AI fraud detection in banking

A fraud model compares a payment with what is normal for that customer, that device and that merchant: the amount, the time, the place and the payee. Supervised models learn from past cases that were confirmed as fraud, and unsupervised models flag behavior that stands out without such labels. Coursera's overview adds graph neural networks, which look at links between accounts, and computer vision for forged documents. In the 2025 Alloy survey it quotes, 59 percent of firms ran supervised machine learning next to their rule sets.

Speed decides the design. NVIDIA quotes American Express, whose models check every card transaction worldwide in real time, more than USD 1.2 trillion in spending a year, and decide in milliseconds. NVIDIA also names the problem every fraud team knows: confirmed fraud cases are rare, so there are few labels to train on, and a model that flags too much buries analysts in false positives.

The joint report of the EBA and the ECB puts payment fraud in the EEA at EUR 4.2 billion for 2024, up from EUR 3.5 billion a year earlier. For credit transfers, customers bore about 85 percent of the losses, mainly because scammers got them to send the money personally. Card fraud was about 17 times higher when the payee sat outside the EEA.

The shift to scams changes what a model looks for. A stolen card shows up in unusual device and location data. A customer who sends money after a fake bank call uses the customer's own phone and login, so the signal is in the payment itself: a new payee, an unusual amount, a hurried session. Authorized push payment fraud and money mules cover both ends of such a scam, and verification of payee covers the name check before a transfer.

The EU AI Act treats credit scoring of natural persons as high-risk, but Annex III, point 5(b) excludes AI systems used to detect financial fraud from that entry. A fraud model is therefore not a high-risk system for that reason alone. It still runs under the bank's ICT and model risk rules, and BaFin treats AI systems as ICT under DORA.

Strong customer authentication and the payment services rules set the frame for what a fraud score may trigger: a block, a second factor or a call to the customer. Fraud prevention in Germany covers liability under the German Civil Code and the role of SCA in detail.

The two run together in most banks. Rules catch known patterns and are easy to explain to an auditor. Models catch combinations no one wrote a rule for. The Alloy survey cited by Coursera found that 99 percent of respondents had AI in their fraud prevention, most of them next to a rule engine.

Yes. Generated voices, faces and documents make fake bank calls and fake identities more convincing. Deepfake attacks on onboarding covers the identity side, where injected video tries to pass a video identification. Insurers see generated images of damage in claims, as described on AI in insurance.