Why fraud prevention cannot remain reactive in 2026

Historically, fraud prevention was stuck one step behind. Fraudsters find gaps, banks detect the losses, analysts investigate, and a new prevention rule goes into the engine. The rule set grows, the false positive rate creeps upward, and the cycle restarts with the next fraud attack.

That model assumed there was time to work with. There is much less of it now. The Instant Payments Regulation entered into force in April 2024, and since 9 January 2025, every payment service provider (PSP) operating in the EU has had to be able to receive instant credit transfers, with euro transfers credited to the payee within ten seconds, according to the ECB.

A defence that used to take three days to build no longer applies to payments that settle before the customer puts the phone down.

What the European data shows

The most reliable picture of European fraud comes from the joint EBA and ECB report published in December 2025. Reported payment fraud across the European Economic Area (EEA) rose from EUR 3.4 billion in 2022 to EUR 3.5 billion in 2023 and EUR 4.2 billion in 2024. Credit transfer losses reached EUR 2.200 billion in 2024, up 16% year-on-year, while fraud on cards issued in the EU and EEA came to EUR 1.329 billion, up 29%.

Two details in that report matter more than the headline numbers.

The first is that the fraud rate held steady at around 0.002% of total transaction value. Losses are getting bigger because payment volumes are growing, not because controls have suddenly become weaker. Strong customer authentication (SCA) is still doing its job for the fraud types it was designed to address, and card fraud ran 17x higher when the recipient sat outside the EEA, where SCA is not required.

The second is where the losses land. Payment service users bore roughly 85% of credit transfer fraud losses in 2024, mainly through scams that tricked them into initiating the payment themselves. The EBA and ECB single out manipulation of payers as the fraud type on the rise, and note it will require new mitigation approaches.

That is the shape of the problem. Authentication controls hold up well against unauthorised transactions. They offer far less protection when the customer is the one pressing send.

Available vendor data points the same way. BioCatch recorded a 110% spike in instant payment fraud across its European customer base, combined with a rise in scams. In the US, Veriff’s 2025 industry survey found 72% of the fraud decision-makers it polled had seen online fraud increase over the previous 12 months, with 60.5% reporting more AI in attacks. Alloy’s 2026 report, based on more than 500 US fraud leaders, put the equivalent figure at 67%.

Spending is following the threat. Juniper Research expects financial institution spend on fraud detection and prevention to grow from USD 21.1 billion in 2025 to USD 39.1 billion by 2030. What that money buys is the open question, because more of the same architecture will not change the trajectory.

Real-time detection is not proactive prevention

These two capabilities are often considered somewhat synonymous, but they are not the same thing.

Real-time detection means the system scores a transaction as it happens and can decline it, pause it, or step up authentication before settlement. Any institutions handling instant euro credit transfers need it, because the IPR leaves no post-settlement window to work in.

Proactive prevention means something narrower and harder to do. Here, the system examines its own performance, identifies where current logic is being evaded, and proposes a change before an analyst has noticed the pattern. The difference is not scoring speed. It is who spots the weakness first, and how long the institution stays exposed while nobody knows it is there.

An engine can score in a few milliseconds and still be running logic that was appropriate four months ago. Speed at the point of authorisation says nothing about how quickly the defence itself adapts.

The analyst queue is the real constraint

If you ask a fraud team where they are left most exposed, the answer might not be model accuracy but throughput.

Once a new pattern is identified, someone characterises it, writes a rule, tests it against historical data, checks for false positive impact, obtains approval, and pushes it to production. A well-resourced team can do this in days. In a team carrying a backlog, it takes even longer. Every day in that queue is a day the pattern keeps earning.

Fraudsters know and understand this. Manual rule updates, investigation delays, and analyst error are predictable, hence exploitable. Human operational capacity does not scale in the same way attack volume does. Generative tools made the gap even wider. According to Deloitte’s Center for Financial Services, gen AI could push US fraud losses to USD 40 billion by 2027, up from USD 12.3 billion in 2023, a CAGR of 32% under its higher scenario.

