The customer isn't a fraud signal - they're the key witness

Ask a fraud model whether a payment looks suspicious, and it will answer with confidence. Ask it whether the person making that payment is being coerced by someone on the other end of a phone call right now, and most models become much less certain.

That is because these are not quite the same problem.

The first is a transaction-risk problem. The second is a human-context problem. And banks have spent decades building systems that are extraordinarily good at analysing the former while having much less visibility into the latter.

From the transaction to the person

This article continues our series on what effective fraud prevention looks like. In the previous instalment, I questioned whether the industry's favourite fraud scorecards are measuring the right thing. We moved away from the final transaction and followed the customer's journey through the bank - from identity and device, through login and beneficiary creation, to payment, intervention, investigation, recovery and, ultimately, learning.

The point was not that every fraud journey follows some neat steps. Real scams are messier than that. Rather, the map showed that a payment is only one event in a much longer sequence, and that banks may have several opportunities to identify risk before money leaves the account.

But there is another problem hiding inside that map. At almost every stage, the customer is being translated into data: an identity attribute, a device fingerprint, a login pattern, a behavioural score, a beneficiary relationship, a transaction amount. Those signals are useful. But in the fastest-growing categories of scams, they do not necessarily tell us why the customer is doing what they are doing. And that distinction matters.

The customer can be authenticated - and still be deceived

A conversation with John Erik Setsaas, an independent fraud and identity expert and contributor to Mobey Forum's Fraud Expert Group, helped me put a name around the problem. John Erik shared with me Mobey Forum's report Rethinking Fraud in a Connected World: Trust, Collaboration, and Resilience in the Digital Ecosystem. The report makes a useful distinction between different ways in which a customer can become involved in fraud.

• There is fraud in which the customer is unaware and passive: their credentials are stolen, their device is compromised, or an account is accessed without their knowledge.
• Then there is fraud in which the customer is aware but deceived: the authentication may be perfectly valid, but the customer's understanding of what they are authorising is wrong.
• And then there is the more difficult category: the customer is aware and involved, but their consent has been engineered through manipulation.

That last category changes the problem. Traditional fraud controls were largely designed around the first scenario. Someone other than the legitimate customer is doing something they should not be doing. APP scams, romance scams, and investment scams often look completely different. The legitimate customer is holding the phone, is entering the credentials, may pass authentication, and may even tell the bank, truthfully, that they authorised the payment. The problem is that authorisation does not necessarily equal informed intent. And this is where analysing the context around the transaction becomes as important as analysing the transaction itself.

Intent is becoming the new frontier

This becomes even more complicated as AI changes the way people and machines interact with financial services. In the BioCatch discussion about the future of fraud signals I mentioned last time, one idea stood out to me: intent is becoming a new frontier. Consider an agent acting on a customer's behalf. The customer may legitimately authorise an AI agent to pay their regular bills. But that does not necessarily mean they have authorised the agent to send USD 100 to an unknown recipient. The technical question - 'Is this session risky?'- is therefore becoming less sufficient. The harder question is: 'What is this actor actually trying to do, and is the action consistent with the human's intent?' That requires context.

Behavioural models can help establish what is normal for a particular customer. Identity signals can tell us who is acting. Device intelligence can indicate whether the environment has changed. Transaction analytics can identify unusual activity. But none of those signals is meaningful in isolation. And this is where the industry can fall into what one of the speakers described as the 'orchestration trap': adding more vendors, more signals, and more layers without necessarily improving the decision at the end. The result can be a system that processes more information and reaches the wrong conclusion faster.

The answer, then, is not necessarily more data. It is knowing which signals matter, what they mean in context, and whether anyone can act on them in time.

That also changes the governance challenge. If fraud decisions increasingly happen in real time and involve autonomous or AI-enabled systems, periodic model reviews are not enough. Institutions need continuous risk assessment, explainability at the level of individual decisions, and clear accountability for what happens when an automated system gets the customer's intent wrong. But even the best model eventually reaches a boundary. Sometimes the missing signal is not hidden in another database. Sometimes it is sitting on the other end of the phone.

The key witness

This is where the idea of the customer as the key witness becomes useful. Refine Intelligence's approach to high-risk APP cases offers a fascinating example. Rather than treating the customer as the object of a fraud score, the bank can contact them directly and analyse the conversation alongside behavioural biometric signals to assess whether the customer may still be under coercion or manipulation. Uri Rivner described the approach to me in a phrase I found hard to forget: 'calling the key witness to testify.'

It reframes the investigation. The bank is no longer asking only: Does this transaction look suspicious? It is asking: What is happening to this person? Are they repeating a script given to them by someone else? Do they understand who they are paying? Are they under pressure? Are they being told to keep the conversation secret? Do they believe the recipient is someone it clearly is not? The transaction may contain some of those clues, but the conversation can reveal the story around them. That is particularly important because social engineering is, by definition, a story.

