For most of the last two decades, fraud prevention in financial services was built around a simple premise: someone other than the customer was trying to move the customer’s money. The controls that grew up around it — authentication, card-not-present rules, velocity checks — were designed to tell the genuine customer from the impostor.
That premise no longer holds. A growing share of losses now comes from payments the genuine customer authorises themselves, having been persuaded, pressured or deceived into making them. At the same time, the identities on the other side of the transaction are increasingly fabricated, and the accounts receiving the money are often run by mules recruited for the purpose. The fraudster has moved from attacking the bank’s controls to attacking the customer’s judgement.
This changes what a fraud function has to be good at. Below we set out how the threat has shifted, what a layered defence looks like when decisions have to be made in seconds, how to govern the models that sit at its centre, and how to organise and measure the work — ending with a practical plan for the first 90 days.
How the threat has shifted
Scams and authorised push payment fraud
Authorised push payment fraud — investment scams, romance scams, purchase scams, impersonation of the bank or the police — defeats strong authentication by design. The customer passes every check because the customer is the one making the payment. Controls that verify who is paying say little about why, and that is now the question that matters.
Account takeover and social engineering at scale
Account takeover persists, but the route in has moved from malware towards manipulation: one-time passcodes talked out of customers, remote-access tools installed on request, SIM swaps arranged with a convincing story. Generative AI has lowered the cost of this further. Voice clones of relatives or executives, and deepfake video on calls, make impersonation more persuasive and harder for staff and customers to challenge.
Synthetic identities, first-party fraud and mule networks
Synthetic identity fraud combines real and invented data into a person who does not exist, then nurtures that identity patiently — small credit lines, on-time repayments — before borrowing heavily and disappearing. Because there is no real victim to complain, it is often written off as credit loss. First-party fraud, from false refund claims to deliberate bust-outs, blurs the same line. And behind most scams sits a mule network: accounts opened or rented to receive and disperse stolen funds, frequently held by young or financially vulnerable people who do not fully understand what they are part of.
Real-time payments compress the decision window
Instant payment schemes — Faster Payments in the UK, SEPA Instant in Europe, RTP and FedNow (launched in July 2023) in the United States — are a real benefit to customers. They also remove the buffer that fraud operations used to rely on. When settlement is final in seconds, there is no overnight batch to review and little prospect of recalling funds once they have hopped through several mule accounts.
The practical consequence is that the decision has to be made before the money moves, using whatever can be scored within the scheme’s latency budget. That pushes institutions towards real-time fraud detection architectures: streaming feature computation, pre-calculated customer and counterparty profiles, and decision engines that can return an answer in milliseconds.
Building a layered defence
No single control catches modern fraud. The aim is a set of signals that are individually imperfect but collectively hard to evade, combined into one risk view per event.
- Device and session intelligence. Device fingerprinting, emulator and remote-access detection, and checks for an active phone call during a banking session all speak directly to account takeover and coached payments.
- Behavioural biometrics. How a user types, swipes and navigates is difficult to imitate. Just as useful, behavioural biometrics can reveal a genuine customer acting under duress — hesitation, unusual navigation, copying a payee’s details from another app — which is the signal most scam detection lacks.
- Network and graph analytics. Mule accounts and synthetic identities reveal themselves through relationships: shared devices, addresses, phone numbers and funds flows. Graph analysis exposes rings that look ordinary account by account.
- Confirmation of payee. Name-checking the beneficiary before payment is now standard in the UK and, under the EU Instant Payments Regulation, verification of payee became mandatory for euro credit transfers in October 2025. It deters misdirection, though it does little against a scam where the customer pays a correctly named account the fraudster controls.
- Consortium and intelligence sharing. The receiving account is often the clearest signal, yet it sits at another institution. Industry data-sharing schemes, and bilateral arrangements where the law allows, let a sending bank learn that a beneficiary has already been reported elsewhere.
