The friction vs fraud problem
In financial services, fraud has become a boogeyman. Attacks are growing. Fraudsters are getting smarter. Successful events cost institutions multiples more than the loss on paper.
While fraud is a serious and growing issue for the banks and credit unions we work with, a fraud control that locks out ten legitimate customers to catch one bad actor has a cost too.
Striking the balance between stopping fraud and providing account holders with a seamless digital banking experience has been difficult, but now, banks and credit unions have more options and better technology to help them find the right solution for their institution.
Why rules alone fall short
Fraud detection in digital banking has largely run on rules. Financial institutions will set fixed thresholds and hunt specific patterns that flag specific behaviors, like cash deposits clustered just under reporting limits, money that arrives and leaves the same day, or a dormant account that suddenly gets busy.
These rules still do a lot of work to catch fraudsters, and they’re not going away. But they have a fundamental weakness: they’re gameable, and many criminals have learned exactly how to stay under the radar.
Take, for example, a contractor paid in several installments, each landing just under $10,000. It looks identical whether someone is deliberately structuring payments to avoid a reporting requirement — itself a violation — or simply paying a bill in a way that happens to land under a threshold. A rules engine can’t tell the difference. It only knows the number.
That’s the core limitation of a rules-only approach. A threshold rule can flag that a transaction is unusual, but it’s not looking across the digital banking sessions to tell you whether the person behind it is behaving like themselves.
How AI is changing fraud detection
Today, financial institutions can deploy AI-driven behavioral analysis inside the digital banking session to learn what normal looks like for each account holder. AI enabled technology is able to read typing cadence, how someone navigates the app, the device they’re are on, and the shape of their mouse path. Tracking these signals is what reveals the small tells of fraud, like when someone is being coached over the phone by a criminal or when an account takeover attack is afoot. The models do this in real time, before the payment leaves the account, and across millions of sessions.
Traditional rules ask the question, “does this transaction look like the others,” while AI models ask, “does the person doing this look like you.” The second question is what catches account takeover and authorized push payment fraud, which are the categories where losses are actually growing.
Illustrating the point
Rules might seem sufficient, but there are many cases where rules flag suspicious activity that, while different from normal transactions, is perfectly legitimate. For example, a user might deposit a large sum of cash from selling an old car, or because of a gift from a relative. With the rise of the gig economy, users might pick up a side hustle that produces forty small payment-app deposits a month, where there used to be a standard bi-monthly payment. In isolation, each of these examples could be flagged by a rules-based model, causing friction with legitimate account holders.
This is where AI-driven behavioral models do a much better job than rules. A threshold rule looks at an usual deposit and fires off a warning flare. A behavioral model looks at everything around it, such as noting that the customer typed calmly, navigated the deposit screen the same way they always do, was on their usual device, did not linger on a screen looking for guidance, and did not send the money right back out to a new payee. Those context signals are what let a good model clear an innocent transaction that a rules engine would freeze. The reverse is also true. A criminal moving stolen money often trips no threshold at all, but the session behavior around the transfer is completely different from the real customer, and the model catches that.
Restricted entitlements as the middle ground
For years, banks and credit unions were limited to a binary choice when handling suspicious fraud activity. They could either let the user through or freeze the account. But now AI is enabling a more nuanced option, restricted entitlements. Instead of freezing the whole account, the institution turns off the specific ability that looks risky, such as adding a new payee, initiating a wire, or changing the email on file, leaving everything else running. This is only possible with AI-driven detection that produces a specific reason for the concern, and it is the direction fraud programs are moving.
In addition to introducing restricted entitlements, AI-driven detection is also producing better inputs to the freeze-or-close decision. Older systems would produce a generic “this account looks risky” flag. Modern behavioral models produce a specific reason, a confidence score, and a recommended narrow action. That should mean fewer full account freezes, more restricted entitlements, and closures reserved for cases where the pattern repeats.
What financial institutions can do about it
Many banks and credit unions are investing in AI to tackle fraud. But how can they ensure they’re creating an intelligent fraud strategy, not just creating more layers of unnecessary friction? Based on what I’ve seen work, there are five things banks and credit unions should prioritize:
- Invest in behavioral detection, not just more rules. The gap between institutions that have made this investment and those that haven’t is now visible in the customer experience of fraud holds. Rules-based systems produce blunt alerts. Behavioral models produce specific ones — and that specificity is what makes a graduated response possible.
- Adopt restricted entitlements as the default response. When a model flags an outbound wire, hold the wire. Don’t shut off the debit card, bill pay, or direct deposit at the same time. Turning off one specific ability while leaving the rest of the account running is the single biggest customer-experience improvement fraud teams can make right now — and very few banks or credit unions are actually using that capability yet.
- Tell the customer what they can do to resolve a hold. Plain language matters here, even when the financial institution can’t disclose why the hold happened in the first place.
- Let customers get ahead of it. A large deposit, a big transfer, travel plans — when customers can flag these in advance, verification happens before the hold instead of after.
- Measure false positives and time-to-resolution as customer experience numbers, not just compliance numbers. Every fraud program built on behavioral AI should have those two metrics on its main dashboard, not buried in a quarterly compliance review.
Finding the right balance
The goal isn’t zero friction, as some friction is unavoidable to stop fraud in its tracks. But that friction should be small, targeted, explained, and reversible in minutes rather than weeks. That’s what restricted entitlements paired with behavioral AI are built to deliver.
So no, the boogeyman isn’t going anywhere. Fraud is still growing, and criminals are still getting more sophisticated. But the response doesn’t have to be extreme just because the threat is real.
