Fraud Risk Management and Control Systems

Introduction

Fraud risk management is the coordinated process through which a bank identifies, assesses, prevents, detects, investigates, responds to, and learns from deceptive or dishonest conduct. It is broader than transaction monitoring. An effective programme links governance, people, processes, technology, customer authentication, internal control, investigation, recovery, and performance measurement.

Banks face both external and internal fraud. External fraud includes account takeover, payment manipulation, identity fraud, card fraud, loan application fraud, phishing, and social engineering. Internal fraud includes misappropriation of assets, unauthorised trading, collusion, corruption, falsification of records, and abuse of privileged access. Cyber-enabled fraud increasingly crosses these categories: criminals may compromise a customer, recruit an insider, exploit a control weakness, and launder proceeds through several institutions.

Fraud risk is difficult to manage because losses are often infrequent but severe, fraud patterns change rapidly, legitimate customers may resemble criminals, and controls can create friction. The objective is therefore not to eliminate every suspicious event. It is to reduce expected and extreme losses while preserving legitimate service, legal compliance, customer trust, and operational efficiency.

Learning Objectives

After completing this chapter, the learner should be able to:

1. Explain an enterprise fraud risk-management framework.
2. Conduct a fraud risk assessment and construct a risk register.
3. Design preventive, detective, investigative, corrective, and recovery controls.
4. Evaluate segregation of duties, authentication, access, and control-testing arrangements.
5. Measure fraud losses and interpret fraud-control performance indicators.
6. Apply analytics and artificial intelligence responsibly in fraud management.
7. Analyse governance, ethical, regulatory, and operational trade-offs.

1. Fraud Risk as an Enterprise Risk

Fraud risk is the possibility that intentional deception or abuse will cause financial, regulatory, operational, reputational, or customer harm. It differs from accidental error because intent is central, although intent may be difficult to prove. Fraud risk also differs from ordinary cyber risk: a cyber incident may compromise confidentiality without deception, whereas a fraud event generally seeks an unauthorised benefit.

A useful enterprise view considers four interacting elements:

• Threat: the actor, motive, capability, and method.
• Vulnerability: a weakness in process, technology, human behaviour, or governance.
• Opportunity: the circumstance that permits the weakness to be exploited.
• Impact: financial loss, customer harm, regulatory consequences, or damage to trust.

Fraud risk is dynamic. A new instant-payment service, mobile channel, outsourcing arrangement, or artificial-intelligence tool can change both threat exposure and control effectiveness. Risk ownership therefore belongs to business management, while specialist fraud, security, compliance, legal, audit, and data teams provide expertise and challenge.

2. The Enterprise Fraud Management Framework

A mature framework operates as a cycle rather than a one-time project:

1. Governance and strategy: establish policy, accountability, risk appetite, reporting, and escalation.
2. Risk assessment: identify fraud scenarios, causes, controls, residual risk, and treatment priorities.
3. Prevention: make fraudulent activity difficult or uneconomic before execution.
4. Detection: identify anomalies, suspicious behaviour, control breaches, and emerging patterns.
5. Investigation and response: preserve evidence, decide proportionate action, and protect customers.
6. Recovery and remediation: recover assets, correct records, compensate where appropriate, and repair weaknesses.
7. Assurance and learning: test controls, measure outcomes, analyse incidents, and update the framework.

A three-lines model is useful. The first line consists of business and operations, which own risks and operate controls. The second line includes fraud risk, compliance, information security, and risk functions, which set standards, monitor, and challenge. The third line is internal audit, which provides independent assurance. The board or an appropriate committee approves risk appetite and receives material fraud reporting.

A fraud policy should define prohibited conduct, reporting duties, investigation authority, evidence standards, disciplinary principles, customer treatment, data use, whistleblowing, conflicts of interest, and regulatory notification. Policies must be supported by procedures; a policy that cannot be translated into operational decisions is not an effective control.

3. Fraud Risk Assessment

3.1 Scenario-based assessment

Fraud assessments should be scenario-based rather than limited to broad labels such as “payment fraud.” A scenario states who may act, what asset or process is targeted, how the act occurs, which control is bypassed, and what consequences follow. Examples include:

• an employee creates a fictitious customer and approves a loan;
• a criminal acquires a customer’s credentials and adds a new payment beneficiary;
• a colluding employee overrides a sanctions or transaction-monitoring alert;
• a fraudster uses synthetic identity information to open several accounts;
• a merchant and cardholder collude to create false chargebacks.

The assessment should consider inherent risk before controls and residual risk after controls. It should include products, channels, geographies, customer segments, third parties, staff roles, and privileged technology access.

3.2 Scoring and prioritisation

A simple qualitative model may classify likelihood and impact as low, medium, or high. A quantitative expected-loss model can be expressed as:

Here, EL is expected loss per assessment period, pᵢ is the probability of scenario i occurring during that period, and Lᵢ is the monetary loss if scenario i occurs. The model assumes scenarios are sufficiently defined and that probabilities and losses are measured on the same time basis. It is useful for prioritisation but does not capture all reputational, legal, or systemic effects.

