Fraud Detection in Banks and Fintech: Challenges, False Positives, and Mitigation Strategies

Fraud detection is not merely about finding unusual transactions. Banks and fintech companies process massive volumes of transactions with continuously evolving patterns.

Within these transaction flows, fraudulent activity does not always appear in easily recognizable forms. Large-value transactions, device changes, different locations, or increased transaction frequency can indeed be risk signals, but each can also occur in legitimate customer activity.

This is one of the main challenges in fraud detection: distinguishing genuinely risky behavior from normal activity that happens to be unusual.

Overly lenient systems can miss fraud. Conversely, overly sensitive systems can generate too many false positives, increasing investigation workloads and disrupting the user experience of customers conducting legitimate transactions.

This challenge is becoming increasingly important as fraud patterns continue to adapt to the security mechanisms used by financial institutions.

In a joint report by the European Central Bank (ECB) and the European Banking Authority (EBA) on payment fraud in 2025, strong customer authentication (SCA) was still considered effective against the types of fraud it was designed to prevent. However, both also noted an increase in fraud that manipulates users into legitimately authorizing transactions to perpetrators.

This means that implementing fraud detection is not enough simply by adding more and more rules. Banks and fintechs need an approach that can read patterns, consider context, connect various risk signals, and determine which alerts truly require follow-up.

Challenge 1: Fraud Patterns Change, While Rules Tend to Be Static

One common approach in fraud detection is using rule-based detection.

For example, a system can generate an alert when a transaction exceeds a certain amount, is conducted multiple times within a short period, originates from an unusual location, or involves accounts with certain risk characteristics.

But rules still have an important function, known fraud patterns can be translated into rules that provide quick responses when similar conditions reappear.

The problem is, what happens when perpetrators understand these thresholds?

If transactions above a certain amount receive additional scrutiny, funds can be split into a number of smaller transactions. If a particular pattern is already recognized, perpetrators can change timing, intermediary accounts, amounts, or activity patterns to more closely resemble normal user behavior.

Therefore, rules should be viewed as one layer of detection, not the entire fraud detection system.

Techniques such as rule-based analysis, anomaly detection, and other analytical approaches can be used according to the risk characteristics being sought.

Challenge 2: Anomalies Are Not Always Fraud

The ability to find anomalies is highly useful in fraud detection. However, "unusual" and "fraud" are not the same thing.

A customer who has always transacted in small amounts may suddenly make a large-value purchase. A user may transact from a new location while traveling. A business may experience a surge in receipts during a particular sales season.

All of these activities can deviate from historical baselines without involving fraud. This is why false positives are a significant issue.

If thresholds are too sensitive or every deviation is treated as having the same risk level, the system can generate a large number of alerts.

Fraud teams then have to spend time reviewing activity that is actually legitimate, while higher-risk alerts compete for the same attention. Therefore, fraud detection questions should not stop at: "Is this transaction different from usual?"

The system also needs to help answer: "Is there other context that makes this difference relevant as a fraud risk?"

This concept also aligns with the FATF's discussion on the use of technology for AML/CFT. FATF explains that analytical technology can help institutions improve risk identification, reduce false positives, and direct resources to activities more relevant for review.

Challenge 3: Fraud Often Appears as a Pattern, Not a Single Transaction

A single transaction is often insufficient to indicate fraudulent activity.

A transfer of IDR 5 million, for example, does not provide enough information when viewed in isolation. The picture changes when that transaction is one of dozens of similar transfers moving through multiple accounts within a short period.

Fraud detection therefore requires the ability to connect various characteristics, such as:

Analytical value emerges when this information is read as a pattern, not merely a collection of independent transactions.

In this context, fraud analysis is not just about finding the largest transactions or those that exceed thresholds. Analysis needs to examine relationships between activities to uncover patterns that are difficult to see when each transaction is examined separately.

Financial institutions actually have a wealth of information that can potentially assist the detection process. However, this information is not always in the same system or format.

Risk signals can originate from:

The problem is not just how much data is available, but whether relevant information can be connected when a transaction needs to be evaluated.

A change in transaction patterns, for example, may appear less significant when analyzed alone. The risk can change when the same activity is accompanied by device changes, inconsistent identity information, or relationships with accounts that have previously drawn attention.

FATF discusses the benefits of using technology and advanced analytics to process large datasets and identify patterns or relationships that are difficult to identify through traditional processes.

At this point, the process of transforming information from documents into processable data also becomes relevant when documents serve as one of the supporting sources of analytical information.

Challenge 5: Fast Detection Must Still Maintain Precision

In digital payments, speed creates additional challenges. When transactions can be completed in a very short time, organizations have less time to detect suspicious activity before funds move.

However, aggressively increasing system sensitivity can also increase the risk of blocking legitimate user transactions. Fraud detection therefore has two consequences that both need to be considered:

Reducing one without considering the other can create new problems.

The ECB–EBA fraud report shows an example of why a layered approach is needed. SCA is effective in reducing certain types of fraud, but does not eliminate fraud because perpetrators can shift to other modes, including manipulating users into authorizing transactions themselves.

Thus, the effectiveness of fraud detection is not accurately measured solely by the number of alerts generated. Alert quality and the system's ability to prioritize risk should also be part of the evaluation.

No single method can capture all types of fraud. A stronger approach uses multiple mechanisms to address different risk types.

Implementation can include:

Advanced analytics can expand monitoring capabilities, but the quality of results still depends on the data used and how the system is implemented.

FATF explicitly discusses both the opportunities and limitations of new technologies in improving the effectiveness of financial crime identification and mitigation processes, so technology should be positioned as part of a broader control framework.

Models Help Prioritize, Investigators Assess Context

Machine learning and risk scoring systems can help process data volumes that are difficult to examine manually one by one.

Models can be used to find patterns, assign risk scores, rank alerts, or identify relationships with characteristics of previous cases.

However, a risk score is not evidence that fraud has occurred. Activity that is statistically unusual may have a legitimate business reason. Conversely, fraud designed to resemble normal behavior may not produce an extreme anomaly.

Therefore, the function of models is more appropriately viewed as a prioritization layer. The system helps determine which activities warrant further examination, while investigation helps understand the context and available evidence.

In the banking industry, fraud is also related to operational risk management. The Basel Committee defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people, or systems, or from external events.

The Basel Framework also requires banks to have processes to identify, assess, monitor, report, and control or mitigate operational risk.

The Basel Framework even classifies internal fraud and a number of forms of theft and fraud as operational loss event categories, including unauthorized transactions, misappropriation, forgery, credit fraud, and account takeover.

The main challenge of fraud detection in banks and fintech is not just finding transactions that look different. Financial institutions need to determine whether a deviation truly indicates risk, recognize changing patterns, connect signals from various sources, and respond quickly without overwhelming the investigation process with false positives.

Therefore, an effective fraud detection system requires a layered approach. Rules remain useful for known patterns, while anomaly and pattern analysis help identify activity not covered by rules.

Risk scoring helps prioritize examination, while investigators provide context for the signals identified by the system.

At the end, the quality of fraud detection is not determined by how many alerts are successfully generated. Its value lies in the organization's ability to find the most relevant signals, understand their context, and direct investigative resources to risks that genuinely require action.