This is what the market has started building against, from different directions. BioCatch works the behavioural signal layer, Alloy the identity and onboarding layer. Platform providers are approaching it from the configuration side instead. BPC, whose SmartVista suite it says serves more than 500 customers across 140 countries, describes an AI-powered fraud management platform that analyses historical transaction data continuously, identifies gaps in its own coverage, and generates candidate detection rules from its machine learning output rather than waiting for an analyst to characterise the pattern first. Configuration sits with business users rather than inside a development cycle.

The claimed operational effect is that the time between a pattern emerging and a defence existing stops depending on how many analysts are available that week. That is what institutions can test vendors on, and it could be a more useful question than scoring latency.

Automation needs a boundary, set in advance

A version of this argument overreaches, and it needs a line drawn precisely.

A system that writes its own rules and deploys them without review doesn’t represent improved governance. It is an audit finding waiting to happen, particularly for institutions carrying regulatory reporting obligations. The value sits in compressing analytical work, not in removing the approval step.

What makes automated rule generation defensible is human governance with controlled automation. The platform proposes, a person with authority decides, and the decision is recorded in a form that can be reconstructed later. Model updates remain governed and manual effort falls, while accountability stays where it was.

The institutions that skip this conversation risk having it during an examination instead. Before anything goes live, executives need to explicitly write and agree upon the thresholds at which the system must escalate.

Regulatory change runs into the same bottleneck

Fraud controls and AML obligations move on timetables that banks do not set, and they rarely align across markets.

The IPR is the current example. As stated by the ECB, euro area PSPs have had to offer a free Verification of Payee (VoP) service starting with 9 October 2025, checking the payee name against the IBAN before the transfer is authorised. Providers outside the euro area are expected to follow by 9 July 2027. The regulation also requires PSPs offering instant credit transfers to screen their users against sanctions lists at least daily.

A platform that needs a development cycle for each regulatory change carries the same constraint as one that needs a development cycle for each fraud pattern. Configurability matters for the same reason automation does, which is that the institution must move at the speed demanded by the obligation rather than the speed allowed by its release calendar.

This is the arena in which vendors compete. For example, BPC positions SmartVista Fraud Management around handling authorised push payment fraud, account takeover, phishing, smishing and vishing, and mule account activity inside one configurable rule environment, powered by omni-channel behavior profiling and ML scoring models, on the argument that fragmenting those controls across systems is what makes local adaptation slow in the first place.

The update to the analyst role

None of this points toward smaller fraud teams.

Instead, analysts will be spending their time differently. Routine rule maintenance and first-pass case triage are the parts of the job automation genuinely improves. AI-assisted case handling can shorten investigations and better scoring can reduce the false positive volume analysts work through.

What remains unchanged is the work that involves human judgement. Deciding which recommendations to accept. Setting the thresholds for automated operations. Investigating cases that go outside known patterns. Owning the governance framework that makes the entire system possible. All combined point to a more senior role than rule maintenance, and it is the one institutions will find hardest to hire for.

If one’s looking for a useful closing perspective, let’s consider card fraud. Global losses actually dipped 1.2% to USD 33.41 billion in 2024, which, according to the Nilson Report, can be attributed in part to better AI-driven fraud models. Still, the same publication projects cumulative losses of USD 407.60 billion over the next 10 years on sharply rising card volume.

Detection can win ground when the tools improve. The institutions best placed in 2026 and onward will be those that shorten the distance between noticing something new and doing something about it, and that can explain to a regulatory exactly how that happened.

Frequently asked questions

What is the difference between real-time fraud detection and proactive fraud prevention?

Real-time detection scores and acts on a transaction as it happens, before settlement. Proactive prevention means the system identifies weaknesses in its own detection logic and proposes improvements before an analyst has spotted the pattern. An institution can have fast real-time scoring while still running detection rules that are months out of date.

Can a fraud platform generate its own detection rules safely?

It can generate and propose them safely. Deploying them without review is where the risk sits, particularly under regulatory reporting obligations. The defensible model is human-in-the-loop governance, where the platform produces candidate rules from its analysis of historical data and a person with authority approves them, with the decision recorded in a reconstructable form.

Why does instant settlement change fraud management?

Under the Instant Payments Regulation, euro credit transfers must be credited to the payee within ten seconds, and funds are effectively irrecoverable once they land. Controls that depend on post-transaction review or an analyst intervening mid-flow have far less room to operate than they did on batch-settled rails.

Key takeaways