Credit Risk and Fraud

If you think Stripe Radar is enough, you're covering maybe a third of the fraud vectors that matter. Modern fraud isn't just stolen cards. It's account takeovers, synthetic identities, bot attacks, friendly fraud, and money laundering each requiring its own defense layer. That's why fraud prevention has split into a full stack of specialized tools. Card fraud is still massive, but its share of total losses keeps shrinking. In many verticals, transactional fraud is no longer the biggest threat. Sift is a good illustration. Often seen as a generic fraud tool, it processes signals far beyond payments: ~70% of its detections relate to non-payment events (logins, signups, content abuse) ~1 trillion events analyzed per year ~34,000 sites and apps protected globally And here's the shift almost nobody talks about: the card networks and bureaus are quietly buying up the entire stack. Visa now owns Featurespace and Verifi. Mastercard owns Ethoca and NuData. Equifax owns Kount and Midigator. LexisNexis owns ThreatMetrix. Entrust absorbed Onfido. "Beyond Stripe Radar" increasingly means "beyond a handful of giants." The full stack today: - End-to-End Fraud Platforms: Sift, Forter, Riskified, Signifyd, Sardine, SEON, ClearSale, NoFraud, Ravelin Technology - Device Intelligence & Behavioral Biometrics: Fingerprint, Incognia, BioCatch, ThreatMetrix, Castle, SHIELD, Callsign, NuData Security, a Mastercard company, Darwinium, Trustfull - Identity Verification & KYC: Persona, Alloy, Sumsub, Socure, Onfido, Veriff, Jumio Corporation, Incode, iProov, Trulioo, Mitek Systems, IDnow, GBG - AML & Transaction Monitoring: ComplyAdvantage, Hawk AI, Unit21, Feedzai, NICE Actimize, Quantexa, SAS, FICO, Nasdaq Verafin, Chainalysis, ACI Worldwide, DataVisor - Bot Protection & Account Takeover: Arkose Labs, HUMAN, DataDome, Cloudflare, Kasada, Imperva, Akamai, Netacea, Trusona - Chargeback & Dispute Management: justt, Chargeflow, Ethoca, Verifi Inc., Kount, Midigator, Chargebacks911 Attacker behavior explains the split. AI-generated synthetic identities, credential stuffing at scale, and organized fraud rings have made single-layer defenses obsolete. A rough 2026 picture of where losses sit: ~45% account takeovers and identity fraud ~30% transactional and card fraud ~25% chargebacks and friendly fraud Real-time decisioning, shared fraud networks, and AI-driven risk scoring keep accelerating the trend. Fraud prevention is no longer a feature. It's becoming critical infrastructure for every digital business. PS: I post about payments with Suby, stablecoins & the reality of building a payment startup, every week. Follow for more!

If fraud cases are fewer, does that really mean the system is cleaner? That was the question that came to mind while reading the RBI Annual Report for FY26. The report says bank fraud cases fell by 57%. At first glance, that sounds reassuring. But the amount involved rose by 46%, from ₹32,803 crore to ₹48,021 crore. This is the part that deserves more attention. A fall in the number of cases may mean many things. It could mean better controls in some areas, fewer small-value frauds, better filtering, or even different reporting patterns. But when the value rises at the same time, the question changes from, “𝗔𝗿𝗲 𝗳𝗿𝗮𝘂𝗱 𝗰𝗮𝘀𝗲𝘀 𝗿𝗲𝗱𝘂𝗰𝗶𝗻𝗴?” to “𝗪𝗵𝗲𝗿𝗲 𝗶𝘀 𝘁𝗵𝗲 𝗺𝗼𝗻𝗲𝘆 𝗴𝗲𝘁𝘁𝗶𝗻𝗴 𝗰𝗼𝗻𝗰𝗲𝗻𝘁𝗿𝗮𝘁𝗲𝗱?” The RBI data gives a clear answer. Out of ₹48,021 crore, ₹40,774 crore came from the advances category. That is around 85% of the total fraud value. In simple terms, the largest fraud exposure is sitting in credit. So the more useful question is whether enough attention is being paid to: • borrower financials • collateral valuation • end-use monitoring • related party structures • credit appraisal quality • early warning signals • post-sanction follow-up Interestingly, these frauds are slower and harder to see because they sit inside documents, valuations, projections, and monitoring gaps. And by the time they are detected, the original decision may already be several years old. RBI’s reporting basis matters because of this. A fraud reported in FY26 may not have originated in FY26. In large loan frauds, detection often comes much later. The ₹40,774 crore reported under advances may also be a delayed reflection of earlier credit cycles, and not just the fraud picture of FY26. When you look at a global level, the ACFE’s 2026 RTTN points to a similar pattern. Financial statement fraud formed only 6% of the cases studied, but caused the highest median loss at $1 million per case. That is the uncomfortable part about high-value fraud. It does not always show up frequently. But when it does, it is rarely small. For banks and financial institutions, the learning is clear: lower case numbers should not make us comfortable unless the control environment behind large-value credit decisions has also improved. Because fraud does not always reduce. Sometimes, it only becomes more concentrated. #BankFraud #ForensicAccounting #CreditRisk #FraudRisk #FinancialStatementFraud #Governance #RBI #ACFE

