{
  "slug": "payee-add-is-the-transaction",
  "title": "The payee add is the real transaction. Everyone guards the wrong step.",
  "summary": "Account takeover starts with a settings change, not a transfer. The FBI logged $262M in ATO losses in 2025. Sign the change, not just the payment.",
  "lede": "Every fraud team in the world puts its strongest control on the moment money moves. Attackers know this, so they stopped attacking that moment. They attack the settings page six weeks earlier, and then let your own systems approve a payment that looks completely ordinary. This is a lesson about picking the right event to protect.",
  "date": "2026-09-04",
  "reading_time": "17 min read",
  "category": "Payments",
  "tags": [
    "account takeover",
    "payee add",
    "beneficiary fraud",
    "withdrawal whitelist",
    "payments security",
    "PSD2 SCA"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Payee%20Add%20Risk/1200_630/blog.jpg",
  "url": "/blog/payee-add-is-the-transaction.html",
  "wordcount": 5200,
  "related": [
    "session-theft-aitm",
    "crypto-withdrawal-authorization",
    "help-desk-mfa-reset-attack"
  ],
  "schema": "Article"
}