Where control effectiveness is represented explicitly, a simplified residual expected loss is:

REL is residual expected loss and eᵢ is the proportion of loss exposure reduced by controls for scenario i, where 0 ≤ eᵢ ≤ 1. This is an analytical approximation, not a claim that controls act independently. Correlated controls, adaptive adversaries, detection delays, and recovery proceeds must be considered in serious models.

Risk scoring should not conceal uncertainty. A risk register should record the scenario, owner, inherent likelihood, inherent impact, key controls, control owner, residual rating, assumptions, evidence, treatment plan, target date, and escalation threshold. High-impact low-frequency events should not be dismissed merely because their average frequency is low.

3.3 Risk appetite and treatment

Management may accept, reduce, transfer, or avoid a risk. Insurance or outsourcing transfers only part of the exposure; accountability and residual risk remain with the bank. Treatment decisions should consider customer friction, false positives, accessibility, privacy, and the possibility that controls displace rather than eliminate fraud.

4. The Fraud Control System

4.1 Preventive controls

Preventive controls operate before or at the point of transaction. Important examples include:

• customer due diligence and beneficial-owner verification;
• device binding, secure credential management, and strong authentication;
• transaction limits, cooling-off periods, and beneficiary confirmation;
• maker-checker approval for sensitive actions;
• role-based access and privileged-access management;
• secure software development and change approval;
• employee screening, training, declarations, and conflict management;
• supplier due diligence and contractual audit rights;
• data-quality validation and duplicate detection.

Prevention should be risk-based. Applying maximum friction to every transaction may encourage unsafe workarounds and harm vulnerable customers. Conversely, high-risk actions such as changing contact details, adding a beneficiary, or releasing a large payment warrant stronger controls than routine low-value activity.

4.2 Detective controls

Detective controls identify events that have occurred or are in progress. They include rules, behavioural analytics, reconciliation, exception reports, complaints analysis, whistleblowing, access-log review, and post-transaction sampling.

A rule might alert when a new device, new beneficiary, unusual location, and high-value payment occur together. Rules are transparent and easy to govern, but criminals learn stable thresholds. Behavioural models can detect deviations from a customer’s normal pattern, but they require quality data and careful validation. Detection should use layered signals rather than a single indicator.

A detection system should distinguish:

• alert: an item requiring review;
• case: a structured investigation containing linked alerts, evidence, decisions, and actions;
• confirmed fraud: an event supported by sufficient evidence under policy;
• false positive: an alert that does not justify a fraud conclusion.

4.3 Investigative and corrective controls

Investigation must be independent enough to avoid conflicts, but integrated with operations, security, legal, compliance, and customer-protection functions. A standard case process includes triage, preservation of evidence, identity and transaction verification, network analysis, interviews where appropriate, decision recording, escalation, and closure.

Evidence may include authentication records, device and session data, call recordings, transaction histories, access logs, approvals, emails, application documents, and blockchain or payment-network information. Evidence handling should preserve integrity, provenance, access restrictions, and retention requirements. Investigators must separate facts, assumptions, allegations, and conclusions.

Corrective action may include blocking or reversing transactions, restoring accounts, resetting credentials, notifying affected parties, disciplining staff, closing exploited accounts, improving rules, and reporting to authorities. Customer protection should be prompt and fair. A customer’s failure to follow security advice does not automatically establish negligence or remove the bank’s obligations.

4.4 Recovery

Recovery includes payment recall, account freezing under lawful authority, chargeback processes, asset tracing, insurance claims, restitution, and legal action. Recovery should be measured separately from prevention because recovered funds do not erase the cost of investigation, customer disruption, regulatory exposure, or lost confidence.

5. Segregation of Duties and Access Governance

Segregation of duties (SoD) prevents one person from controlling incompatible stages of a process. Typical incompatible duties include:

• creating a customer and approving credit;
• creating a beneficiary and releasing payment;
• developing code and approving its production deployment;
• entering a journal and approving reconciliation;
• investigating a case and approving its closure;
• administering access and reviewing one’s own access.

SoD is not merely an organisation chart. It must be implemented through workflow permissions, dual approval, independent review, privileged-access controls, and monitoring of emergency overrides. Small branches may not have sufficient personnel for perfect separation; compensating controls can include retrospective independent review, automated limits, rotation, and centralised approval.

Access should follow least privilege, need-to-know, time limitation, and strong authentication. Joiner-mover-leaver processes must remove access promptly when roles change or employment ends. Dormant accounts, shared credentials, excessive administrator rights, and unreviewed service accounts are common control weaknesses.

6. Customer Authentication and Transaction Authorisation

Authentication establishes confidence that a user is the legitimate account holder; authorisation determines whether the requested action may proceed. These are distinct. A correctly authenticated account can still be used to initiate a coerced or socially engineered payment.

Authentication factors generally include:

• knowledge, such as a password or PIN;
• possession, such as a registered device or security token;
• inherence, such as a biometric characteristic;
• contextual or behavioural evidence, such as device reputation, location, typing pattern, or transaction behaviour.

