Fraud Prevention Insights

Subscription fraud is often invisible - but its impact is significant. Fake free trials and recurring payment abuse rarely appear fraudulent at the start. They typically mimic legitimate user behavior, making detection challenging. Common fraud patterns in subscription businesses • Multiple accounts created by the same user • Use of temporary emails and shared or stolen cards • Abnormal usage during trial periods • Intentional chargebacks after extensive consumption Business impact • Revenue leakage • Increased chargeback ratios • Payment gateway penalties • Distorted growth and retention metrics • Higher customer acquisition costs How fraud is detected effectively • Device and IP intelligence • Behavioral signal analysis • Payment reuse and failure patterns • Usage anomalies during trials and renewals Prevention strategies that scale • Limit free trials per device and payment method • Apply step-up verification for high-risk users • Monitor usage prior to renewals • Block bots and high-risk IP ranges • Leverage AI models to identify evolving fraud patterns Outcomes of a strong fraud strategy • Reduced fake users • Lower chargebacks • Accurate business metrics • Protected recurring revenue • Improved trust with genuine customers Fraud prevention is not friction. It is a safeguard for legitimate users and sustainable growth.

Financial crime compliance (FCC) remains a critical priority for financial institutions, requiring robust controls, governance, and regulatory alignment. The Financial Crime Guide (FCG) 2025, published by the UK Financial Conduct Authority (FCA), offers a comprehensive framework for firms to strengthen their financial crime risk management, covering money laundering, fraud, bribery, sanctions, insider trading, and market manipulation. Key Takeaways ✅ Governance and Senior Management Responsibility • Firms must establish a clear governance structure where senior management actively oversees financial crime risks. • Boards and risk committees should regularly review financial crime reports and escalate key concerns. • Financial crime risk must be integrated into corporate risk management, with dedicated MLROs ensuring compliance. ✅ Risk-Based Approach & Compliance Framework • Firms must continuously assess their exposure to financial crime risks across products, services, customers, and jurisdictions. • A proactive risk assessment model should be in place, using data-driven insights and regulatory intelligence. • EDD is required for high-risk entities, such as PEPs and businesses in high-risk sectors. ✅ Money Laundering & Terrorist Financing Controls • Real-time transaction monitoring must detect unusual patterns, particularly in cross-border payments and digital assets. • Strong KYC and CDD processes are required to UBO. • Firms should leverage AI-driven AML analytics to track complex laundering networks and illicit flows. ✅ Fraud Prevention & Data Security • Firms must strengthen internal controls to detect fraudulent transactions and mitigate risks from synthetic identity fraud and cybercrime. • Cybersecurity measures should align with the NCSC, GDPR, and UK ICO guidelines to prevent data breaches and financial fraud. • A zero-trust security model is encouraged, with continuous monitoring of internal and external fraud risks. ✅ Sanctions, Asset Freezes & Proliferation Financing • With evolving geopolitical risks, financial institutions must align their sanction screening tools with FATF, OFSI, and EU sanction lists. • Compliance teams must detect and prevent trade-based money laundering (TBML) and ensure crypto asset compliance against sanctions circumvention tactics. • Third-country correspondent banking relationships must undergo stringent due diligence and ongoing risk monitoring. Strategic Actions for Compliance Leaders 🔹 Automate financial crime controls—AI-driven compliance tools improve fraud detection, sanctions screening, and transaction monitoring. 🔹 Enhance regulatory engagement—proactive collaboration with FCA, FATF, and JMLSG ensures alignment with evolving compliance expectations. 🔹 Integrate cybersecurity and financial crime risk strategies—given the rise in cyber-enabled financial crime, firms must merge cyber risk governance with FCC protocols. #FinancialCrime #Compliance #AML #Sanctions #CyberRisk

