When the victim authorizes the crime

Instant payment systems are designed to verify that the person making a transfer is the legitimate account holder. But what happens when a customer is forced to authenticate a payment at gunpoint? As South Africa’s PayShap expands, cases from Brazil, India and the US expose a growing blind spot.

One of the fundamental principles of digital banking is ensuring that a transaction is authorized by the account holder. Strong customer authentication – whether through a PIN, a biometric scan, or a one-time code – is designed to answer this question. Authentication confirms that the expected customer, using the expected credentials, approved the transaction. However, it does not in itself prove that the transaction is legitimate.

This vulnerability is now being exploited in remarkably similar ways in three different countries. Criminals in Brazil, India and the United States have found ways to manipulate situations so that customers authenticate transactions themselves.

The new express kidnapping

In Brazil, victims are grabbed off the street and forced to transfer money to their captors, usually through Pix, Brazil’s instant payment system. The practice, known as ‘sequestro relâmpago’, or ‘express kidnapping’, surged when Pix launched during the COVID-19 pandemic, and continues today. São Paulo state recorded 133 kidnapping cases in the first nine months of 2024, and police report that criminals now typically hold victims captive for over a day, waiting for daily transfer limits to reset before releasing them. In May 2025, São Paulo’s military police arrested three people in connection with a case in which a victim was forced to transfer BRL9 200 (US$1 770).

Brazil’s central bank has repeatedly revised its approach to combat the phenomenon. In 2021, it introduced caps on overnight transfers. Under the bank’s resolution BCB nº 147/2021, any transaction judged suspicious can be placed under a mandatory precautionary hold of up to 72 hours while the receiving institution investigates. Brazilian courts have confirmed the rule applies as written.

In 2023, São Paulo’s public prosecutors met formally with Febraban, Brazil’s bank federation, to discuss further measures, including geolocation data in banking apps, which would allow police to intercept a transaction in progress rather than investigating it afterwards.

In addition, a resolution published in 2025, mandatory nationwide since February 2026, requires banks to freeze and trace funds across a chain of accounts once a payer reports a transaction as fraudulent, rather than stopping at the first account that received the money, as the previous system did. The shift from transfer limits to active fund tracing reflects an approach that continues to adapt in response to the threat.

Traceable, but not preventable

Similar tactics are being used in India. In 2025, a woman in Bengaluru was forced to transfer INR5 100 (US$54) after intruders held her pet cat at knifepoint.

Here, however, transactions made using the country’s Unified Payments Interface (UPI), a real-time mobile payment system, leave a digital trail tied to the accounts involved. This has occasionally helped victims after the fact.

In 2025, police used a UPI transaction record to catch two suspects who had forced a victim to transfer INR3 500 (US$37) at knifepoint. In another case, near Gurugram, five men posing as cab drivers were convicted, fined and imprisoned for kidnapping two passengers and forcing them to transfer INR27 000 (US$283) through UPI.

The cases in India show that authentication can work exactly as intended and still be abused. Authentication confirms who initiated a payment. It does not explain the circumstances under which it was made.

Not confined to one type of rail

This type of criminal activity is not confined to sovereign instant payment infrastructure. In the United States, for example, where Zelle, Venmo and Cash App are consumer transfer services rather than part of a national system, similar crimes have emerged despite a very different landscape.

In Chicago and other cities, so-called ‘bank jackings’ have become increasingly common. In these incidents, criminals force victims to unlock their phones using passcodes, fingerprints or facial recognition, and then drain their accounts through commercial instant payment platforms.

In 2024, Manhattan District Attorney Alvin Bragg called for stronger safeguards to protect consumers against a rise in theft through payment apps, proposing measures including transaction limits and delays, secondary verification for large transfers, and stronger monitoring of unusual activity.

Despite their differences, these systems share one characteristic that criminals can exploit: money moves almost instantly once a customer approves a transfer.