What to read this weekend: 📊 Rising Threats Across Payment Instruments The 2024 joint report from the EBA and ECB sheds critical light on the evolution of payment fraud across the EU/EEA. With total fraud losses amounting to €4.3 billion in 2022 and €2.0 billion in H1 2023, the analysis confirms that financial crime threats remain persistent—particularly in credit transfers and card payments. These two instruments alone accounted for over €1.7 billion in fraud losses in just six months. 💳 Card Fraud Dominance Card fraud remains the most prominent in both volume and value: • 7.31 million fraudulent card transactions were recorded in H1 2023. • Remote card fraud made up 82% of the value and 80% of volume. • Most common methods? Card details theft (64% of remote fraud) and lost/stolen cards (53% of non-remote fraud). This underlines the need for enhanced e-commerce security and controls in digital payments. 🔐 SCA: A Double-Edged Sword Strong Customer Authentication (SCA) has played a pivotal role in reducing fraud: • SCA was applied to 77% of credit transfers, 65% of card payments, and 64% of e-money payments by value. • Transactions authenticated using SCA showed significantly lower fraud rates. However, the exemptions—like those for trusted beneficiaries and low-value contactless payments—are areas of heightened vulnerability, particularly when misused. 📍 Cross-Border Fraud: A Persistent Weakness More than 70% of card fraud by value and 43% of credit transfer fraud were cross-border, often with counterparts outside the EEA. Fraud rates for these transactions were up to 10 times higher than those within the EEA, where PSD2 and SCA are fully enforced. 💸 Who Bears the Loss? In H1 2023: • 86% of credit transfer losses were borne by payment service users (PSUs). • PSU liability for card fraud varied dramatically—reaching 80% in some countries. This discrepancy emphasizes the importance of consistent liability frameworks, transparent user protection policies, and proactive fraud detection tools at the PSP level. 🌍 Compliance Outlook for 2025 With EMV standards maturing and RTS requirements in place, there’s cautious optimism about stabilizing fraud levels. But regulatory bodies and FCC officers must remain vigilant: • Ensure proper application of SCA and exemptions. • Monitor geographical fraud patterns. • Investigate disparities in PSU liability. Staying ahead requires collaborative intelligence sharing, harmonized fraud definitions, and advanced data analytics to identify and react to emerging risks. #compliance #financialcrime #fraud #regulatory #sanctions #payments

