💻 computer science

Modeling Trust and Liquidity Under Payment System Stress: A Multi-Agent Approach

This paper presents a multi-agent model demonstrating that operational disruptions in retail payments can trigger behavioral hysteresis, causing liquidity stress and withdrawal peaks to persist beyond technical recovery due to trust erosion, rumor propagation, and merchant messaging dynamics.

Original authors: Masoud Amouzgar

Published 2026-02-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Masoud Amouzgar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a bustling city where everyone pays for coffee, groceries, and rent using a digital card system. Suddenly, the system glitches. Some cards work, some get rejected, and some just spin in a "loading" circle forever.

This paper asks a scary question: What happens to people's trust and their money after the system is technically fixed?

The authors, led by Masoud Amouzgar, built a computer simulation (a "digital city") to watch how people behave when their payment system breaks. They found something counterintuitive: The most dangerous moment isn't when the system is broken; it's often when it's just starting to get fixed.

Here is the story of the paper, explained through simple analogies.

1. The "Digital City" and the Glitch

Imagine a city where everyone uses a magical card to buy things. One day, the magic wand (the payment system) starts acting up.

The Glitch: Some cards work, some fail, and some just hang there.
The Reaction: People get frustrated. They start avoiding the card. They might switch to cash or just stop buying things.
The Panic: If enough people get scared, they might decide, "I'm not keeping my money in this bank anymore!" and rush to withdraw it all at once. This is called a "run on the bank."

2. The Three Ingredients of Panic

The researchers found that panic doesn't happen just because the system is broken. It happens because of three specific "ingredients" mixing together:

The "Scar" (Bad Memories): Imagine you get burned by a hot stove. Even after the stove cools down, you are still scared to touch it. In the model, every time a card fails, people get a "scar." These scars don't disappear instantly when the system is fixed; they fade slowly.
The "Rumor" (The Grapevine): People talk. If your neighbor says, "My card didn't work," you get worried, even if yours did. The model uses a "small-world network" (like a neighborhood where everyone knows a few friends, but news travels fast). If enough neighbors are avoiding the card, you start avoiding it too.
The "Signs" (Merchant Messages): This is the secret sauce. Imagine a coffee shop. Even if the card machine is fixed, the cashier might still have a sticky note on the counter saying, "Cash Only, Card Machine Broken." Or they might just look nervous. The model calls this "Sticky Broadcasts." The signs and the nervous behavior of shopkeepers take much longer to fix than the actual machine.

3. The Big Surprise: The "Delayed Peak"

Here is the most important finding, which the authors call the "Delayed Peak."

Old Thinking: We think the worst panic happens when the system is at its absolute worst (the "nadir").
New Finding: The model shows that the biggest rush to withdraw money often happens after the system is technically working again.

Why? The "Recovery Trap" Analogy:
Imagine a fire alarm goes off in a building.

The Fire (The Outage): The alarm is blaring, smoke is everywhere. Everyone is confused but still inside.
The Fix (Technical Recovery): The fire is put out. The smoke clears. The alarm stops.
The Panic (Behavioral Lag): But the signs on the doors still say "EVACUATE." The security guard is still shouting "RUN!" and your neighbor is sprinting for the exit.

Even though the fire is gone, the perception of danger is still high. People start running out the door after the fire is out because the signs and the panic haven't caught up yet.

In the paper's model, this means that liquidity stress (people pulling money out) peaks during the recovery phase, not the outage phase.

4. The "Instant Transfer" Trap

The paper also tested a solution: What if people could instantly switch to a different payment method (like an instant bank transfer) when their card fails?

The Good News: It stops the immediate panic. People feel like they have a backup plan, so they don't freak out as much at the very top of the crisis.
The Bad News: It doesn't necessarily stop them from pulling all their money out later.
- Analogy: Giving people a lifeboat during a storm stops them from jumping overboard immediately. But if the ship still looks like it's sinking (because the signs say "SINKING" and the crew looks terrified), they might still decide to jump later, even if the ship is technically floating again.

5. What Should Banks and Governments Do?

The paper concludes that fixing the technology is only half the battle. If you fix the servers but leave the "signs" up and the "nervousness" in the air, you are still in danger.

The "Post-Recovery" Checklist:

Don't just say "It's Fixed": You have to actively tell people, "The fire is out, the signs are down, and we are safe."
Fix the Signs: Merchants (shops) need to take down the "Cash Only" signs immediately. If the cashier looks calm, the customer will feel calm.
Watch the "Scar": Understand that trust takes longer to rebuild than a server takes to reboot.

Summary

This paper is a warning: Technical recovery $\neq$ Behavioral recovery.

Just because the lights are back on doesn't mean the crowd has stopped running. The most dangerous time for a payment system is often the quiet moment right after the chaos, when the technology is working, but the memory of the failure and the nervousness of the crowd are still at their peak. To prevent a financial panic, you have to fix the people's feelings just as hard as you fix the machines.

1. Problem Statement

Modern payment systems face a critical vulnerability: operational disruptions do not necessarily imply immediate behavioral recovery. While technical infrastructure may be restored quickly (e.g., card authorization systems come back online), customer trust and merchant signaling often lag significantly. This disconnect can trigger delayed liquidity outflows (bank runs) even after the technical "nadir" (worst point) of an outage has passed.

