GRA · Financial Crime and Fraud Risk
Spatial financeWhere capital meets hazard, exposure and transition
Payments fraud
Payments fraud takes money through unauthorised transactions, such as stolen card use and account takeover, and through authorised push payment fraud, where victims are tricked into sending funds. Instant and irrevocable payments raise the stakes. This page sets out how payments fraud develops and moves between channels, how it is measured, who bears losses and which institutions decide on controls and reimbursement.
Payments fraud in seven parts.
- 01The questionPayments fraud: how the risk develops
- 02IndicatorsWhat is measured, and how well
- 03SourcesWhere the evidence comes from
- 04DecisionsWho decides, and what the evidence serves
- 05Core questionsWhat experts ask
- 06Mechanisms and driversSpeed, finality and displacement
- 07Methods and dataHow the evidence is built, and where it stops
Payments fraud: how the risk develops.
Fraud in digital transactions. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Speed removes the window
Instant payments settle in seconds and cannot easily be recalled. Fraudsters move funds through mule accounts before victims or banks notice, so prevention must happen before release.
Controls displace fraud
Strong authentication cut card-not-present and unauthorised fraud in several markets, and criminals shifted to manipulating customers into authorising payments themselves.
Mule networks launder proceeds
Stolen funds pass through accounts held by recruited, coerced or synthetic mules. Detecting and closing mule accounts limits the fraud economy.
Liability shapes incentives
Who reimburses victims, the sending bank, the receiving bank or no one, decides how much each invests in prevention. Rules differ sharply between jurisdictions.
Alert triage and investigations.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Alert triage and investigations
Payments fraud · Bank B monitoring · Today
- Alerts today1407
- Escalated to cases3pct of alerts
- Open cases older than 30 days31Watch
- Reports filed this month42Normal
Alert queue
- HRapid in-out through new accountsScenario TM-07 · score 842 h
- MTrade invoice price outlierScenario TB-03 · score 674 h
- MStructuring below thresholdScenario TM-02 · score 663 h
- LName match, sanctions listLikely false positive1 h
Counterparty network, case CS-6839
red: accounts under review
Case path
- Alertscenario
- Triageanalyst
- Investigatecase
- DecideMLRO
- Reportto FIU
- Feedbacktuning
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Fraud losses by payment type | currency per year | annual | Industry and central bank reports | REPORTED |
| Fraud rate on card payments | fraud value as share of transaction value | annual | ECB and scheme reports | Published statistics |
| Authorised push payment fraud cases | count and value | half-yearly | Industry reports | REPORTED |
| Reimbursement rate to victims | share of losses returned | periodic | Regulator data | Published statistics |
| Mule accounts identified | count | annual | Industry and law enforcement data | REPORTED |
| Payments subject to verification of payee | share of credit transfers | periodic | Scheme data | REPORTED |
How a shock to assets becomes a system loss.
The equity the system loses after interbank contagion, against the initial hit, as leverage, interconnection and recovery rates change, the core of a macroprudential stress test. Teaching model with stated illustrative values, not a prediction.
Controls
- Fall in external assets
- 2.0%
- Leverage (assets over equity)
- 10 times
- Interbank share of assets
- 10%
- Recovery on interbank claims
- 40%
- Banks in the system
- 20
- Core banks
- 20% of banks
Readouts
- Equity lost to the initial shock
- 18.0%
- Equity lost after contagion
- 45.0%
- Added by contagion (DebtRank)
- 27.0 points
- Banks in default
- 0
Numbers, methods and sources
| Round | System equity lost (%) | Banks in default |
|---|---|---|
| 0 | 18.00 | 0 |
| 1 | 28.80 | 0 |
| 2 | 35.28 | 0 |
| 3 | 39.17 | 0 |
| 4 | 41.50 | 0 |
| 5 | 42.90 | 0 |
| 6 | 43.74 | 0 |
| 7 | 44.24 | 0 |
| 8 | 44.55 | 0 |
| 9 | 44.73 | 0 |
| 10 | 44.84 | 0 |
| 11 | 44.90 | 0 |
| 12 | 44.94 | 0 |
| 13 | 44.96 | 0 |
| 14 | 44.98 | 0 |
| 15 | 44.99 | 0 |
| 16 | 44.99 | 0 |
| 17 | 45.00 | 0 |
| 18 | 45.00 | 0 |
| 19 | 45.00 | 0 |
| 20 | 45.00 | 0 |
| 21 | 45.00 | 0 |
| 22 | 45.00 | 0 |
| 23 | 45.00 | 0 |
| 24 | 45.00 | 0 |
| 25 | 45.00 | 0 |
| 26 | 45.00 | 0 |
| 27 | 45.00 | 0 |
| 28 | 45.00 | 0 |
| 29 | 45.00 | 0 |
| 30 | 45.00 | 0 |
Methods
- DebtRank Battiston and others (2012), Scientific Reports 2:541
- Differential DebtRank Bardoscia and others (2015), PLOS ONE 10
- Contagion in financial networks Gai and Kapadia (2010), Proc. R. Soc. A 466
- Clearing in financial networks Eisenberg and Noe (2001), Management Science 47
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme's own evidence.
