identifying mule accounts before more victims reach them. Know Your Payee (KYP) is the frame that ties these together. It is the check that happens before authorisation, not the recovery process that happens after.

Verifying the Payee Before the Payment Leaves

PayNow already lets a payer send money using a mobile number, NRIC, FIN or UEN instead of a full bank account number. A recent change to the nickname display, which partially masks the name shown before payment, makes it harder for scammers to rename themselves after a legitimate agency. That is a real improvement, and it applies only to PayNow's alias-based payments.

FAST, GIRO and MEPS+ transfers, made using account details rather than a proxy, still give the payer no confirmation that the name on the invoice matches the name on the receiving account. A business paying a supplier from a compromised invoice, or a household paying a contractor whose bank details were changed by a fraudster, has no signal to catch the error before the transfer clears.

The models operating elsewhere solve this with a definitive match outcome, not a displayed name. Confirmation of Payee has been mandatory for the UK's largest banking groups since 2020 and now covers close to all Faster Payments-addressable accounts, contributing to a sustained fall in misdirected payments over that period. The EU's instant payments regulation makes Verification of Payee a mandatory pre-payment check across SEPA instant credit transfers. In Australia, Confirmation of Payee has been used more than 100 million times since its July 2025 launch, with one bank alone reporting over 450,000 payments abandoned after a "no match" result, more than 10,000 of them directed at accounts already flagged on the Australian Financial Crimes Exchange.

Extending a true match outcome, Match, Close Match or No Match, across all of Singapore's domestic rails would give payers the same signal for a FAST transfer that they now get for a PayNow one.

Making Fraud Signals a Shared Utility

Payee verification confirms that a name and an account belong together. It does not confirm that the account is safe. An account can pass a name check and still show a pattern no single institution has enough context to see: unusual receiving volume, a device already linked to other scam reports, behaviour that looks nothing like the account's history.

Singapore already has a foundation for this in COSMIC, the MAS platform that has let six major banks share red-flag information on money laundering and terrorism financing since April 2024. Its scope is narrow by design. It covers a small set of participating banks, is built around anti-money laundering typologies rather than live scam signals, and does not reach the non-bank payment providers and e-wallets that now sit inside PayNow.

International practice is moving toward exactly this kind of pre-transaction sharing. Banks in Australia are piloting an inter-bank network that assesses receiving-account risk before a payment clears. European frameworks allow anonymised fraud signals to be pooled across more than 100 banks and fintechs without exposing raw customer data. Extending COSMIC's foundation into a dedicated, real-time scam and fraud utility, open to banks and non-bank PSPs alike, would let receiving-side risk inform screening before funds are released, not after a report is filed.

Closing the Door on Mule Accounts

Every scam needs somewhere for the money to land. Mule accounts are that landing point, and instant settlement means funds can be dispersed within minutes of arriving. Singapore's Mule Facility Restriction Framework, in place since October 2025, has already placed more than 550 money mules and 801 telco mules under banking and mobile line restrictions. That framework acts once an account has been identified. The harder problem is identifying it before the next victim's payment reaches it.

The same account and the same laundering pattern are frequently reused across multiple institutions, and each one sees only its own slice of the activity. A shared, real-time mule account registry, drawing on confirmed scam reports, law enforcement input and participating institutions' own investigations, would let a high-confidence match trigger a restriction before further funds move in, rather than after. It would need clear governance: listing criteria, retention limits and a genuine appeal path for account holders. But once an account has been identified as a mule once, no other payer should have to discover that fact the hard way.

From Detecting Fraud to Preventing It

PayNow Gen2's four priority areas, checkout that reduces friction, transaction limits that expand what the rail can carry, government collections, and richer business data, all point in the same direction: PayNow doing more, faster, for more of the economy. That is worth building toward. It is also exactly why the payment itself, not just the surrounding compliance activity, needs to carry its own trust layer.

Payee verification, shared fraud intelligence and mule account detection are three forms of the same idea: checks that happen before authorisation, not investigations that happen after the money is gone. Together, they are what Know Your Payee (KYP) means in practice, and they are the layer that lets PayNow's next generation of speed and convenience carry the same confidence that made the first generation trusted.

Learn how iPiD helps financial institutions verify payees and prevent payment fraud before funds move.

‍