🚨Recent Standard Chartered bank's credit card fraud incidents in Bangladesh aren’t just individual cases- they expose industry-wide trust gaps. In multiple reports, BDT 50K+ was transferred to MFS accounts within seconds -without customers ever sharing their OTPs. The response from banks? 👉”Since it was OTP verified, it’s not fraud.” But as Product Managers, we know the issue isn’t that simple. This is a product trust challenge, security issues- not just a compliance checklist. 🔎Probable Loopholes I see as a PM: • SMS Gateway Leak → Banks rely on 3rd-party SMS providers. If OTPs leak there, fraud is inevitable. • Excessive 3rd-Party Access → Outsourced vendors (like BPOs) sometimes get full database access. That’s a massive risk. • Weak Fraud Detection → Same High-value, unusual card-to-MFS transfers aren’t flagged in real time. ✅Possible Solutions (Tech + Product): • Shift from sms based OTP → adopt stronger MFA (biometric, facial recognition, in-app approvals). • AI/ML fraud models → detect similar transaction predict as scam alert in real-time and block suspicious transactions. • Fraud scoring system → device, location & transaction velocity checks before approval. • Joint monitoring frameworks → Bank + MFS + Telco working in sync. • Access governance → limit & audit vendor access instead of full DB exposure. ❇️But It is evident that these fraud incidents may involve internal collusion- whether through bank employees, OTP gateway providers, or outsourced BPO companies. In such cases, the bank must acknowledge the issue and take full responsibility, rather than denying accountability. 💡Digital finance adoption is growing — but without security & trust, growth won’t sustain. As PMs, our role isn’t just building features. It’s safeguarding user trust at every touchpoint.

"Self-register", fraudster slang for opening a bank account in a victim's name. And there's an entire supply chain behind it. The research team at Heka Global surfaced a dark web marketplace that covers both ends of the operation: 🔍 Before: A $15 lookup service to check any victim's CR (credit report) and CS (credit score), searchable by SSN, reverse SSN, even driver's license. In fraudster guides on "self-registering" accounts or cashing out loans, this step is always emphasized: get good "fullz" (full identity information), build a synthetic identity, and pre-check the credit profile to see if the identity is worth using. 💳 After: The finished product, sold openly. Self-registered Capital One, GoBank, Bluevine and Bluebird accounts, complete with login credentials, available credit, cookies, Apple Pay/Google Pay enabled, even mail recovery access. Priced $52–$199, filterable by state. That last part deserves a pause: these accounts passed onboarding. KYC checks, credit pulls, device checks, all cleared. Now they're inventory. The implication for risk teams: A clean credit profile isn't proof of a legitimate applicant, sometimes it's precisely why that identity was chosen. Catching this requires signals fraudsters can't pre-check or fake at scale: web intelligence, digital footprint, behavioral data, off-bureau data, dark web intelligence, network analysis and more. Having challenges with your onboarding fraud stack? Lets chat. P.S. Love how the FaaS provides 24 hour guaranties and FAQ pages.

The cost of fraud is rising globally. According to the latest TransUnion report: companies lost an average of 7.7% of revenue to fraud in the past year — equivalent to $534 billion globally. That's up from 6.5% in 2024. 💰 Nearly a quarter (24%) of business leaders cited scam/authorized fraud as the most prominent cause of reported fraud losses. 📈 Account takeover attacks jumped 141% since 2021, with 21% increase from H1 2024 to H1 2025. 🔓 Account creation is now the riskiest point in the consumer lifecycle, with 8.3% of new account attempts are suspected fraud. 🪪 77% of US data breaches included full Social Security number in H1 2025, feeding more sophisticated fraud. But there are ways organizations are fighting back using technology, including the use of multi-layered identity verification, moving beyond passwords to biometrics and behavioral signal. The key takeaway? 👉 Assume all identity data is compromised. The question isn't if your organization will be targeted, but whether your defenses can tell real customers from sophisticated fraudsters. Investing in smarter fraud detection is a must. ✅ Prioritize an enterprise-wide approach to fraud prevention to overcome fragmented systems that are more vulnerable to exploitation. ✅ Bolster each layer of your defenses. ✅ Reduce consumer identity fragmentation through better data and risk signals, advanced analytics and integrated technology. Full report here: https://lnkd.in/eYYPszBv #AI #fintech #financialservices #fraud