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Crime and Fraud Risk in Foundry
- Tested at Financial Crime and Fraud Risk in Universe
- Codified in Finance, Insurance and the Economy in Standards
- Published in Financial Crime and Fraud Risk in Reports
- Taught in Faculty of Finance and Economics in Academy
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ECB and EBA report on payment fraud | Payment fraud rates by instrument in the European Economic Area | Free, EU reuse terms |
| UK Finance annual fraud report | Unauthorised and authorised push payment fraud statistics | Free to read, UK Finance terms |
| Payment Systems Regulator APP fraud reimbursement data | Reimbursement under the UK requirement | Free, PSR terms |
| FTC Consumer Sentinel data | Reported fraud by payment method in the United States | Public domain |
| Card scheme and central bank payment security reports | Card fraud trends | Free to read, terms per publisher |
What payments fraud means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in payments fraud reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
Who decides, and what the evidence serves.
Financial Crime and Fraud Risk prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Payment regulators and legislators | Who reimburses victims and what prevention duties apply | Loss data, reimbursement outcomes and comparative rules |
| Bank and payment firm fraud functions | Which controls to apply before releasing payments | Fraud patterns, friction cost and detection performance |
| Payment scheme operators | Whether to mandate verification of payee or data sharing | Scheme data and fraud trends |
| Law enforcement | How to target mule networks and organisers | Intelligence from reports and industry data |
Outputs this topic produces
- Guide to unauthorised and authorised push payment fraud
- Comparative notes on victim reimbursement rules
- Brief on mule account detection and data sharing
- Questions for boards on fraud prevention in instant payments
What experts ask.
Payments fraud researchers ask how to stop fraud without stopping legitimate payments.
- How are fraud methods shifting between unauthorised and authorised fraud as controls change?
- How can fraud be detected in real time without excessive friction for legitimate payments?
- How should responsibility for losses be allocated between sending and receiving institutions and customers?
- How do confirmation of payee, delays and other interventions affect fraud and customer experience?
- How can data from payment systems be used to detect fraud across institutions?
Speed, finality and displacement.
Instant payments are valuable because they are fast and final, but those features also make fraud harder to stop and reverse. As controls on card fraud and account takeover improved, fraud shifted towards deceiving customers into authorising payments, which bypasses authentication. Fraudsters use social engineering, impersonation of banks, police or family members, and fake investments or purchases.
Proceeds move quickly through money mule accounts, often at several institutions. Detection relies on monitoring behaviour, devices and payment patterns, and on intelligence sharing. Rules on reimbursement shape incentives: where receiving institutions share liability, they have stronger reasons to prevent mule accounts.
How the evidence is built, and where it stops.
- 01
Transaction monitoring
Machine learning models scoring payments for fraud risk, using artificial intelligence and machine learning. False positives create friction; models degrade as fraud adapts.
- 02
Network analysis
Detecting mule networks across accounts with network science. Requires data across institutions.
- 03
Typology research
Describing fraud methods to inform controls. Must avoid enabling crime.
- 04
Published fraud statistics
Industry and published fraud statistics. Definitions and reporting vary.
How it is studied, and what the methods cannot say.
- 01Artificial intelligence and machine learningReal-time fraud scoring · Alert prioritisation · Fairness in fraud controlsApplied here
- 02Network science and contagionMule network detection · Ownership chain analysis · Cross-institution patternsApplied here
- 03Data engineering, interoperability and stewardshipScreening data quality · Monitoring coverage checks · Retention and minimisationApplied here
- 04Digital identity and public digital systemsAssurance levels for onboarding · Defending against deepfakes · Inclusion testingApplied here
Questions and answers.
What is authorised push payment fraud?
Why is instant payment fraud hard to reverse?
What is a money mule?
Can instant payments be made safer without slowing them?
Does GRA assess individual payment firms?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.