This text discusses the evolution of fraud prevention strategies. Fraud-prevention methods need to steadiness a number of competing calls for: catching fraudulent exercise with out blocking professional prospects, adapting rapidly to new assault patterns, processing choices effectively and retaining these choices explainable.
It covers the interval from the Nineteen Seventies to the current, when corporations moved from rules-based approaches to counting on ML after which ultimately adopted hybrid approaches. We’ll look into the principle driving forces that triggered every shift, the issues every new method tried to unravel and who was first to make the transfer.
Guidelines-Primarily based Period
In 1973, Visa launched VisaNet that introduced computerised authorisation, clearing and settlement to card transactions (Dee Hock — In memoriam). The system relied on static guidelines to forestall fraudulent transactions.
Most of rules-based methods had been involved with card-present fraud. They relied on velocity checks, geo anomalies and BIN blocklists.
Guidelines shined when it got here to explainability: they had been straightforward to know and audit. They had been good to work with regulators.
Guidelines-based method labored effectively in 90s and 2000s. However fraudsters had been consistently adapting their techniques to beat new safety measures. Static guidelines, in the meantime, had been too inflexible to catch new fraud schemes. The foundations couldn’t routinely discover and replace them to mirror more and more advanced assaults triggered one other drawback.
One other hurdle was to consistently replace numerous thresholds to keep up acceptable charges of false positives. They weren’t as large of an issue again then, however one thing price contemplating nonetheless.
With the intention to meet up with fraud schemes, rule units had grow to be extraordinarily advanced and onerous to keep up. In its Guidelines based mostly vs machine studying in fraud prevention report, PayPal says {that a} rule-based system may fit for small corporations but it surely’s changing into too unwieldy when it grows past a sure level.
To cope with the evolving fraud techniques and get across the limitations of static guidelines, corporations turned to Machine Studying strategies.
Transfer to Machine Studying
Visa deployed a neural network-based AI for transaction scoring in 1993 (Visa Prevents Roughly $25 Billion in Fraud Utilizing Synthetic Intelligence). It was solely a reference indicator for its shoppers at the moment. Nevertheless it wasn’t till 2010s that machine studying fashions received huge adoption.
By that point, corporations had amassed excessive volumes of labelled knowledge. Vital advances in neural architectures and gradient-boosted tree algorithms allowed corporations to make use of that knowledge to deploy machine studying methods of their pipelines. They supplemented the previous rules-based algorithms and more and more dealt with duties that static guidelines struggled with.
Mastercard launched its Determination Intelligence platform in 2016. It analyses every transaction and checks it in opposition to the cardholder’s previous behaviour. Aside from fixing the issue of excessive upkeep price of the static guidelines method, the brand new platform allowed Mastercard and issuers to cut back false positives.
PayPal geared toward important fraud discount by adopting machine studying (Doing Massive Issues with Massive Knowledge at PayPal). They constructed an ensemble of deep studying and gradient boosting fashions. The system checked a number of parameters to attain transactions: system fingerprint, account-level threat, transaction graph.
The corporate later reported a transaction loss fee of simply 0.08% of its complete fee quantity, together with losses from fraud (PayPal 2025 Type 10-Ok).
False Optimistic Disaster
Each fraud-prevention system has to steadiness two pricey sorts of error: letting fraudulent transactions by means of and blocking professional ones. Most corporations naturally geared toward catching as many fraudulent transactions as doable. In different phrases, they minimized false negatives to guard themselves from direct monetary losses, operational prices and reputational harm attributable to fraud.
However stricter controls naturally led to a better variety of false positives, which corporations usually ignored or thought-about acceptable. Analysis by Aite Group confirmed how costly that trade-off might grow to be. It projected that losses from false declines would attain $443 billion in 2021, exceeding the losses attributable to fraud itself (Monetary Establishments Ease Cardholder Frustration by Addressing Transaction False Declines with New Fiserv Know-how).
More moderen Aite-Novarica analysis put the common false-decline fee for US e-commerce retailers at 1.16%. With greater than $960 billion in US on-line gross sales in 2021, that translated into over $11 billion in misplaced professional gross sales (New Experian Hyperlink).
