How AI Is Changing Fraud Prevention and Why Data Still Matters Most

Heamanth Raina

SEB

Global Head of Data Management, Financial Crime Prevention

AI can make fraud detection faster, broader and more precise. It can analyse large volumes of activity, identify unusual behaviour and reveal links between transactions, accounts, devices, Behaviours and individuals that traditional rules may miss. But AI is not a standalone solution. Its effectiveness depends on the quality of the data it uses, whether banks can explain the decisions it supports and how well institutions collaborate across organisational and national boundaries.

Fraud is evolving faster than many traditional control systems can adapt. Financial institutions still rely heavily on rules, historical data, Legacy systems, regulations (such as sharing of information, GDPR etc), processes and built in separate parts of the organisation. Fraudsters face no such constraints. They move quickly across digital channels, adopt new technologies and increasingly use AI themselves. The challenge for banks is therefore not simply to flag a suspicious transaction, but to build the data, governance and information-sharing capabilities that allow AI to detect the wider pattern in time.

Heamanth Raina, Global Head of Data Management for Financial Crime Prevention at X-SEB & MUFG, explains where AI can make a practical difference in fraud prevention, why poor data remains one of the biggest obstacles, and what banks need if they are to detect risk faster without sacrificing control or explainability.

Moving Beyond Rules

The shift underway in fraud prevention is from static rules towards a better understanding of behaviour, relationships and anomalies. Rules remain useful when the scenario is known. The problem is that many of today’s fraud schemes do not stay unchanged for long. Criminals move between digital channels, use social engineering, manipulate devices, create false identities and route money through chains of accounts.

This is where AI can add something that conventional monitoring often cannot. Instead of looking at a transaction in isolation, a model can process far larger volumes of information, compare a customer’s activity with their normal behaviour and identify connections between people, accounts or devices that might otherwise go unnoticed.

Speed matters as well. Detecting a suspicious payment after it has been completed leaves much less room to prevent the loss. Banks are therefore trying to bring risk detection closer to real time, combining signals from customer due diligence, transaction monitoring, sanctions screening and fraud controls rather than treating each as an entirely separate exercise. Bringing real time or near time detection and monitoring of Financial Crime Processes help speed the operation. 

That is not a straightforward transition for institutions whose monitoring systems were built around retrospective review. Faster detection requires more than a better algorithm. The underlying data, technology architecture and decision-making processes all have to support it.

Where AI Can Make a Difference

One obvious advantage is scale. Fraud teams deal with enormous volumes of information across transactions, customer behaviour, devices, communications and documents. AI models can sift through those data for patterns that would be difficult to identify manually.

Anomaly detection is another important use case. A sudden departure from a customer’s usual behaviour may be significant even when no individual action looks obviously fraudulent. Typing speed, mouse movements, the device used to log in, session behaviour, time spent on a page and the nature of a transaction can all provide useful signals when considered together.

Then there is the longstanding problem of false positives. Rules-based systems can generate large numbers of alerts for perfectly legitimate activity. Investigators spend time clearing them, while genuine customers may be subjected to unnecessary checks or interrupted transactions. A well-designed model can help distinguish meaningful signals from noise. Whether it succeeds, however, depends heavily on the quality of the data behind it and how carefully the model has been calibrated.

Fraud also changes. A model trained on yesterday’s cases cannot simply be left to run indefinitely. It has to be monitored, tested against new behaviour and retrained when necessary. In practice, maintaining the model can be just as important as building it.

Why Banks Need to Share More

Fraudsters rarely organise their activity around the boundaries of a single institution. A scheme may involve several banks, multiple accounts and devices, and participants operating in different countries. Each bank sees its own transactions. The fraudster sees the whole network.

That asymmetry makes information sharing increasingly important. Consider mule accounts used to receive, transfer or withdraw the proceeds of fraud. One bank may have identified 10,000 such accounts, but its view remains limited to what happens within its own environment. If several banks can share verified information, patterns that were previously fragmented begin to emerge.

The difficulty is that banks cannot simply exchange whatever data they hold. National legislation, privacy rules and regulatory requirements determine what can be shared and under what circumstances. In Europe, the tension between protecting personal data and preventing financial crime can be particularly difficult to navigate between the GDPR (General Data Protection Regulation ) vs AML (Anti-Money Laundering) legislation. Criminal networks, meanwhile, do not have a compliance department telling them what information they are allowed to use.

So this is not simply a technology problem. Effective collaboration requires a legal basis, trust between institutions, reliable ways to validate information and clear boundaries around what can and cannot be exchanged.

Seeing Fraud as a Network

Fraud often makes more sense when viewed as a network rather than a series of individual transactions. Accounts connect to devices; devices connect to IP addresses; telephone numbers, documents and identities reappear; the same recruiters or intermediaries may sit behind apparently unrelated cases.