💥 Fincrime Mythbusters 💥 Myth#22 ~ Know Your Customer (KYC) ❌ Myth: We know our customer. 🔸 We onboarded them under a robust CDD framework. 🔸 We screened sanctions, PEPs and adverse media. 🔸 We applied a risk rating. 🔸 We completed EDD where required. 👉 File signed off. Governance satisfied. So yes - we know our customer. ✔️ Reality: You knew your customer at onboarding – (once upon a time) The risk is dynamic, these day customer identities are fluid. A low-risk customer can quietly become: 🔸 A money mule recruited via social media 🔸 A layering account in a wider laundering chain 🔸 A synthetic identity maturing over years 🔸 A scam exit account used for romance or investment fraud 👉 And often documents never change, the risk does. ⚖️ UK Regulations ♦️ Under the Money Laundering Regulations 2017, regulation 28 mentions that firms must conduct ongoing monitoring, including scrutiny of transactions and keeping CDD information up to date. ♦️ The FCA is clear on CDD – it is not a one-time, tick box exercise, but an ongoing, risk-based requirement that must be applied throughout the customer relationship. 👉 Where does ‘I know my customer’ fail? 1️⃣ Mule evolution A student account opened legitimately in 2024. By 2025, it is receiving high-velocity inbound payments from unrelated third parties, immediately transferred onward. ➡️ The onboarding file? clean ➡️ The behavioural profile? completely different 2️⃣ Synthetic identity risk Fraudsters combine real and fabricated data, for example; genuine NI numbers, manipulated addresses, thin-file credit histories. The identity builds credibility slowly and then a coordinated bust-out across institutions. ➡️ Documents pass checks ➡️ The identity itself is engineered 3️⃣ Account opened to move proceeds of crime Investment fraud victims are instructed to move funds through ‘trusted’ accounts. These accounts may belong to coerced individuals or compromised customers. ➡️ The original purpose? personal account ➡️ The current role? criminal conduit. 👉 What real ‘Knowing Your Customer’ should look like? ✔️ Continuous behavioural monitoring ✔️ Cross-team intelligence sharing (KYC + Fraud + AML + Sanctions) ✔️ Dynamic risk re-scoring ✔️ Vulnerability flag ✔️ Data-led trigger reviews (not just periodic reviews) ✔️ Clear first-to-second line escalation pathways ✋ There is a massive change from asking ‘Was the onboarding compliant?’ instead it should say ‘Did we see the risk evolving?’ ⚔️ Chaos isn’t a pit. Chaos is a ladder. Criminals don’t fear chaos, they exploit it. Fragmented controls are their ladder. #FinCrimeMythbusters #AML #fraud #scams #silos #financialcrimeprevention   (Image credit: ChatGPT, words are mine)

🚨 FRAUD IS EVOLVING FASTER THAN CONTROLS. From AI-enabled scams and synthetic identities to trade-based money laundering, procurement manipulation, cyber-enabled financial crime, and ESG fraud — the modern fraud landscape has become multidimensional, borderless, and highly sophisticated. I have compiled a comprehensive infographic on the “Top 100 Fraud Typologies” covering: 🔍 Core Fraud Elements 💰 Financial & Banking Fraud 🌐 Cyber & Digital Fraud 🏦 AML & Money Laundering Typologies 📊 Accounting & Financial Statement Manipulation ⚖️ Corruption & Procurement Fraud 🛡️ Investigation Methodologies 🚨 Prevention, Detection & Deterrence Controls The objective is simple: To help Fraud Examiners, AML Analysts, Compliance Officers, Investigators, Auditors, Risk Professionals, and Law Enforcement personnel strengthen their fraud-risk intelligence framework. Key takeaway: Fraud is no longer just a compliance issue — it is an enterprise risk, reputational risk, cyber risk, and national security risk. Critical controls every organization must prioritize: ✔️ Transaction Monitoring ✔️ Enhanced Due Diligence (EDD) ✔️ Behavioral Analytics ✔️ AI-assisted Detection Models ✔️ Vendor Risk Management ✔️ Continuous Control Testing ✔️ Whistleblower Mechanisms ✔️ Cross-border Intelligence Sharing As FATF, Wolfsberg, Basel, ACFE, and global regulators continue tightening expectations, organizations that fail to modernize fraud detection frameworks will face escalating operational and regulatory exposure. “Prevent. Detect. Investigate. Deter.” is no longer a slogan — it is a strategic necessity. What emerging fraud typology concerns you the most in 2026? #FraudRiskManagement #FraudExamination #AML #FinancialCrime #Compliance #TransactionMonitoring #KYC #EDD #FraudInvestigation #CyberFraud #MoneyLaundering #InternalAudit #RiskManagement #ForensicAccounting #ACFE #Banking #FinancialServices #AntiFraud #CorporateGovernance #FinCrime