The paper addresses the gap in existing literature, which typically treats payment outages as exogenous technical events or models bank runs based solely on balance-sheet concerns. It fails to capture how micro-level payment experiences (failures, timeouts), merchant signaling (sticky "cash only" signs), and social contagion interact to create macro-level liquidity stress.

2. Methodology: Multi-Agent System (MAS)

The authors propose a discrete-time, agent-based computational model embedded in a Watts–Strogatz small-world network to simulate the interaction between heterogeneous agents.

Key Agents and Components:

Customers ( $N$ agents):
- State Variables: Trust ( $T_i$ ), Accumulated Negative Experience/Scar ( $C_i$ ), Perceived Systemic Risk/Rumor ( $R_i$ ), Behavioral Mode ( $S_i \in \{OK, FRUSTRATED, AVOIDING\}$ ), and Balance ( $B_i$ ).
- Dynamics: Customers update their internal states based on:
  1. Direct Experience: Payment outcomes (Success, Failure, Unknown/Timeout).
  2. Merchant Signals: Broadcast states (Accepting, Degraded, Fallback) from habitual merchants.
  3. Social Influence: The fraction of neighbors in the "Avoiding" state.
- Memory: Bounded memory processes ensure that negative experiences (scars) and rumors decay slowly, creating hysteresis.
- Decision Rule: Withdrawals are threshold-gated. A customer only withdraws if they are in "Avoiding" mode and their Scar and Rumor variables exceed specific thresholds.
Merchants ( $M$ agents):
- Maintain an Operational State (internal assessment of success rates) and a Broadcast State (external messaging like signage).
- Stickiness Mechanism: Broadcast states exhibit "persistence." Even if the operational state recovers, the broadcast state (e.g., "Cash Only") remains degraded for a dwell time, acting as a delayed signal to customers.
Payment Infrastructure:
- Modeled as an exogenous stochastic process defining probabilities of success, failure, and unknown outcomes over time. It simulates an outage onset, degradation, and recovery but does not adapt to agent behavior.

Core Mechanisms:

Bounded Memory & Hysteresis: Trust and risk perception do not reset instantly upon technical recovery; they depend on the accumulation and slow decay of past negative signals.
Threshold-Gated Runs: Liquidity outflows are not immediate reactions to failures but emerge only after a "phase transition" where accumulated stress crosses individual thresholds.
Merchant Broadcast Persistence: A structural amplifier where delayed merchant messaging sustains perceived risk even after technical fixes.

3. Key Contributions

Unified Framework: Integrates payment reliability, behavioral memory, merchant signaling, and social contagion into a single computational model, bridging operational risk and bank run theory.
Theoretical Proof (Delayed Peak Theorem): The authors prove that under mild assumptions (bounded memory, threshold gating, and sticky merchant broadcasts), the peak of aggregate withdrawal pressure ( $W(t)$ ) occurs strictly after the technical outage nadir ( $t_{min}$ ).
- Implication: The highest liquidity risk occurs during the recovery phase, not the outage itself.
Analysis of Payment Substitution: Investigates the role of instant transfers as a substitute for card payments.
- Finding: Substitution reduces peak avoidance (panic) by providing successful transaction alternatives but has a non-monotonic effect on cumulative outflows. It keeps customers operationally engaged, allowing them to withdraw funds once behavioral thresholds are eventually crossed.
Operational Insight: Demonstrates that "Status Green" (technical recovery) is not equivalent to risk resolution.

4. Simulation Results

Simulations were run across various outage scenarios and random seeds to validate the theoretical findings.

Behavioral Hysteresis: Customer avoidance and merchant broadcast degradation peak after the technical success probability recovers. Perceived reliability lags significantly behind technical reliability.
Delayed Withdrawal Peak: Aggregate withdrawal outflows ( $W(t)$ ) are negligible during the initial outage but surge during the recovery phase, confirming the Delayed Peak Theorem.
Merchant Broadcast Impact: Removing "broadcast stickiness" (making merchant signs update instantly) significantly reduces cumulative withdrawals, proving that merchant messaging is a primary amplifier of systemic risk.
Substitution Effects:
- Peak Panic: Instant transfer substitution consistently lowers the peak fraction of avoiding customers.
- Cumulative Risk: Substitution does not guarantee a reduction in total liquidity outflows. By preventing customers from disengaging entirely, it preserves their ability to execute withdrawals once the "run" threshold is met.
Robustness: The qualitative behavior (delayed peaks, hysteresis) remains stable across different network topologies and random seeds.

5. Significance and Implications

The paper offers critical insights for central banks, payment system operators, and regulators:

Redefining Incident Response: Incident management cannot end when technical metrics normalize. Response strategies must extend into the post-recovery phase to address behavioral lag.
Communication Strategy: "Silence" or ambiguous messaging during recovery reinforces perceived risk. Effective response requires coordinated merchant messaging (removing "cash only" signs immediately) and transparent post-mortems to accelerate the decay of "rumor" and "scar."
Stress Testing Limitations: Traditional stress tests focusing on transaction volumes or settlement delays may underestimate tail risk. Future frameworks must incorporate behavioral amplification channels (trust erosion, social contagion).
Policy Design: Payment substitution (e.g., instant transfers) is a useful tool for dampening acute panic but is insufficient as a standalone risk control. It must be paired with active rumor management to prevent latent run risks.

In summary, the paper establishes that liquidity stress in digital payment systems is a socio-technical phenomenon, where the timing of behavioral recovery is decoupled from technical recovery, creating a dangerous window of vulnerability immediately following system restoration.