South Africa’s open question

With PayShap, South Africa is still early in the growth curve that countries such as India and Brazil have already climbed. However, vulnerabilities are already emerging.

Like Pix and UPI, PayShap payments are final and irrevocable once authenticated. In a May 2026 BioCatch survey of fraud, anti-money laundering and compliance leaders at South African banks, 89% of respondents rated real-time payment platforms like PayShap as presenting a moderate to very high risk of fraud. Accompanying commentary points to the related rise in violent crime involving express kidnappings in the country.

The question, then, is whether fraud controls can correctly identify a transfer that has been authenticated by the real account holder under physical duress. This is a design problem that Brazil is still grappling with, even after several regulatory iterations following the launch of Pix.

Who bears the loss?

Although the examples from Brazil, India and the United States involve three different jurisdictions and payment products, the strategies employed by criminals are remarkably similar. Liability for the resulting losses is less straightforward.

In the United States, Regulation E explicitly recognizes some coerced transactions, including ATM transfers induced by force, as unauthorized. However, it does not provide explicit guidance on the scenario now appearing during payment app robberies, where the genuine customer is forced to authenticate and initiate the transfer themselves.

India’s customer protection framework, meanwhile, allocates liability based on whether the bank, a third party or the customer was at fault, but offers little guidance on how losses should be treated when a customer personally enters their credentials under physical duress.

In Brazil, courts have reached different conclusions about whether banks should reimburse victims of express kidnapping, with the circumstances and location of the robbery affecting liability. While the crime itself is similar, the courts have not always agreed on who should bear the loss.

When authentication is not consent

In 2026, the Financial Action Task Force (FATF) found that 90% of the 156 jurisdictions it assessed had identified fraud as a major money laundering risk. FATF ministers formally committed to tackling the growing ‘fraud epidemic’ as a strategic priority for the period 2026–2028. But coerced instant payments raise a more specific and challenging question: what happens when the bank correctly authenticates the customer, but cannot verify their consent?

South Africa must decide whether to wait for these ambiguities to arise through disputes or to learn from other jurisdictions that are already confronting them. As PayShap grows, it must consider not only how to detect coerced but authenticated payments, but also how to classify them, who should bear the loss and when victims should be reimbursed.

When transparency standards diverge

South Africa spent years strengthening beneficial ownership transparency to secure its exit from the FATF grey list. Ten months later, the US has moved in the opposite direction. What does that divergence mean for South African banks dealing with US-linked companies?

From February 2023 to October 2025, South Africa lived under the scrutiny of the Financial Action Task Force’s (FATF) ‘increased monitoring’ list. Getting off it meant completing a 22-item FATF action plan, covering legislative amendments, improved access to beneficial ownership information, and demonstrated effectiveness in investigations, prosecutions and related measures.

When FATF confirmed the plan complete and delisted South Africa on 24 October 2025, the Financial Intelligence Centre (FIC) called it the end of ‘a difficult but critical chapter’. South African Revenue Service (SARS) Commissioner Edward Kieswetter was even more cautious, describing it as ‘not a finish line but a milestone on a long-term journey’. The country entered a new FATF review cycle in the second half of 2026.

For South Africa, one of those hard-won gains was greater transparency over who ultimately owns and controls companies, an area FATF specifically identified as a strategic deficiency and required the country to address.

Ten months later, the United States – the world’s largest economy and an FATF member – has moved in the opposite direction.

The reversal

On 11 August 2026, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) finalized a rule that permanently exempts American companies and individuals from reporting beneficial ownership under the Corporate Transparency Act (CTA). This makes permanent an interim exemption that FinCEN had issued in March 2025. FinCEN will also delete any beneficial ownership data that US persons have already submitted. Foreign entities registering to do business in the US still have to report, but millions of US-created entities no longer do.