However banks suffered from extra than simply monetary losses. Excessive fee of professional transactions being turned down triggered prospects to really feel upset and indignant. They may go away the offending corporations and switch to their opponents, which led to increased churn. Or they went to complain to regulators, who requested the businesses to show that their choices weren’t discriminatory. Both manner, excessive false constructive fee triggered important reputational harm in addition to excessive fraud fee.
Some corporations had began to work on retaining the false constructive fee low lengthy earlier than the report was printed. Mastercard’s Determination Intelligence, launched earlier, was one instance: the corporate reported that it reduce false positives in half. With round 75 billion transactions a yr, this discount was reported to save lots of tons of of hundreds of thousands of US {dollars}.
Stripe additionally launched its Radar Engine in 2016 (A primer on machine studying for fraud detection). They took one other method and focused on the service provider. Stripe calculates a suitable degree of threat for every service provider and rating transactions based mostly on that degree.
For instance, a B2B or enterprise software program firm might tolerate some losses from particular person transactions to maintain its status for high-figure contracts. In Radar 2.0 testing in 2018, Stripe mentioned the upgraded ML fashions diminished fraud by greater than 25% in contrast with the earlier fashions with out rising the false-positive fee.
The Explainability Downside
When giant quantities of professional transactions had been turned down and the affected folks complained to regulators, they needed to demand higher transparency and equity in automated decision-making. The EU launched GDPR in 2018 which strengthened necessities round automated choices. Within the UK, the Shopper Responsibility launched in 2023 added additional strain on monetary corporations to exhibit that their methods produced truthful outcomes for purchasers.
Monetary establishments had been now required to elucidate their choices after they turned down transactions. Nevertheless it was very tough, if doable in any respect, to do when the choices had been made by an ML mannequin.
HSBC tackled this drawback when it developed its Dynamic Danger Evaluation platform in collaboration with Google Cloud (Harnessing the facility of AI to combat monetary crime). They launched SHAP values to elucidate machine studying predictions by measuring how a lot every function contributes to a closing output, utilizing guidelines from cooperative recreation concept. HSBC put this method into manufacturing in 2021. Two years later, Google Cloud made it out there for different companies by means of their Anti-Cash Laundering AI.
Advances in Fraud Methods
Whereas corporations moved to extra subtle measures to forestall fraud, fraudsters improved their strategies as effectively. Speedy improvement of generative AI allowed them to launch new sorts of assaults at scale.
One among such assaults is Authorised Push Cost (APP) fraud. Fraudsters manipulate victims into authorising the funds themselves. Whereas it had been doable to make use of this strategies earlier than, advances in generative AI allowed them to routinely generate extremely customized messages.
APP fraud is probably the most quickly increasing type of fraud now. UK Finance report says that one of these fraud triggered losses of £460 million within the UK in 2023. Essentially the most difficult a part of coping with it’s that every transaction appears fully professional. The sufferer initiates the switch, approves it on their system, nothing suspicious. How can the monetary firm spot an issue?
Revolut approached this drawback by including a specialised layer to their fraud-detection system (Revolut launches AI function to guard prospects from card scams). They rolled out the system in 2024.
Revolut reported a 30% discount in losses from investment-related card scams after introducing the function. Individually, in October 2023 they reported a 35% discount in APP fraud since June 2023, and its broader proprietary fraud system prevented greater than £475 million of fraud in 2023 (Revolut doubles Monetary Crime Headcount to Fight Rising Business Fraud).
Evolution of Anti-Fraud Approaches Into Hybrid Programs
Firms naturally wished to make use of a single system for fraud detection, whether or not it was a rules-based or an ML-based one. It’s simpler to keep up and to elucidate to administration and stakeholders. However evolution of fraud menace and rising regulatory necessities pushed groups to undertake hybrid methods.
Similar to Revolut added a specialised layer to focus on one particular type of fraud, different corporations’ methods advanced to multi-layered architectures.
