Social Engineering Instead of Hacking: How Banking Fraud Is Evolving

Gökhan Dumrul

QNB Türkiye

Head of Fraud Risk Management

Banks are strengthening security across their digital channels, yet fraudsters are increasingly targeting customers rather than banking systems. Drawing on insights from Gökhan Dumrul, Head of Fraud Risk Management at QNB Türkiye, we examine how fraud schemes are evolving, why traditional transaction monitoring is no longer enough, and how banks can strengthen security without compromising the customer experience.

Digital transformation has reshaped not only the banking experience but also the nature of fraud risks. Mobile banking, remote identity verification, instant payments and integration with third-party services have made financial services faster and more accessible. At the same time, they have created a more complex environment in which banks must detect and prevent fraud.

Increasingly, fraudsters no longer need to breach banking systems. Instead, they persuade customers to disclose confidential information, authorise transactions or grant access to their accounts.

How can banks combat fraud when a critical vulnerability lies beyond their technological infrastructure? And how can they strengthen security without turning every transaction into a lengthy verification process?

These questions were at the heart of a presentation by Gökhan Dumrul, Head of Fraud Risk Management at QNB Türkiye, at the Eurasian Anti-Fraud Summit organised by B2B Events. Drawing on experience from the Turkish banking market, he explored emerging fraud risks, approaches to fraud risk management and practical solutions implemented at QNB Türkiye.

Why Social Engineering Is Becoming a Major Threat

Digital banking continues to expand rapidly in Türkiye. According to figures presented by Gökhan Dumrul, the number of active digital banking users rose from 36.2 million in the first quarter of 2017 to 134.5 million in the fourth quarter of 2025.

Card transactions and e-commerce activity have also increased. For banks, this means not only greater demands on infrastructure but also the need to assess the risks associated with an ever-growing volume of transactions in real time.

Yet the expansion of digital services has been accompanied by a shift in the way fraud is perpetrated. As Dumrul observed, banks have steadily strengthened their technical defences, prompting criminals to rely increasingly on social engineering — exploiting customer behaviour, trust and the ability to recognise threats.

According to an estimate cited by Dumrul, approximately 95 per cent of fraudulent attacks in Türkiye involve social engineering. The figure, presented during his speech, illustrates the scale of the challenge facing the Turkish financial sector. For banks, the implications are significant. Even robust technical infrastructure cannot eliminate fraud if customers are manipulated into taking actions that compromise their own security.

Why Monitoring Individual Transactions Is No Longer Enough

A modern digital bank operates as an interconnected network of products and service channels. Mobile applications, payment cards, remote onboarding, transfers, partner platforms and telecommunications infrastructure all form part of a single customer-facing environment.

A fraudulent scheme may begin in one channel, move through another and culminate in a financial transaction that does not necessarily appear suspicious when examined in isolation. As Dumrul explained, anti-fraud systems must therefore consider not only the characteristics of individual transactions but also the wider context of customer behaviour. This creates a difficult balancing act. Fraud prevention systems need to remain sufficiently flexible and manageable to adapt to emerging threats, while also accounting for numerous interconnected scenarios.

The central challenge is to balance transaction speed, customer convenience and the rigour of security controls.

Excessive verification can undermine the customer experience and increase operating costs. Insufficient controls, by contrast, leave banks more exposed to financial losses.

How Fraudsters Exploit Customer Trust

One scenario presented by Dumrul illustrates how social engineering allows criminals to gain access to banking services through a sequence of carefully orchestrated steps. Fraudsters first obtain a customer’s payment card details and telephone number through phishing. They then initiate a suspicious e-commerce transaction. The customer subsequently receives a call from someone posing as a bank employee. The caller warns of an allegedly fraudulent transaction and offers to help protect the customer’s funds.

Having established trust, the fraudster persuades the customer to disclose their mobile banking password. With access secured, the criminals can carry out further transactions through the customer’s banking application. 

What makes this scheme particularly effective is that the victim may genuinely believe they are protecting their money, when in fact they are helping criminals gain access to their account.

For anti-fraud teams, this highlights the need to monitor not only technical indicators of fraud but also behavioural patterns that suggest a customer may be acting under external influence.

Five Areas Requiring Continuous Oversight

In his presentation, Dumrul identified five areas that anti-fraud teams must manage simultaneously:

1. New digital products and services. Additional features create new forms of customer interaction and potential opportunities for abuse.

2. Partnerships and integrations. Expanding banking ecosystems require institutions to assess risks arising from relationships with external organisations.

3. Growing transaction volumes and data flows. Higher transaction activity makes anomaly detection more complex and places greater demands on monitoring systems.

4. Complex fraud scenarios. Attacks increasingly combine multiple channels, techniques and successive actions.

5. Transaction processing speed. Banks must identify threats and make decisions without materially slowing down customer service.

Together, these priorities demonstrate why modern anti-fraud capabilities must extend well beyond identifying suspicious transactions. Fraud prevention needs to be embedded in product development, partner onboarding, customer service processes and operational risk management.

Three Pillars of Effective Fraud Prevention

The approaches outlined by Dumrul point to three complementary elements of an effective fraud prevention strategy.

1. Customer and Employee Awareness

When fraud relies on manipulating human behaviour, awareness becomes an essential line of defence. This goes beyond warning customers about potential scams. It also requires regular training for bank employees.

According to Dumrul, QNB Türkiye conducts monthly training sessions to keep staff informed about emerging fraud schemes. Anti-fraud specialists also help train colleagues across other departments. This approach ensures that knowledge of emerging threats is shared throughout the organisation rather than remaining confined to specialist teams.