In an ideal world, every card transaction follows a stepped, secure flow: ◾a card is presented ◾the authorisation is requested in real time ◾and once approved, the transaction is completed and settled. But... in reality payments 𝘥𝘰𝘯'𝘵 always follow this script (of course!). There are scenarios (i.e. sometimes technical, sometimes operational), where a merchant ends up submitting a transaction for settlement 𝘸𝘪𝘵𝘩𝘰𝘶𝘵 𝘦𝘷𝘦𝘳 receiving an auth approval. The logic behind it isn’t always flawed. There are indeed reasons why a merchant might force post a transaction: ⚪ 𝐎𝐟𝐟𝐥𝐢𝐧𝐞 𝐨𝐫 𝐟𝐚𝐥𝐥𝐛𝐚𝐜𝐤 𝐦𝐨𝐝𝐞: The terminal goes offline or an issuer doesn’t respond in time, but the merchant decides to proceed with the transaction, often manually entering a generic approval code. ⚪ 𝐇𝐨𝐭𝐞𝐥𝐬, 𝐭𝐫𝐚𝐯𝐞𝐥, 𝐫𝐞𝐧𝐭𝐚𝐥𝐬: A pre-authorisation is taken at check-in or vehicle handover. Later, when the final amount is charged, the original authorisation has expired or doesn't match, yet a new auth isn't obtained. ⚪ 𝐌𝐎𝐓𝐎 𝐚𝐧𝐝 𝐦𝐚𝐧𝐮𝐚𝐥 𝐨𝐫𝐝𝐞𝐫𝐬: Telephone and mail orders sometimes involve legacy systems or manual entry that bypass authorisation steps. ⚪ 𝐒𝐮𝐛𝐬𝐜𝐫𝐢𝐩𝐭𝐢𝐨𝐧 𝐛𝐢𝐥𝐥𝐢𝐧𝐠: A recurring payment system may try charging an expired or declined card, and force the transaction through when retries fail. ⚠️ Why It’s a Problem While some of these scenarios may seem justified from a customer service or operations perspective, a force post naturally introduces major risks into the transaction lifecycle because these transactions bypass the standard issuer validation. As a result: ❌ Fraud risk increases because there’s no issuer-side validation. ❌Chargeback exposure spikes, as the issuer can reject liability due to invalid auth data. ❌ Data integrity takes a hit, making it harder to verify and reconcile transaction records. ❌And on top of that there are now scheme fees levied to discourage this practice and encourage a shift toward real-time authorisation in most cases possible. These may seem like minor occurences because they are often buried in complex statements and broad fee categories, they actually quietly erode the margin that’s critical for any business bottom line. #paymentexperts, any perspectives to share on the #authorisations frameworks? --- 𝑾𝒐𝒏𝒅𝒆𝒓 𝒘𝒉𝒐 𝒘𝒆 𝒂𝒓𝒆? 𝘞𝘦 𝘢𝘳𝘦 𝘢 𝘵𝘦𝘢𝘮 𝘰𝘧 𝘗𝘢𝘺𝘮𝘦𝘯𝘵𝘴 𝘚𝘵𝘳𝘢𝘵𝘦𝘨𝘪𝘴𝘵𝘴 𝘣𝘭𝘦𝘯𝘥𝘪𝘯𝘨 𝘰𝘶𝘳 𝘪𝘯𝘥𝘶𝘴𝘵𝘳𝘺 𝘦𝘹𝘱𝘦𝘳𝘵𝘪𝘴𝘦 𝘸𝘪𝘵𝘩 𝘢 𝘤𝘳𝘦𝘢𝘵𝘪𝘷𝘦 𝘢𝘱𝘱𝘳𝘰𝘢𝘤𝘩 𝘵𝘰 𝘢𝘴𝘴𝘪𝘴𝘵 𝘰𝘶𝘳 𝘤𝘭𝘪𝘦𝘯𝘵𝘴 𝘵𝘩𝘳𝘰𝘶𝘨𝘩 𝘊𝘰𝘯𝘴𝘶𝘭𝘵𝘪𝘯𝘨, 𝘚𝘵𝘳𝘢𝘵𝘦𝘨𝘺, 𝘙𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘢𝘯𝘥 𝘛𝘩𝘰𝘶𝘨𝘩𝘵 𝘓𝘦𝘢𝘥𝘦𝘳𝘴𝘩𝘪𝘱 𝘱𝘳𝘰𝘫𝘦𝘤𝘵𝘴. 🔘 Need help with your payment or product strategy? Let's talk: intro@paypr.work 🔘 Looking for Payments learning resources, check out our unique hub: https://lnkd.in/dVXjGkz 🔘 Follow Paypr.work [ˈpeɪpəwəːk] for more weekly #paymentinsights #paymentinfographics

