Barbados Built BiMPay to Bank the Unbanked. Scammers Were Wearing Its Logo Before the First Month Was Out

Paul Cézanne, The Card Players, 1890–92. The Metropolitan Museum of Art, public domain.

Barbados spent years building BiMPay, its first instant, interoperable national payment system. It went live on June 12, 2026, after the Central Bank moved the date back once. Twenty-five days later, on July 7, the same Central Bank warned that fraudsters were calling people over WhatsApp, showing the Bank's logo on the call screen and claiming to represent BiMPay.

I do not think the Central Bank did anything wrong by launching when it did. By regional standards this has been one of the better-run fintech roll-outs in CARICOM. The warning matters because every Caribbean country now building a similar rail will face its own version of those 25 days. The Caribbean AI Risk Management Council (CAIRMC), which I chair, has spent two years asking central banks whether their fraud controls will be ready on launch day.

What BiMPay is and how it performed in its first month

BiMPay has two parts under one name:

• A payment rail. It replaces Barbados's old automated clearing house with a system that runs continuously and settles transfers between institutions in seconds.
• A digital wallet. People can download it to send money to a friend, pay a bill or buy groceries without opening a bank account.

Six commercial banks, the three largest credit unions, the Accountant General and the Barbados Stock Exchange are connected. When the Central Bank unveiled the system in April, it said the aim was to reach people the banking system has never served.

Adalbert John Volck, Counterfeit Confederate Notes Publicly Offered for Sale in the "City of Brotherly Love" (from Confederate War Etchings), 1861–63. The Metropolitan Museum of Art, public domain.

By July 13, Governor Dr. Kevin Greenidge said the system had processed 750,000 transactions worth 1.3 billion dollars, with settlement in seconds. The problems reported so far sit at individual banks: late salary payments, delayed transfers and wrongly formatted payroll files, which Greenidge said were being fixed institution by institution.

The regional context explains the rush. Hope Research Group values the Caribbean fintech market at 1.2 billion dollars in 2025 and projects 2.8 billion dollars by 2030. Mobile connections exceed 131% of the population, 18.4 billion dollars a year arrives in remittances, and 30 to 40% of people in some Caribbean markets are unbanked or underbanked.

What the Central Bank warned about on July 7

The fraud warning is separate from the payroll problems. The Central Bank said it was aware of WhatsApp calls displaying its logo and claiming a connection to the Bank and BiMPay, and that it does not make unsolicited calls about BiMPay. Its advice to the public:

• Do not share passwords, PINs or security codes with anyone who calls you.
• If you already have, contact your financial institution through its verified channels and change your credentials.
• Report the call to the Barbados Police Service.
• Trust only the Bank's published numbers, its main line and a dedicated BiMPay hotline, and its official websites.

What is confirmed about the scam, and what is not

What is documented is caller ID spoofing and brand impersonation: a foreign number, a borrowed logo and a script claiming authority. That is an old fraud on a new channel. Nobody has confirmed that AI-generated audio was used in these calls.

The concern is what the same approach looks like with voice cloning added. Research cited by McAfee found that three seconds of speech is enough to produce a clone with an 85% voice match. A scammer no longer needs to sound like a central bank. They can sound like a named loan officer at your branch, using audio lifted from a recorded video call.

Ryūryūkyo Shinsai, Pocketbook with Its Fittings, 19th century. The Metropolitan Museum of Art, public domain.

What global fraud data says about the next stage

None of these figures are Caribbean, but they describe the systems the Caribbean is now adopting.

• Deloitte's Center for Financial Services projects US losses from generative AI-enabled fraud rising from 12.3 billion dollars in 2023 to 40 billion dollars by 2027, a 32% compound annual growth rate.
• Capital One Shopping Research, working with AARP, found that 77% of people targeted by an AI voice scam lost money.
• Sift's Digital Trust Index for the second quarter of 2025 found that a third of Americans believed someone had tried to scam them with AI or a deepfake, and 27% of those targeted were defrauded.

In Hong Kong, an employee of the engineering firm Arup transferred about 25 million dollars after a video call with what appeared to be the company's chief financial officer and several colleagues. Every person on the call was a deepfake built from public video and audio. He had checked identities on a video call, which was the recommended step at the time.

Why fast payment rails and new users raise the stakes

Jamaica has JAM-DEX, its central bank digital currency, and the Eastern Caribbean Central Bank has run DCash. All of these share BiMPay's design goals: faster payments, wider reach, more people brought in. Two features make them attractive to fraudsters. Money that settles in ten seconds cannot be recalled the next morning. And a person using a wallet for the first time has no history with a bank's fraud line and may not know what a real call sounds like.

CAIRMC's Caribbean AI Risk Assessment (CARA) reviews AI systems on technical, ethical, legal and societal grounds, aligned with the EU AI Act, GDPR and Caribbean data protection law. Applied to a payment launch, its purpose is timing: the transaction monitoring and impersonation controls should be tested and live before the first customer transaction. A country that can build an instant rail in months can build monitoring alongside it.

The gap this plan does not close

The standard advice to central banks includes asking telecom carriers to block spoofed caller ID. That helps with ordinary phone calls. The Barbados calls came over WhatsApp, which runs over the internet and bypasses the carrier's caller ID system entirely, so a carrier cannot block them. The only parties who can act on those calls are Meta and the public. I have not seen a Caribbean central bank with a working reporting arrangement with Meta, and I think that is the weakest point in the region's defences.

John Keyse Sherwin, Smithfield Sharpers, or the Countryman Defrauded, [April 10, 1787], reissued 1809–16. The Metropolitan Museum of Art, public domain.

What central banks launching an instant payment rail should do

1. Central bank communications team, before launch: publish one hotline, one website and one sentence ("We will never call you about your wallet"), and repeat them in every launch advert, so the public knows the rule before the first scam call.
2. Rail operator: run real-time transaction monitoring that scores each payment inside the ten-second settlement window, with extra checks on first payments to a new recipient and on new wallets sending unusually large amounts.
3. Central bank and participating banks: show the recipient's registered name before the sender confirms a payment, as the UK's Confirmation of Payee does, so a mistyped or fraudulent recipient is caught before money moves.
4. Central bank legal or risk team: set up an escalation route with Meta for impersonation accounts on WhatsApp, and ask telecom carriers to block spoofed domestic numbers on ordinary voice calls.
5. CARICOM central bank governors: agree one shared launch checklist for instant payment fraud controls, so each country does not rebuild the same safeguards from scratch.

"BiMPay's core system worked as designed. Its fraud warning came 25 days after launch. The next country should publish its warning before launch day." - Adrian Dunkley, AI Boss