Treasury Secretary Scott Bessent described it as ‘a victory for common sense and American small businesses’. However, transparency advocates took the opposite view. Erica Hanichak, co-director of the Financial Accountability and Corporate Transparency (FACT) Coalition, said the rule ‘keeps the floodgates open for criminals to launder money through US shell and front companies’.

It would be easy to frame this as hypocrisy, with Washington supporting stronger ownership transparency internationally while stepping back from it at home. That criticism has some merit. But for banks, the more important question is what the decision means in practice. The US has long had well-documented deficiencies in beneficial ownership transparency, even while supporting FATF standards internationally. The CTA was a relatively recent and contested attempt to address that gap, rather than a long-established part of the US anti-money laundering framework.

The FATF’s own standard (Recommendation 24) does not require all countries to operate the same type of beneficial ownership register. Instead, it requires companies to hold information on their beneficial owners, and the relevant authorities to have efficient access to adequate, accurate and up-to-date ownership information, whether through a registry or another mechanism. Whether the US retreat constitutes a technical breach is therefore a narrower and more contentious issue, which this article does not seek to resolve.

The sharper question

Whether the US remains technically compliant with FATF standards is only part of the story. A more immediate concern is what happens to the information available to banks when a major FATF member scales back its domestic transparency obligations at precisely the same time that jurisdictions such as South Africa have invested heavily in legislative, institutional and political reforms to build the opposite – largely in response to FATF requirements.

Regulatory retreat is not the same as risk retreat. FinCEN’s decision means that most US companies will no longer be required to report the details of their beneficial owners. This does not make it any easier to determine who owns or controls a company. Nor does it make such structures any less appealing to criminals seeking to conceal their identities. US authorities will simply have less ownership information available than they would have had under the Corporate Transparency Act.

This also does not mean banks have lost access to a database they previously relied on. The FinCEN database was never publicly accessible, and financial institutions’ access to it was limited and subject to customer consent. Foreign banks did not routinely consult it directly.

What has diminished is one potential layer of information available to US authorities. As a result, customer-supplied information, corporate records, commercial databases and institutions’ own due diligence have become more important.

Obligations here arise domestically, not internationally. The customer due diligence (CDD) and enhanced due diligence duties of South African institutions stem from local law and FIC requirements, rather than from the FATF, which sets the standard that domestic law implements. These obligations have not changed. What has changed is the amount of information available for US-linked counterparties.

Furthermore, the compliance burden does not disappear when a foreign jurisdiction collects less information. Rather, it shifts back to the institution conducting the due diligence. More than 600 US companies operate in South Africa, directly employing well over 250 000 people, while US Embassy figures from March 2026 put US direct investment in South Africa at over US$7 billion, with bilateral trade reaching nearly US$23 billion in 2025 alone.

Given the scale of these commercial ties, US-linked companies are significant counterparties in cross-border relationships where South African institutions may need to establish beneficial ownership. When a foreign jurisdiction collects less information, banks must rely more heavily on their own due diligence processes.

Why this matters now

For South Africa, the timing is significant. The country entered a new FATF review cycle in late 2026, and will need to show that the reforms that secured its exit from the grey list are being implemented and maintained in practice. The US decision does not change these obligations. It does, however, highlight an increasingly uneven landscape. South Africa is expected to ensure greater transparency regarding beneficial ownership at a time when the US government is stepping back from collecting the same information from most of its own companies.

For banks, the consequence is more practical. South African institutions still have to identify and verify the beneficial owners of their customers and counterparties. These requirements are not weakened simply because another jurisdiction has chosen to collect less information.

Who fills the gap?

As the US steps back from collecting beneficial ownership information on domestic companies, its corporate structures could become more attractive to those seeking to conceal ownership. Where the state collects less of this information, institutions may have to rely more heavily on information obtained directly from customers, corporate records, commercial databases and their own due diligence.

For South African banks, the key question is whether their verification processes are robust enough to determine who ultimately owns a US-linked client or counterparty when less official information is available to support that assessment.