🚨 🆕Peer-reviewed journal article — just published in the Journal of Financial Regulation Retail payment fraud is rising and current liability rules are misaligned with where fraud actually originates. This paper is particularly timely as negotiations on the PSR approach the endgame. 1️⃣Diagnosis ➡️Fraud has become a structural problem that no longer sits solely within PSPs: it flows through a fragmented digital ecosystem (platforms, telecoms, intermediaries, technical service providers) ➡️Authorised push payment (APP) fraud is rapidly growing ➡️There is a mismatch between where fraud happens and where liability sits (PSPs) and a lack of adequate institutional cross-sector cooperation platforms 2️⃣International benchmarks 🇸🇬Singapore: a cascading liability model (Shared Responsibility Framework) that can shift liability between banks and telecoms depending on where the preventive failure occurred (only scoped to phishing) 🇬🇧United Kingdom: mandatory reimbursement for APP fraud, rapid redress for users — but non-financial actors remain outside the liability perimeter 🇦🇺Australia: a prevention-first framework imposing obligations across banks, telecoms and platforms — without mandated reimbursement or liability apportionment. 3️⃣EU implications (PSR) ➡️The PSR proposal advances a four-pillar approach: user awareness; clearer basis for fraud-data processing under GDPR; a reimbursement right for impersonation-based fraud; and calls for telecom cooperation ➡️The Parliament goes a step further: a limited right of recourse against platforms/ECSPs when they fail to remove fraudulent content after notification. Still, the scope remains narrow, with operational uncertainties (proof, timing, enforcement). 4️⃣Policy recommendations ➡️Align fraud prevention and liability: users should be reimbursed swiftly — especially in deception-based fraud — but the cost should not fall solely on PSPs; it should extend to actors whose inaction enabled the fraud, with clear deadlines, procedures and effective redress. Where the user has committed gross negligence, the loss should remain with them ➡️Create an institutionalised, cross-sector EU platform for fraud-intelligence sharing (PSPs, telecoms, digital platforms, cybersecurity agencies, law enforcement and regulators) with a legal mandate and enforceable data-sharing duties ➡️Make fraud-data exchange mandatory among PSPs (with legal clarity under GDPR) and structure cooperation with telecoms/platforms at national level for early-warning signals ➡️Empower coordinated supervision (EBA, national competent authorities and data-protection regulators) for joint actions, coordinated alerts and monitoring of the shared-responsibility principle Link: https://lnkd.in/dTvt2Fc4 Though the paper is not open access, feel free to contact me bilaterally and I’ll be happy to share it!

This is the RiskShield bay at Cashfree Payments, where the team hunts for new fraud patterns before they scale. And they have found something interesting. Well under 0.1% of transaction volume, concentrated in a narrow set of niche UPI handles and card BINs, accounts for 80-90% of the fraud we see. The fraud rings on these handles follow a consistent pattern. They never open with their largest transaction. They start at Rs. 200-Rs. 2000, to see if a merchant’s fraud detection reacts. If it doesn’t, the same handle scales to Rs. 50,000, and in the worst case we have tracked, to Rs. 2.5 lakh, after weeks of testing. To a merchant, these look like regular transactions. RiskShield catches this at the testing stage, in three ways: 1. It sees the same ring across merchants. So,a pattern flagged on one is blocked on the next 2. Its rule engine tracks value within a time window and blocks a handle the moment it crosses a threshold under 50 milliseconds, before authorisation 3. Its device intelligence and behavioural biometrics flag how a transaction is made, not just how much, catching what doesn’t match a genuine customer In the last year, RiskShield blocked over 1.3 million fraudulent transactions, preventing $428.95 million in fraud. I've written more about this, and how merchants can protect themselves, in an article for ET Hindi, link in the comments. Checkout RiskShield if fraud is a problem you want to solve for your business.

Let’s take a moment to address a serious issue that affects many customers: credit card scams. With the rise of digital transactions, it’s more important than ever to stay vigilant and informed. As a technology leader at Chase, I wanted to share a few tips to help you safeguard your financial information: 1. Monitor Your Accounts: Regularly check your bank and credit card statements for any unauthorized transactions. Report any suspicious activity immediately. 2. Utilize Chase's Credit Journey ID Monitoring: Take advantage of our Credit Journey service, which provides free credit monitoring and alerts calling out changes to your credit report. Anyone can use this free tool can help you spot potential fraud early. You don’t have to be a Chase customer. 3. Beware of Phishing Scams: Be cautious of unsolicited emails, texts or phone calls asking for personal information. Always verify the source before sharing any sensitive data. 4. Use Strong Passwords: Create complex passwords for your online accounts and change them regularly. Consider using a password manager to keep track of them securely. 5. Enable Two-Factor Authentication: Adding an extra layer of security can significantly reduce the risk of fraud. Whenever possible, enable two-factor authentication on your financial accounts. 6. Stay Informed: Educate yourself about the latest scams and tactics used by fraudsters. Knowledge is one of the best defenses against becoming a victim. At Chase, we are committed to keeping your information safe and secure. Our advanced security measures help protect your accounts, but your vigilance is crucial. Together, we can combat credit card fraud and keep our communities safe. Check out this recent post to learn more about steps you can take if you suspect your identity has been stolen. Stay alert and protect your financial well-being! #FraudPrevention #SecurityFirst #CreditJourney