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐓𝐲𝐩𝐞𝐬 𝐨𝐟 𝐂𝐫𝐞𝐝𝐢𝐭 𝐑𝐢𝐬𝐤 𝐢𝐧 𝐁𝐚𝐧𝐤𝐬 𝐖𝐢𝐭𝐡 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐄𝐱𝐚𝐦𝐩𝐥𝐞𝐬 In banking, credit risk goes far beyond borrower default. It is a layered and interconnected framework that influences capital allocation, pricing, portfolio strategy, and long-term stability. Here are the 10 major types of credit risk explained with practical context: 𝐃𝐞𝐟𝐚𝐮𝐥𝐭 𝐑𝐢𝐬𝐤 When a borrower fails to repay principal or interest. •Example: An SME borrower stops servicing a term loan due to cash flow stress. 𝐃𝐨𝐰𝐧𝐠𝐫𝐚𝐝𝐞 𝐑𝐢𝐬𝐤 Decline in a borrower’s credit rating, increasing perceived risk. •Example: A corporate rated A gets downgraded to BBB after declining profitability. 𝐂𝐫𝐞𝐝𝐢𝐭 𝐒𝐩𝐫𝐞𝐚𝐝 𝐑𝐢𝐬𝐤 Change in the yield difference between debt instruments due to risk perception. Example: Bond spreads widen during economic uncertainty, reducing portfolio value. 𝐂𝐨𝐧𝐜𝐞𝐧𝐭𝐫𝐚𝐭𝐢𝐨𝐧 𝐑𝐢𝐬𝐤 Excessive exposure to one borrower, group, sector, or geography. •Example: A bank heavily exposed to the real estate sector during a property slowdown. 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲 / 𝐌𝐚𝐫𝐤𝐞𝐭 𝐑𝐢𝐬𝐤 Adverse developments affecting a specific sector. •Example: Regulatory changes impacting NBFCs or telecom companies. 𝐒𝐨𝐯𝐞𝐫𝐞𝐢𝐠𝐧 𝐑𝐢𝐬𝐤 Risk related to a country’s financial stability and repayment capacity. •Example: Lending exposure to companies operating in politically unstable regions. 𝐋𝐢𝐪𝐮𝐢𝐝𝐢𝐭𝐲 𝐑𝐢𝐬𝐤 Inability of a borrower to generate sufficient cash to meet obligations. •Example: A company with strong assets but poor working capital management. 𝐈𝐧𝐭𝐞𝐫𝐞𝐬𝐭 𝐑𝐚𝐭𝐞 𝐑𝐢𝐬𝐤 Impact of interest rate movements on loan repayment capacity. •Example: Rising rates increase EMI burden, leading to stress in retail home loans. 𝐑𝐞𝐠𝐮𝐥𝐚𝐭𝐨𝐫𝐲 𝐑𝐢𝐬𝐤 Changes in regulations affecting borrower operations or bank exposures. •Example: Sudden policy restrictions on certain lending segments. 𝐌𝐨𝐫𝐚𝐥 𝐇𝐚𝐳𝐚𝐫𝐝 𝐑𝐢𝐬𝐤 Misrepresentation of financial information by borrowers. •Example: Inflated receivables shown to secure higher working capital limits. 𝐄𝐟𝐟𝐞𝐜𝐭𝐢𝐯𝐞 𝐜𝐫𝐞𝐝𝐢𝐭 𝐫𝐢𝐬𝐤 𝐦𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐭𝐨𝐝𝐚𝐲 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐬: • Deep financial analysis • Sectoral understanding • Portfolio diversification • Continuous monitoring • Stress testing under multiple scenarios In a volatile environment, the biggest losses often arise not from a single default but from overlooked concentration, sectoral, or structural risks. Sachin Kumar #CreditRisk #Banking #RiskManagement #CreditAnalysis #FinanceProfessionals #Lending #BankingLeadership