DEFS Learn · AI agents and online banking

How do credit unions stop Zelle and P2P scams, and do those controls work for AI agents?

Last updated October 26, 2026 · DEFS Agent Defense (defs.ai)

Short answer

Credit unions cut P2P scam losses with a well-known set of controls: holds or extra checks on payments to new recipients, lower limits for new users and new payees, step-up approval above a dollar threshold, transaction monitoring and member education. The same controls matter even more when an AI agent starts the transfer, because the agent can act fast and answer prompts inside the session. Apply them to every agent request, and send approvals to the member's own device.

The proven controls against P2P scams

America's Credit Unions recommends member education, monitoring for large transfers to unfamiliar recipients, temporary holds on new P2P recipients, daily limits for new users and verification before large transfers (America's Credit Unions). NACUSO describes Zelle's Advanced Authentication option, where credit unions pick a dollar amount at or above which members confirm with a one-time code, and advises frequent review of monetary and velocity limits (NACUSO).

Control	Why it works
Hold or verify payments to new recipients	Most scam payments go to someone the member has never paid before.
Lower limits for new users and new payees	Caps the loss while trust is being established.
Step-up approval above a threshold	Adds a deliberate pause and a second check on large payments.
Velocity monitoring	Catches several quick payments that each look small.
Member education and in-flow warnings	Helps members spot impersonation and urgency tactics.

Why AI agents raise the stakes

When an AI agent starts the transfer, two things change. The agent can act in seconds, splitting a payment into several small ones or spreading it across more than one agent. And a confirmation prompt shown inside the session can be answered by the agent itself: in DEFS testing, a browser agent re-entered the member's password and approved its own step-up prompt. Controls designed for a person tapping through an app need to be applied at the moment of each agent request, with approvals delivered somewhere the agent cannot reach.

Mapping each control to agent-initiated transfers

Scam control	Agent version
New-recipient hold	The first payment by any agent to a new payee or account goes to the member's enrolled device.
Limits	Per-payment and daily limits per agent, counted across all of the member's agents.
Step-up approval	Approval on the member's device, never a prompt inside the agent's session.
Velocity monitoring	Rolling totals and request rates per member across every agent.
Warnings	Screening memos and payee names for instructions aimed at the agent, and holding those payments for a person.

Where DEFS fits

DEFS applies these controls to requests made by AI agents through online banking: bill pay, transfers, ACH, disputes and moving deposits out. When a member is persuaded to send a payment themselves, through Zelle or any other P2P service, your existing scam controls and member education carry that channel. DEFS adds the same protections to the new channel where software, not the member, presses send.

How DEFS handles it

One checkpoint before money moves. Every agent request for bill pay, transfers, ACH, disputes or moving deposits out passes through DEFS before your core or payments engine sees it.
Accepts the credentials agents already carry. DEFS checks Cloudflare Web Bot Auth, Visa Trusted Agent Protocol and Google AP2 credentials today, and is adding Mastercard Agent Pay, Prove and World ID. Members and agent makers don't adopt anything new.
Your scopes and the member's, enforced together. For example: bill pay up to $500 to existing payees, no external transfers. The strictest rule wins.
Members stay in charge. New payees and new destinations go to the member's own device for approval. A "connected agents" page lets members see every agent and revoke it with one tap.
Your fraud team keeps the controls. A live decision log, approve, limit or block for any agent, a kill switch that stops all agent money movement at once, and a tamper-evident audit trail. DEFS reviewers run it day to day; your team can step in any time.
Shared protection. A rogue agent blocked at one participating institution is flagged for yours, on your terms.

The demo results

We tested DEFS in a model credit union built from public information, using test data. OpenAI and Claude agents sent it 3,259 requests: everyday member tasks mixed with deliberate attacks.

1,490 of 1,491attack attempts stopped by DEFS. The one remaining request moved $0 because the core system rejected it.
0 of 807legitimate requests wrongly blocked: zero false positives.
3,259requests from OpenAI and Claude agents, decided in a median of 7 ms.

"Stopped" means DEFS denied the request outright or held it until the member or a reviewer decided. No attack attempt moved any money.

Attack type in the test	Result
New-payee attempts	90 of 90 stopped or held for the member
Over-limit payments	119 of 120 stopped or held; the remaining request moved $0 because the core system rejected it
Transfers split across several agents	72 of 72 stopped or held
Hidden instructions in memos and payee names	112 of 112 held for review

See it for yourself in the live demo environment (test data only), or book a 30-minute walkthrough.

See DEFS stop a rogue AI agent before it moves money, live, in 30 minutes.

Book a demo

Frequently asked questions

How do credit unions stop Zelle scams?

With layered controls: holds or verification on payments to new recipients, lower limits for new users, step-up approval above a dollar threshold, transaction monitoring and member education. America's Credit Unions and NACUSO both describe these practices.

Does DEFS stop all Zelle and P2P fraud?

DEFS protects transfers that an AI agent starts through online banking. Payments a member makes personally through Zelle or another P2P app stay with your existing scam controls, and DEFS brings the same proven controls to agent-initiated requests.

Why not just rely on our existing step-up prompts for agents?

A prompt inside the session can be answered by the agent driving that session. In DEFS testing a browser agent re-entered the member's password and approved its own step-up. Approvals for agent requests should go to the member's enrolled device.

Do new-payee holds annoy members?

Only the first payment to a new payee or account needs approval. After that, payments within limits go straight through.

Sources

America's Credit Unions: Peer-to-Peer Payments: Monitoring for Fraud
NACUSO: What your credit union can do to prevent losses as P2P fraud continues to rise
DEFS demo results: model credit union built from public information, using test data (3,259 agent requests from OpenAI and Claude agents).