An isolated payment might reveal very little. Add those relationships, and the picture can change considerably.

Graph analytics and network analysis are designed for this kind of problem. They allow investigators to map relationships between entities and identify potential fraud rings. A graph may reveal that several accounts share a device, that the same IP address appears across supposedly unrelated customers, or that multiple transactions ultimately converge on a common beneficiary.

The practical value goes beyond making an investigation easier to understand. If the evidence and legal framework allow it, banks can move from stopping one suspicious transaction to identifying and disrupting a broader network.

The Models Behind Fraud Detection

There is no single AI model for fraud prevention. Different techniques are useful for different problems.

Supervised learning works well when a bank has historical cases that have already been classified as fraudulent or legitimate. Models can learn from those examples and support transaction scoring, card-fraud detection or payment-authorisation decisions.

Unsupervised learning addresses a different challenge: finding behaviour that nobody has labelled in advance. Instead of learning what known fraud looks like, the model looks for activity that departs from established patterns. That can be particularly useful when a new scheme has not yet found its way into the rulebook.

Deep-learning techniques can handle complex sequences and large numbers of variables, making them relevant to transaction chains, payment monitoring and some forms of behavioural analysis.

Graph models focus on relationships. They can connect accounts, devices, IP addresses and other entities, making them particularly useful when looking for money-mule networks or organised fraud rings.

Banks may also combine several algorithms rather than rely on one. Ensemble approaches can improve accuracy and are common in production environments where a single model may not capture enough of the risk.

Behavioural models add another layer. They look at how someone uses a service, including how they type, move a mouse, log in, navigate a session or use a particular device. A sharp change in those patterns may indicate that the person operating the account is no longer the person who normally does so.

AI Is Only as Good as the Data Behind It

For all the attention given to models, one of the biggest constraints is much more prosaic: data quality.

Banks often carry decades of technology history with them. Some still depend on data and systems created 35 or 40 years ago, including mainframe environments that remain embedded in critical operations. Putting a sophisticated model on top of that infrastructure does not automatically make the underlying information usable.

The distinction between having data and having usable data matters. Models need information that can be accessed when required, is sufficiently current, can be connected across systems and is structured well enough to process. Access also needs to be governed. Fragmented, poorly documented or inaccessible data do not become an asset merely because an AI model is applied to them. A good AI journey started with a good data journey. 

Explainability Is Not Optional

Banks have to be able to explain their decisions. AI does not remove that obligation; in some respects, it makes it more important.

A model therefore needs a clear governance framework. An institution should know who developed it, which data were used, where and how it is deployed, what its limitations are and how its output is validated. There also need to be safeguards against biased, inappropriate or simply incorrect decisions.

Regulation adds another layer of work, but it can also impose useful discipline. Requirements around governance, ethics, oversight and explainability force institutions to ask questions that should in any case be answered before a model begins influencing real customers and real transactions.

Integration Matters More Than the Demo

Banks rarely introduce AI into an empty environment. They already have transaction-monitoring platforms, rule engines, data warehouses, investigation processes, reporting systems and regulatory obligations. Any new model has to work alongside them before it can eventually replace or reshape parts of that architecture and connect all the FCP systems.

That makes implementation less glamorous than a successful proof of concept might suggest. An existing control cannot simply be switched off while a replacement is still being trained, tested or approved. Banks have to think about compatibility, scalability and data availability, as well as who will maintain the model once the initial project team has moved on.

Five Questions Worth Asking

The first is whether the right data are available when they are actually needed. A near-real-time model is of limited value if its inputs arrive hours later or cannot be reconciled across systems.

The second is where rules remain useful and where models can do better. There is little reason to apply AI simply because it is available. But when fraud patterns change faster than rules can be updated, or false positives begin to overwhelm investigators, the existing approach deserves another look.

The third is whether the organisation can explain the result. If nobody can show why a customer, transaction or group of connected entities received a high-risk score, the model may introduce regulatory and reputational risk of its own.

The fourth is what happens after deployment. Fraud patterns evolve. A model that is not monitored, challenged and refreshed against new data will gradually lose relevance.

The fifth concerns the world outside the bank. How effectively can the institution work with other banks, regulators, law-enforcement agencies and telecommunications providers? Networked fraud is difficult to understand when every participant sees only its own fragment of the network.

Data Are Becoming Part of the Defence

AI will not replace fraud specialists or make financial crime disappear. In fact, more sophisticated models make some of the fundamentals more important, not less: reliable data, sound governance, explainable decisions and processes that work across organisational boundaries.

Used well, AI can help banks spot fraud earlier, cut through the noise of false positives and uncover relationships that are almost impossible to see manually. But no algorithm can make up for fragmented data, weak integration or unclear accountability.

The technology matters. The foundations matter more.