Digital Fraud Follows Convenience

Lasha Mazanashvili

TBC Bank

Head of Operational Risk Management

Customers want to open products in an app, transfer money in seconds, apply for a card without visiting a branch and invest from their phones. For banks, this means greater speed, broader reach and less friction. Fraudsters see the same access point, but with a different purpose.

Lasha Mazanashvili, a Risk management expert, does not regard fraud as a new threat. He sees it as an old problem that repeatedly adopts the appearance of the latest technology. This article examines how digital fraud is changing, why real-time monitoring has become an operational necessity for banks and what lessons can be drawn from his experience, from scenario development to managing remote access risks.

Fraudsters evolve alongside banks

In many modern banks, most transactions now take place through digital channels. At that scale, anti-fraud controls either work in real time or become little more than a retrospective analysis of losses.

Payment fraud has evolved through several distinct stages: paper slips, magnetic stripes, online payments, data theft, social engineering and, more recently, AI. At each stage, fraudsters have exploited whatever the financial sector itself has made widely available.

When payments relied on paper, forgery was common. Magnetic stripes created opportunities for skimming and card-data theft. As shopping moved online, phishing and card-not-present fraud grew. When banks strengthened their digital channels, attackers shifted their attention to the customer. Instead of breaking through the door, they began persuading customers to open it themselves.

AI has now added another layer. The methods are already familiar, although increasingly difficult to detect: personalised phishing emails, fabricated documents and images, cloned voices, synthetic video and convincing fraudulent calls. Fraudsters may not yet be using the full potential of AI, but they have clearly started.

For banks, this changes the value of time. An attack that once required weeks of preparation can now be developed and scaled far more quickly. Customers no longer receive only a clumsy message supposedly sent by the security department. They may receive a communication that appears personal and credible. Instead of an awkward call filled with errors, they hear a familiar or authoritative voice. Instead of a vague story, they are shown a screen, an image or a fabricated result that appears real.

The damage extends beyond the money taken from an account. Fraud affects customers’ sense of security, their trust in the app and the bank’s reputation as a safe place to keep their money. That trust can be lost far more quickly than it can be rebuilt.

Banks cannot block everything that looks suspicious

After the COVID-19 pandemic, banks saw a sharp rise in attempted fraud and confirmed cases. This has strengthened the case for real-time fraud monitoring.

The hardest part is teaching the system not to obstruct legitimate customers. A bank cannot simply block every transaction that appears unusual. If it does, customers will eventually leave.

The bank must find a workable balance between two costly outcomes: allowing a fraudulent transaction to proceed and stopping a legitimate one. The first creates a direct financial loss. The second consumes the customer’s time, increases pressure on support teams, causes frustration and may lead the customer to abandon the product.

Anti-fraud monitoring looks beyond the payment

A modern anti-fraud environment usually draws on two broad groups of information.

The first covers the device and session: the network, IP address, device characteristics and behavioural signals from the digital channel. The second covers banking and financial data. Together, these inputs create a customer profile against which the transaction can be assessed. The system can then approve the activity, refer it for review or block it.

Put simply, the bank looks at more than the fact that a customer is transferring money. It asks whether the activity resembles that customer’s usual behaviour. Which device are they using? How is the session developing? What technical signals accompany the action? How far does the transaction depart from the customer’s normal profile?

For specialists, the challenge is more demanding: does the system have enough information to make a sound decision within seconds, and is the model generating too many false positives? In a stream of 50 transactions a second, even a modest error rate can quickly create an investigation queue and frustrate large numbers of customers.

Every new product can become a new fraud scenario

One particularly instructive example involved an investment platform within a digital banking service. Soon after its launch, fraudsters began incorporating it into their scripts. They offered customers supposed investment opportunities and used visible activity on the platform to create the impression that real money was being invested and returns were being generated.

This is an uncomfortable reality for product teams. A new service can be useful, popular and technically sound while also giving fraudsters a credible new story to tell customers.

Remote access applications created a second problem. At the time, the bank’s existing systems could not reliably detect such applications on customers’ devices. The customer might appear to be performing each action personally, while another person effectively controlled or viewed the device.

At this point, the fraud risk extends beyond the bank’s own perimeter. What matters is what is happening on the customer’s phone at the moment the transaction is made.

The solution required more than internal technical development. To gain access to the relevant device signals, the bank had to engage with Google and explain what information was needed, why it was necessary and how it would be used. This process included preparing a short video setting out the case. Once approval had been secured, the bank was able to monitor the relevant indicators.

The resulting solution interrupts screen sharing when the banking app is opened if the customer is sharing the screen or the device is being accessed remotely. Development took less than one quarter, and the control remains in use.

There is no universal answer in this example. It does, however, illustrate an important point: some fraud risks sit outside the product itself.

They may lie in a third-party application, in the customer’s tendency to trust what appears on a screen, in a platform rule that prevents the bank from accessing a useful signal, or in the delay between a product launch and the anti-fraud team’s response.

AI needs governance, not just models

Banks may soon find themselves in an environment where AI is used to fight AI, with defensive models competing against tools developed by fraudsters.

This is not simply a question of deploying more advanced models. It also requires AI governance: clear rules for how artificial intelligence is used, monitored and controlled, and who remains accountable for its decisions.

Governance may sound less exciting than self-learning fraud detection, but it is much closer to the reality of running a bank. A model can help identify risk. Without proper oversight, however, AI can itself become a source of operational risk.

AI in anti-fraud is not a button marked “detect fraudster”. It is another system that must be integrated into processes, controls, reporting and decision-making. The more responsibility a company gives to its models, the more costly weak governance becomes.

What banks should examine honestly

Start with the time between suspicious activity and the bank’s response. If the answer is measured in hours or days, the system is better suited to investigating fraud than preventing losses.

The next question is what the system can actually see. Does it assess only the amount, beneficiary and channel? Or does it also consider the device, session, technical indicators and deviations from the customer’s usual behaviour? In digital fraud, limited data creates dangerous blind spots.

False positives also need to be treated as a cost, not merely a technical metric. Every unnecessary block may result in a call to customer support, a failed transaction and an irritated customer. Yet every missed case creates a direct loss and damages trust. The balance between the two cannot be set once and left unchanged.

The customer’s device deserves particular attention. It may be convenient for a bank to assume that its responsibility ends at the boundary of its own application. Fraudsters do not recognise that boundary. They work with the phone, the screen, the customer’s voice, trust, fatigue and sense of urgency.

The final question concerns product development. When a bank launches a new digital service, who is thinking about how a fraudster might use it against the customer, rather than focusing only on conversion?

If no person or process has been given that responsibility, the first fraud scenario will be designed by somebody outside the bank.