Fintech in the Crosshairs: How Open Banking and P2P Payments Startups Unwittingly Become Tools for Fraud

[Professor]

Abstract: New financial technologies offer the world astonishing speed and simplicity. With just a few clicks, we can transfer money, take out a loan, or get a detailed picture of our finances. However, this magic, born of trust and innovation, also has its downside. In pursuit of a seamless user experience and data openness, fintech startups sometimes inadvertently create a fertile environment for unscrupulous activity. This article is not an accusation, but a calm reflection on how the most advanced ideas in open banking and peer-to-peer payments collide with the eternal reality of human intentions, and how this interaction is shaping a new ecosystem.

Introduction: The Innovator's Dilemma: Convenience vs. Integrity​

The spirit of fintech is one of openness. Open banking breaks down the walls between banks, allowing data to travel securely for the benefit of the customer. P2P payments eliminate intermediaries, creating direct bridges between people. These models are built on the foundation of three pillars: speed, accessibility, and minimal friction.

But it is precisely these qualities that attract the attention of those who see financial systems not as a service, but as a playing field. Fraudsters, or, to use a more neutral term, bad actors, are adherents of the "user experience": they seek the fastest, easiest, and least controlled path. And sometimes, fintech, without intending to, paves this path for them. This is not malicious intent, but a natural consequence of priorities: a startup focuses on solving a customer's pain point, while cybersecurity is often perceived as an obstacle.

1. Open Banking: When Open Doors Open Loopholes​

The concept of Open Banking, supported by regulatory initiatives such as PSD2 in Europe, is a breakthrough. It allows third-party service providers (TPPs) to access a user's financial data and initiate payments with their consent. This gives rise to new services: account aggregators, smart financial assistants, instant lending services.

1.1. Vulnerability #1: Consent Mechanics.
Access to data or payments requires informed consent from the client. But how is this obtained? Often through standardized, simplified screens that the user quickly swipes through. A bad actor can:

• Create a fake financial aggregator app that, under a plausible pretext (spending analysis, cashback), requests not only access to data but also permission to initiate payments. Once consent is granted, funds can be withdrawn undetected.
• Use social engineering to convince someone to provide access through a supposedly official service "to verify their identity" or "unblock their account."

1.2. Weakness #2: Speed as a system.
The strength of the Open Banking API lies in instant transaction confirmation. Payments occur in real time. For an honest user, this is a blessing. For a fraudster, it's a window of opportunity. Fraud monitoring systems can delay anomalies by literally minutes, which is enough time to withdraw funds through a chain of other services.

1.3. Weakness #3: Difficulty of attribution.
With a classic bank transfer, the chain is clear: from account A to account B. In a scheme involving a TPP, a third party appears. If an unauthorized transaction occurs, the question arises: was there a data leak from the bank, was the TPP app hacked, or did the user carelessly give consent? This complexity slows down response and incident resolution.

2. P2P Payments: Trust Transformed into Immediacy​

P2P services (from Venmo and Zelle in the West to our domestic systems) have created the illusion of transferring cash in the digital world: "send money as if you were handing a bill from hand to hand." This metaphor conceals the main challenge.

2.1. The paradox of irreversibility.
A traditional bank transfer could be disputed or revoked in a number of cases. Many P2P payments are positioned as final and irrevocable. This makes sense for speed, but it creates ideal conditions for the simplest and therefore most widespread schemes:

• Marketplace Fraud. The buyer receives the product (or the promise of it) and never sends the money. Or vice versa: the seller receives payment for a non-existent product. The speed and irreversibility of the transaction leave the other party with nothing.
• Social engineering under duress. "Mom, I'm in trouble, I need money for a lawyer urgently!" — these messages, accompanied by a request to send funds via a P2P service "right now," are tragically effective.

2.2. Anonymity and pseudo-anonymity.
A phone number or email address is often sufficient to register with a P2P service. This is lower than the entry threshold for a traditional bank. Creating "drop accounts" to receive and quickly redirect stolen funds is becoming technically simple and inexpensive. Such accounts are short-lived, but they are easy to create again and again.

2.3. Merging the social and financial.
Some P2P payments are integrated into social networks or instant messaging apps. On the one hand, this is incredibly convenient. On the other, it blurs the line between a friendly chat and a financial transaction, reducing the user's level of vigilance. The "pay" button is located in the same interface as the "send a sticker" button.

3. Fintech's Blind Spots: Where Bad Actors Feel Comfortable​

Beyond specific technologies, there are systemic characteristics of young fintech companies that create a favorable environment.

• A "move fast and break things" culture. In the race to market, security sometimes takes a back seat. Implementing complex fraud monitoring, KYC (Know Your Customer), and behavioral pattern analysis takes time and resources and can complicate onboarding. Startups often opt for simplicity.
• Limited data for scoring. A traditional bank has a long history of a client's transactions. A fintech startup is seeing the user for the first time. It lacks the behavioral context to distinguish normal activity from suspicious activity. A new user's first few transactions are a leap of faith.
• Focus on the "good" scenario. Product managers and designers design the ideal path for an honest customer. Paths for abuse often remain outside their mental models until the first major incident.

4. Ecosystem Evolution: How Fintech Learns and Adapts​

Awareness of these challenges is constantly evolving. The ecosystem is evolving, finding balance.

• Regulators are entering the dialogue. Monitoring risks, authorities such as the UK's FCA and the Central Bank of Russia are beginning to extend their responsible security principles to fintech companies, requiring the implementation of adequate control systems that do not undermine the user experience.
• The birth of "Regulatory Fintech" (RegTech). A whole subclass of startups is emerging to help other fintechs solve security problems: services for remote identification (biometric KYC), real-time document verification, digital behavior analysis, and network transaction monitoring.
• Collaboration instead of competition. Fintechs and traditional banks are beginning to exchange data on fraudulent schemes and suspicious actors in secure formats. Industry platforms for joint countermeasures are being created, recognizing the shared threat.
• Product review. Security elements are being built into the design of new features from the start: delays for the first large transfers, two-factor authentication for new devices, and educational push notifications ("Are you sure you know the recipient?").

Conclusion: The Path to Mature Harmony​

The fintech revolution continues. Its drivers — Open Banking and P2P payments — are not “bad” or “dangerous.” They are powerful and necessary. Unscrupulous actors are merely exploiting their fundamental properties — speed, openness, and convenience.

History shows that every innovation in finance (from paper money to credit cards) first experienced a period of vulnerability and then found a stable balance between progress and security. Fintech today is in the middle of this journey.

The future lies not in abandoning openness and speed, but in their intelligent, unobtrusive conditioning. It lies in creating an ecosystem where trust is not blind faith, but the result of subtle, almost invisible mechanisms of mutual verification, where convenience goes hand in hand with awareness, and data openness is protected by granular and transparent user control.

This is the path to a new financial culture, where technology serves not only our efficiency but also our shared integrity.