2. Investment in Technology

Technological defences include suspicious transaction monitoring, malware detection, the identification of fraudulent websites and advertisements, the use of artificial intelligence, and more advanced identity verification methods. Continuous refinement of fraud detection mechanisms is equally important.

Even false positives can provide useful information for analysis and subsequent adjustments to detection rules, although they do not, in themselves, guarantee greater accuracy.

3. Cooperation Across the Financial Ecosystem

Banks hold information about their own customers and transactions, but a fraudulent attack may begin much earlier — with a telephone call, a message or a phishing website. As Dumrul emphasised, effective fraud prevention therefore requires cooperation between banks, regulators, telecommunications operators, payment institutions, fintech companies and other participants in the digital ecosystem.

Information sharing gives institutions a broader view of threats that cannot be fully identified using the data available to any single organisation.

How this works in practice

We rely on automated verification scenarios triggered as soon as elevated risk is detected in a transaction. One option is identity confirmation via smartphone, combined with contactless reading of a chip-enabled Turkish ID card — allowing fast and secure verification within the bank’s environment.

Another is interactive digital verification through the Q system. It contacts the customer and asks questions about the transaction, much like a fraud analyst would. Was the transfer requested by someone claiming to be from law enforcement or the bank? Was a financial return promised via social media or other channels?

If the responses support the legitimacy of the transaction, it proceeds automatically. If not, the operation is flagged as potentially fraudulent, enabling immediate action — from blocking a card to notifying the customer of possible unauthorised access. The time advantage is significant: manual calls can delay a transaction by up to 30 minutes, while automated checks take around 102 seconds. At the same time, this reduces the need to continuously expand anti-fraud teams.

How Banks Can Automate the Verification of Suspicious Transactions

A significant part of Dumrul’s presentation focused on tools that can accelerate transaction verification while maintaining appropriate security controls. QNB Türkiye uses automated verification processes that are triggered when elevated transaction risk is detected.

One approach allows customers to confirm their identity through a smartphone using contactless reading of a chip-enabled Turkish identity card. This enables additional verification to take place within the bank’s secure digital environment. Another tool is Q, an interactive digital verification system that contacts customers and asks questions about potentially suspicious transactions. In effect, the system replicates elements of the checks normally performed by a fraud analyst.

For example, customers may be asked whether someone claiming to represent the police, a prosecutor’s office or a bank has instructed them to make a transfer, or whether they have been promised investment returns through social media. The customer’s responses determine how the transaction is handled.

If the answers support the legitimacy of the transaction, the transfer can be completed automatically. If suspicious indicators are identified, the transaction is flagged as potentially fraudulent, allowing further protective measures to be taken, including blocking a card or notifying the customer.

According to figures presented by Dumrul, automated verification takes approximately 102 seconds, compared with delays of up to 30 minutes when a bank needs to contact a customer manually. The difference is particularly important for banks processing large volumes of digital transactions. Automation enables faster responses to potential threats while reducing the need to expand anti-fraud teams in direct proportion to transaction growth.

However, the effectiveness of such solutions should be assessed not only by verification speed but also by fraud detection accuracy, false-positive rates and their impact on the customer experience.

Why Data Sharing Is Now Essential

One of the central messages of Dumrul’s presentation was the importance of interbank cooperation. Fraud schemes rarely remain confined to a single financial institution. Funds may move between accounts at different banks, while the same criminals may exploit several payment channels. In Türkiye, the Interbank Card Center (BKM) provides infrastructure for information sharing. Under the arrangements described in the presentation, banks and payment institutions share information on accounts and transactions associated with fraud. When processing a new transfer, a financial institution can compare it with available information on previously identified suspicious activity.

Dumrul also discussed SIPER, a service introduced by the Central Bank of the Republic of Türkiye for the country’s instant and continuous payments system. The service is designed to facilitate the exchange of threat data and intelligence to help detect and prevent illicit transactions. Such mechanisms extend the capabilities of individual banks by giving them access to risk information beyond their own systems.

Key Takeaways: What Banks Should Reassess in Their Anti-Fraud Processes

The experience of QNB Türkiye raises several important questions for banks reviewing their fraud prevention frameworks. 

Does fraud monitoring cover the entire customer journey? If controls focus only on individual products and transactions, a bank may fail to recognise a sequence of actions that together constitute a coordinated fraud scheme. 

How well prepared are employees and customers to recognise social engineering? Technology cannot replace awareness and education, particularly when criminals exploit trust and psychological pressure.

Are verification requirements proportionate to the level of risk? Not every transaction warrants the same level of scrutiny. A more effective approach applies enhanced controls when suspicious indicators emerge. 

Can verification times be reduced without compromising security? Automated verification can help minimise delays associated with the manual review of suspicious transactions.

Does the bank make use of external threat intelligence? Interbank information sharing and cooperation across the digital ecosystem can help identify risks that would otherwise remain invisible within a single institution.

How is the effectiveness of anti-fraud systems measured? Beyond the number of attacks prevented, banks should assess detection quality, transaction speed, customer experience and the operational burden on employees.

Anti-Fraud as Part of Digital Banking Architecture

Dumrul’s presentation demonstrates why the continued expansion of digital banking calls for a reassessment of traditional fraud prevention approaches. As technical defences become stronger, criminals are increasingly turning to social engineering, while fraud schemes span multiple channels and participants across the financial ecosystem.

In this environment, the effectiveness of anti-fraud systems depends on more than their ability to identify suspicious transactions. Equally important is how quickly a bank can recognise a threat, interpret customer behaviour and apply additional controls without creating unnecessary friction.

The ultimate challenge is to embed fraud prevention into the architecture of digital banking so that security, transaction speed and customer convenience reinforce one another rather than compete.