Along with layers particular to some threats, many corporations built-in rules-based layers for zero-tolerance issues, akin to compliance with sanctions. They changed resource-intensive ML-models with light-weight encoders for high-volume classification work. Some corporations added graph evaluation levels to identify pretend identities and different fraud enabled by generative AI.
Eastwind, a knowledge analytics supplier for cell operators, carried out a hybrid method in its SMS-firewall answer deployed in 2025. This answer targets one other type of fraud. Cell operators supply particular plans for corporations who have to ship OTP-codes to their shoppers. The operators don’t permit their shoppers to make use of private numbers to ship the codes.
The first concern is that this might practice customers to just accept OTP messages from abnormal private numbers, making them simpler targets for fraudsters impersonating professional corporations. However some corporations purchase giant numbers of non-public SIMs and use them to ship OTP codes extra cheaply.
Eastwind’s firewall answer examine for OTP codes in SMS messages despatched from private numbers. Many consumers function in rising markets and may’t afford in depth infrastructure to run an anti-fraud system constructed with ML-models in actual time. However fraudsters carry on developing with new methods of masking their OTP codes which requires an AI to catch these new developments.
The hybrid method allowed EastWind to unravel the issue of evolving fraud schemes whereas working inside out there sources. Actual-time processing is carried out by the rules-based layer. Some messages are filtered as suspicious and despatched to an asynchronous ML-layer for added checks.
The outcomes of those checks are inspected by a skilled skilled who might discover new developments and replace the principles. This human-in-the-loop method retains useful resource necessities low whereas serving to analysts determine new fraud patterns, replace the principles and maintain choices clear and explainable. (Eastwind — EW SMS Firewall success story in Burundi).
Behavioral Analytics
Hybrid architectures may incorporate extra sources of proof when transaction-level alerts are usually not sufficient. One more and more necessary instance is behavioral analytics, which examines how customers work together with their gadgets and may complement guidelines, ML fashions and human overview in fraud-prevention methods.
This technique has been in improvement since 2011 when BioCatch, the main supplier of options for behavioral evaluation, was based (About BioCatch). Their platform was first adopted by Nuance Safety Suite in 2017 (Nuance Groups with BioCatch to Develop Fraud Detection Throughout Digital Buyer Care Channels). It’s in use at some 30 of the world’s main banks.
The energy of the tactic is that it analyzes the way in which the consumer makes use of their system. Not like most conventional approaches that work on the degree of transaction, this technique reads alerts which can be onerous to breed and even learn by fraudsters.
BioCatch logs over 3,000 cognitive behavioral markers to construct an in depth profile for every consumer. Amongst many components, they have a look at key stroke dynamics, how onerous the consumer swipes, the place and the way they transfer their mouse.
The method has proved efficient in apply. In a single case, a big Latin American financial institution added BioCatch as one other layer on high of its current transaction-monitoring system. The financial institution elevated its fraud-detection fee to greater than 90% whereas slicing false positives by roughly two-thirds (Prime LATAM Financial institution Drastically Will increase Fraud Prevention & Reduces False Positives by 66% with Behavioral Intelligence).
Conclusion
Fraud prevention has advanced in response to altering threats and altering limitations. Guidelines-based methods supplied transparency and management, however turned more and more tough to keep up as fraud schemes grew extra advanced. Machine studying helped corporations analyse bigger quantities of knowledge and detect patterns that static guidelines struggled to seize, whereas introducing new issues round false positives and explainability.
This pushed corporations in the direction of hybrid architectures. Guidelines remained helpful for clear-cut choices, ML fashions dealt with extra advanced scoring, and specialised layers had been added for explicit threats, behavioral evaluation and human overview. The examples from Revolut, EastWind and BioCatch present how totally different strategies can work collectively inside the identical system.
Fraudsters proceed to adapt as effectively. Generative AI has already made some assaults simpler to scale and personalise, so fraud-prevention methods must maintain evolving. The central lesson is that there is no such thing as a single closing answer. Efficient methods depend upon combining the fitting instruments for the actual threats, constraints and choices they need to deal with.
(Prime, featured picture by way of Tara Winstead on Pexel)
