Who Pays for Payment Fraud? Detection and Liability Rules under Strategic Fraudster Adaptation

We develop a dynamic model of payment fraud detection in which fraudsters strategically adapt their methods in response to detection technologies, causing model performance to decay over time. We characterize the socially optimal detection level and show that in competitive markets full liability induces overinvestment: each PSP ignores how its detection effort accelerates fraudster adaptation marketwide, leading to excessive investment relative to the social optimum. When PSPs retrain models to counter decay, competition creates a ratchet effect—detection accelerates decay, increasing retraining frequency beyond the socially optimal level. Optimal liability allocation sets full reimbursement for both sending and receiving PSPs, complemented by a regulatory fee that internalizes the social cost of fraud and eliminates free-riding in detection efforts. Using Reddit discussion data and bot-detection Twitter data, we document strategic adaptation—fraudsters reallocate effort across scam types following detection, and detection performance deteriorates as fraud becomes more sophisticated, independent of overall fraud rates.