Friction applied by risk, not by rule
The layers matter most in how they drive the response. Low-risk payments should flow untouched. Medium-risk payments might receive a specific, contextual warning — one that names the scam type the signals suggest, rather than generic advice. High-risk payments warrant a delay, a call from a trained colleague or a refusal.
Controls that verify who is paying say little about why — and why is now the question that matters.
Machine learning and the discipline of governing it
Supervised models trained on confirmed fraud, supplemented by anomaly detection for patterns not yet labelled, are now the core of most detection stacks. Their performance depends less on algorithm choice than on the discipline around them.
False positives are the first concern. Every alert that turns out to be genuine costs analyst time and customer goodwill, and a model tuned only to catch more fraud will quietly generate more of them. Thresholds should be set with an explicit view of operational capacity and customer impact, not just detection.
Drift is the second. Fraudsters adapt to controls, and customer behaviour changes with seasons, products and channels. Models need monitoring for shifts in input data and in outcomes, with clear triggers for retraining. Label quality deserves equal attention: scam cases confirmed weeks later, and synthetic identities mislabelled as bad debt, both distort what a model learns.
Explainability is the third. Analysts need to know why an event scored highly in order to investigate it efficiently; customers whose payments are stopped deserve a coherent explanation; and model risk frameworks expect institutions to understand and validate what their models do. Reason codes, challenger models and documented validation are the practical tools, and they should be designed in from the start rather than bolted on.
The operating model: fraud and AML convergence
In many institutions fraud and anti-money laundering still run as separate functions, with separate systems, data, case queues and reporting lines. Criminals do not respect the boundary. The mule account that receives a scam payment is both a fraud problem and a money-laundering one, and the same network analytics serve both.
Fraud and AML convergence — often shortened to FRAML — does not have to mean a single merged team. It does mean shared entity resolution, a common view of customer and counterparty risk, and case management that lets an investigator see the fraud alert, the transaction monitoring alert and the customer’s history in one place. It also means clear rules on when a fraud finding triggers a suspicious activity report.
Customer communication as a control
Because scams work by manipulating the customer, the conversation with the customer is itself a control. Warnings written for the specific scenario, staff trained to break the spell a fraudster has cast, and clear communication after a loss all affect outcomes. Treating these as part of the fraud operating model, rather than as a contact-centre afterthought, is one of the most underused levers available.
Regulation and measuring what matters
Regulation is reshaping incentives. In the UK, the Payment Systems Regulator’s mandatory reimbursement regime for APP fraud took effect on 7 October 2024, covering Faster Payments and CHAPS and splitting the cost of reimbursement equally between sending and receiving payment firms. The effect is to make receiving institutions directly accountable for the mule accounts they host. In Europe, PSD2 introduced strong customer authentication, requiring two independent factors for most electronic payments, while allowing exemptions such as transaction risk analysis for firms whose fraud rates stay within defined thresholds — a direct link between detection quality and customer friction.
Against that backdrop, measuring success by fraud losses alone is inadequate. A balanced scorecard should include:
- losses prevented and losses incurred, split by typology, including reimbursement costs;
- false-positive rate and alert-to-case conversion;
- customer friction: payments held, challenges issued and abandonment after warnings;
- time to decision, both for real-time scoring and for cases referred to analysts;
- mule accounts identified and closed, as an inbound measure.
Key takeaways
Fraud has moved from defeating the institution’s controls to manipulating its customers, and real-time payments leave little room to recover from a wrong decision. The response is as much about operating model and measurement as about technology.
- Authentication alone cannot stop authorised push payment fraud; detection must assess the context and intent behind a payment.
- Layered signals — device, behavioural biometrics, graph analytics, payee checks and shared intelligence — are stronger together than any one is alone.
- Apply friction in proportion to risk, and make warnings specific enough that customers act on them.
- Govern models for false positives, drift and explainability from the outset, and invest in label quality.
- Converge fraud and AML data and case management; mule networks are a shared problem.
- Measure friction, false positives and time to decision alongside losses.