When technology has to make room for a human

This is also why I would not treat human intervention as the opposite of technology. The more interesting model is technology deciding when a human conversation is necessary. A sophisticated fraud system can narrow thousands of cases down to the ones where context matters most. Behavioural analytics can identify an unusual pattern. Device intelligence can identify a potential compromise. A payment engine can flag an unusual beneficiary. But when the critical question becomes 'Is this customer being manipulated right now?', a conversation may be the most valuable additional signal available.

Education is not a disclaimer

There is another human intervention that happens much earlier: education. But here too, simply giving customers more information is not necessarily enough. Trace Fooshee of Datos Insights made this point particularly well when we discussed how financial institutions are communicating about scams. For years, banks were reluctant to speak too openly about the risks surrounding digital banking. Now, almost every market is trying to warn customers that scams exist and that they need to be careful. That is progress.

But Trace's challenge is whether banks can 'engage constructively with customers' rather than sound like the 'obligatory safety briefing we all get every time we get on a flight'. The distinction matters because a generic warning is rarely delivered at the moment a customer needs it. Telling someone 'never trust a stranger asking you to move money' is one thing. Recognising that the customer has just received an unusual instruction, has added a new beneficiary, is simultaneously on a phone call and is about to transfer a large amount - and then giving them a warning that speaks directly to that situation - is something else.

The future of customer education may therefore be less about publishing more warnings and more about contextualising the warning around the customer's actual situation.

Some institutions are also going one step further, using feedback from real fraud victims to improve the language, scripts and empathy used in fraud conversations. It is a small but important shift: instead of designing customer communication from the perspective of the institution, they are designing it from the perspective of the person who has actually experienced the scam.

The ecosystem needs to learn too

The same principle applies beyond the customer relationship. Mary Ann Miller of Prove described the value of industry roundtables where banks, regulators, identity specialists, and other participants can discuss emerging threats under Chatham House-style conditions. The value of these forums is not simply networking. It is the ability to turn isolated observations into a shared picture. One bank may see a new identity attack. A telco may see a new pattern of SIM activity. A regulator may see complaints emerging across several institutions. Another bank may have already developed a control that works.

Individually, each organisation sees a fragment. Together, they may recognise the attack pattern much earlier. Mary Ann's point was particularly important here: information sharing only becomes useful when it produces actionable intelligence. Knowing that a trend exists is not enough.

The uncomfortable middle

There is, however, an uncomfortable complication. Not everyone on the other side of a suspicious transaction is a straightforward victim.

Alloy's 2026 research found that respondents attributed 29% of fraud events to customers who intentionally steal from their financial institutions. That makes the clean division between victim and criminal increasingly difficult to maintain. A customer may knowingly participate, unknowingly act as a money mule, or be manipulated. And sometimes the institution has to work out which of those situations it is dealing with while the transaction is still unfolding. The challenge is not simply to stop fraud. It is to distinguish between different kinds of human intent without punishing legitimate customers in the process.

The trust problem

This is where fraud prevention becomes a customer-experience problem as much as a risk problem. Every intervention introduces friction. Ask too little, and criminals get through. Ask too much, and legitimate customers begin to feel that their own bank does not trust them. Delay too many payments, and the digital experience becomes frustrating. Fail to intervene when the customer is being manipulated, and the consequences can be devastating.

The bank therefore has to solve two problems at once: remove friction for legitimate activity while creating friction precisely where the risk warrants it. That is an extraordinarily difficult balance. Because when the bank gets it wrong, the cost is not just a fraud loss. It is trust.

Alloy's research captures why that matters. Its 2026 report finds that financial institutions increasingly connect stronger fraud prevention with customer satisfaction and retention, and that fraud prevention is becoming part of how institutions support growth rather than simply contain losses. In other words, the customer is not merely the person the fraud team is trying to protect. The customer's trust is one of the assets the fraud strategy is trying to preserve.

The bank cannot hear what it cannot see

Overall, the challenge is no longer simply whether banks can build better models, collect better signals, or become better at talking to customers. It is whether the whole ecosystem can learn to recognise the same fraud journey before it reaches the payment system. That means banks, technology platforms, telecom companies, identity providers, regulators, and policymakers all seeing different pieces of the same attack - and finding ways to connect those pieces quickly enough to matter.

But the bank is rarely the only place where the story began.

And that is where the final part of this series goes (to be published on Sept. 23): from the bank's fraud strategy to the ecosystem around it - and the question of who should be responsible for stopping a scam when the scam itself does not belong to any one industry.

About author

Mirela Ciobanu is Lead Editor, Banking and Fintech at The Paypers, focusing on the latest trends and developments in fraud, cybersecurity, and technology (generative AI, blockchain analytics, data, etc.). Mirela is particularly passionate about the importance of having interoperable digital identity solutions that help not only to secure payments but also transactions in other areas of life (travel, health, education). She is a strong advocate for online data privacy and protection.

As a skilled writer, she strives to deliver accurate and informative insights to her readers, always in pursuit of the most compelling version of the truth. To share more ideas and get inspired, connect with Mirela on LinkedIn or reach out via email at mirelac@thepaypers.com.