Scam victims suffer more than financial loss. There’s also the sense of being violated and potential emotional trauma. MP Pei Ling Tin likened scammers to cockroaches - agile, deft at camouflage and hard to eradicate. As for how we fight scammers, I think of similar efforts - our firefighters. In Parliament today, I spoke about our strategy to tackle scams: 1) Containment by strengthening our anti-scam capabilities, for example the Anti-Scam Command under the Singapore Police Force which facilitates swift tracing of funds and freezing of scammed bank accounts. 2) Prevention by closing off avenues for scammers to reach potential victims. Last year, we implemented the mandatory SMS Sender ID registration for organisations which use SMS as a channel of communication. Within the first three months of its implementation, SMS scam cases fell by 70%. But fighting scams is a team effort. The Government cannot do it alone. We will need to continue exploring novel ways to combat scams and working with partners such as banks and telcos. I also announced three new measures. First, a recommended Safe App Standard for app developers to check if the high-risk monetary transactions performed on their apps are secure, as apps are becoming a common channel for online transactions. Telcos will also be given advisory guidelines to help them identify and protect vulnerable customers who may be tricked into performing certain transactions. To tackle the issue of new and evolving scams, we will set up a Centre for Advanced Technologies in Online Safety to bring together a community of experts to build capabilities for a safer Internet. Such capabilities may include measures to detect harmful content such as deepfakes, and trace the origin of digital content. More details on these measures will be announced soon. I would like to thank our GPC members - Ms Pei Ling Tin, Mr Sharael Taha, Ms Hany Soh, Ms Jessica Tan, and Mr Alex Yam for speaking today and pledging their commitment towards building an inclusive and safe digital society. - Jo Teo

Key Findings from the 2025 State of #Fraud Report 🔸 Rising Fraud Incidents Across All Sectors: 60% of financial institutions and #fintechs reported an increase in fraud events targeting #consumer and business accounts in 2024. Fraud was predominantly digital, with 80% of events occurring on #online or #mobilebanking channels 🔸 Key Fraud Types: Credit card fraud, identity theft, and account takeover (ATO) #fraud were the most common types of fraud reported. 20% of enterprise #banks ranked check fraud as their most frequent fraud type. 🔸 Financial and Reputational Costs: 31% of organizations experienced fraud losses exceeding $1M in 2024. 73% ranked #reputational damage as the most severe consequence of fraud, followed closely by direct financial losses (72%) and loss of clients (72%). 🔸 Role of Organized Crime: 71% of fraud attempts were attributed to financial #criminals or fraud rings, marking a shift from first-party to third-party fraud. 🔸 Fraud #Detection and Prevention: 56% of financial organizations most commonly detected fraud at the transaction stage, while 33% identified it during onboarding. Real-time interdiction was conducted by only 47% of respondents, highlighting a gap in immediate fraud prevention. 🔸 Fraud Detection Trends: Inconsistent user #behavior (28%) and mismatched personal data (20%) were leading indicators of fraud attempts. Mid-market banks reported the highest incidence of fraud, with 56% facing over 1,000 fraud cases. 🔸 AI and Technology Adoption: 99% of organizations reported using AI in fraud prevention, with 93% agreeing that machine learning and #generativeAI will revolutionize detection capabilities. #AI was predominantly used for anomaly detection (59%) and explaining large datasets for #risk analysis (67%). 🔸 Fraud Prevention Investments: 93% of respondents indicated ongoing #investments in fraud prevention, with identity risk solutions being the most impactful (34%). Top technologies for 2025 include identity risk solutions (64%), document #verification software (49%), and voice/facial recognition systems (38%). 🔸 Regulatory Impact: 62% of organizations plan to increase fraud prevention investments in response to #regulatory scrutiny and potential #reimbursement requirements for fraud losses. Predictions for 2025: 🔆 Fraud will continue to rise, driven by increased availability of consumer data on the #darkweb 🔆 Financial institutions are expected to adopt #centralized platforms for fraud and identity risk management to enhance efficiency and reduce losses 🔆 Advanced AI tools and real-time #payments systems will remain key focus areas for fraud mitigation strategies. These findings emphasize the need for a multi-layered approach to fraud prevention, prioritizing identity verification, AI-driven analytics, and real-time interdiction

Australians lost an estimated $2.74 billion to scams in the last year alone. 🚨 Yesterday, Stephen Jones, Assistant Treasurer and Minister for Financial Services spoke at the National Press Club of Australia. Here are some takeaways: 1️⃣ The federal government is developing legislation to crack down on scammers, focusing on digital currency exchanges, superannuation funds, and online marketplaces. 🔒💻 2️⃣ With AI advancements, deepfakes are becoming a real concern. The government acknowledges this and is preparing for these emerging threats. 🤖🎭 3️⃣ A code of conduct is being established to hold companies, including banks, liable for compensation if they fail to meet their obligations to prevent scam activity. 🏦💰 4️⃣ The government is leading a national effort, emphasising prevention and in-country responses. International cooperation is crucial, but domestic actions are paramount. 🤝🔍 5️⃣ Banks will be obligated to prevent criminals from setting up accounts that facilitate scams and to refund scam victims. The current law is deemed not fit for purpose, and changes are underway to ensure banks meet these obligations. 🏦🚫 6️⃣ The new system will set clear obligations for banks, social media platforms, and telcos, recognising that scammers operate within an ecosystem. Failure to meet these obligations will result in liability for compensation. 🌐🔗 • Banks must take action on mule accounts and report suspicious activities to the National Anti-Scam Centre. Failure to do so will result in liability. 🏦🚫 • Social media platforms will be required to implement measures to prevent the spread of scam content and to cooperate with authorities in identifying and shutting down scam operations. 📱🚫 • Telcos must enhance their systems to detect and block scam calls and messages, ensuring that consumers are protected from these threats. 📞🚫 • The system will promote collaboration among these sectors to share intelligence and best practices, creating a unified front against scammers. 🤝🔍 7️⃣ These protections, including a pay confirmation scheme, are slated to come into effect by the end of 2025. While the delay is noted, the government is committed to addressing the $3 billion annual loss to scammers. 📅🔒 This is an ongoing conversation. It requires a whole community approach to stay one step ahead of the scammers. __ PS: What else can financial services do to protect its customers from scams and ensure their money stays safe? 💭 Reshare to educate your network ♻️ Follow me for more ✚

Fraud no longer hides in the shadows. It might show up disguised as someone you know. Like when the CEO calls and her voice on the phone sounds exactly right. Her urgency feels real, and the wire transfer request to a new bank account seems legitimate, so accounting releases the funds. And just like that, the company loses $20k to a fraudster who weaponized AI. This isn't science fiction. It's happening right now to individuals and organizations alike. Fraudsters are creating disturbingly real AI deepfakes that can fool even the most cautious people. And companies need strategies to combat them. Because those audio and visual cues we've relied on for decades are no longer reliable indicators of authenticity when it comes to AI deepfakes. Organizations can fight back with these defense strategies: ✔ Stay cautious and be wary of anyone requesting money or personal information, even if they look or sound like someone you trust. ✔ Don’t send money or share sensitive data in response to a single phone or video call. Phone numbers can be spoofed, so always verify a person’s identity by contacting them separately at a number you trust. ✔ Use small action requests, like asking a person to turn their head, blink repeatedly, or hum a song while on a video or phone call. If they decline, freeze up, or go silent, it could be a fraudster. ✔ Establish a safe word that only your inner circle knows to confirm the identity of someone claiming to be a colleague, family member, or friend.   ✔ Use strong passwords. Enable multifactor authentication (MFA) on all company devices and accounts whenever possible. And don’t forget to report AI deepfakes to law enforcement and any relevant social media channels, websites, and other platforms where the encounter took place. All of these tips ALSO work for individuals too because hackers like causing havoc with anyone they can. The question isn't whether AI deepfakes will target your organization. It's whether your organization will be ready when it does.   Food for thought as we kick off Cybersecurity Awareness Month.   ♻ Share our infographic to help companies combat AI deepfakes.