Multi-factor authentication combines independent factors. A password plus a one-time code delivered to the same compromised device may provide less independence than a phishing-resistant cryptographic authenticator. Biometrics can improve convenience but require careful treatment of privacy, liveness, template protection, accessibility, and fallback procedures.

Transaction authorisation should incorporate transaction binding: the customer should be shown meaningful details, such as beneficiary and amount, and the approval should be cryptographically or operationally linked to those details. Step-up authentication is appropriate when risk rises, but excessive challenges create abandonment and customer frustration.

A risk-based decision can be conceptualised as:

where R is transaction risk, I is identity confidence, B is behavioural deviation, D is device and channel risk, C is transaction context, and H is historical information. The function f is institution-specific; it is not a universal equation. It should be validated for discrimination, stability, fairness, and explainability.

7. Fraud Analytics and Artificial Intelligence

Fraud analytics combines rules, statistical analysis, supervised learning, unsupervised anomaly detection, graph analysis, and human investigation. Supervised models learn from labelled historical cases. They can be effective where labels are reliable, but confirmed fraud is only a portion of actual fraud and may reflect past investigative priorities. Unsupervised methods identify unusual patterns without requiring complete labels, but unusual does not mean fraudulent.

Graph analysis is valuable for linking accounts, devices, addresses, merchants, telephone numbers, beneficiaries, and employees. A cluster of apparently unrelated accounts sharing devices or receiving funds from common sources may reveal an organised network.

Model governance should include documented purpose, data lineage, feature controls, validation, threshold approval, performance monitoring, drift detection, access control, and a process for human override. Models should not use protected or irrelevant attributes as unjustified proxies. Explainability is particularly important where a decision may freeze funds, deny service, or affect a customer’s legal rights.

Artificial intelligence can assist triage, summarise cases, detect networks, and prioritise alerts. It should not be treated as an autonomous investigator without controls. Generative systems may hallucinate evidence, expose confidential data, reproduce bias, or obscure reasoning. Human accountability, secure deployment, testing, and audit trails remain necessary.

8. Control Testing and Assurance

Control design asks whether a control could address the stated risk. Operating-effectiveness testing asks whether it actually operated consistently during the review period. Both are required.

Testing methods include inspection of evidence, observation, inquiry, reperformance, data analysis, access simulation, red-team exercises, and sample testing. A test plan should define the population, sampling method, period, control criterion, evidence standard, exception treatment, tester independence, and remediation deadline.

For a simple random sample estimating a proportion, an approximate large-population sample-size formula is:

n₀ is the initial sample size, z is the chosen standard-normal critical value, p is the anticipated exception proportion, and E is the permitted margin of error. The formula assumes random sampling and an approximately independent binary outcome. If p is unknown, 0.5 gives the largest variance and therefore a conservative size. Finite populations, stratification, clustering, non-response, and audit-risk requirements may require adjustment. In internal control testing, statistical precision is only one consideration; a single critical exception may be more important than a low overall exception rate.

Findings should identify condition, criterion, cause, consequence, risk rating, owner, action, due date, and validation evidence. Repeated findings indicate a systemic weakness, not merely isolated employee error.

9. Loss Measurement and Performance Indicators

Fraud measurement must use consistent definitions and time periods. Important categories include attempted fraud, prevented fraud, confirmed gross loss, recovered amount, net loss, customer reimbursement, investigation cost, and control cost.

A basic net-loss identity is:

The identity assumes all terms refer to the same population, currency, and accounting period. Investigation, remediation, legal, and customer-support costs may be reported separately or included in a broader total-cost measure, but the treatment must be explicit.

Useful indicators include:

Indicators require denominators. A rising number of alerts may reflect improved detection, increased threat, or deteriorating data quality. A falling loss rate may reflect prevention, under-reporting, delayed confirmation, or displacement to another channel. Dashboards should therefore combine outcome, activity, quality, timeliness, customer, and control-health measures.

A worked example illustrates the distinction. Suppose confirmed gross fraud loss is 2,000,000 monetary units, recoveries are 300,000, and third-party reimbursements are 200,000. Net loss is:

The recovery rate is 300,000 ÷ 2,000,000 = 15%, while the total offset rate including reimbursements is 25%. These are different measures and should not be conflated.

10. Illustrative Case: Northbridge Bank Instant Payments

Background

Northbridge Bank, a fictional regional bank, introduced instant payments and observed a sharp increase in account-takeover losses. Customers were authenticated with passwords and one-time codes. A fraud rule blocked payments above a fixed threshold, but criminals divided payments into smaller transfers.

Problem

The bank’s control environment had three weaknesses. First, adding a new beneficiary and sending a payment could occur in the same session. Second, the monitoring system assessed each payment separately and ignored device and beneficiary relationships. Third, the fraud operations team measured alert volume but not net loss, containment time, or customer harm.

Analysis

A scenario assessment identified the following chain: phishing or credential theft, login from a new device, contact-detail change, beneficiary creation, rapid low-value transfers, and movement of funds through linked accounts. The fixed threshold was a weak preventive control because it was predictable and did not address the sequence.

Review also found that one operations supervisor could approve emergency rule changes and close the resulting alerts. This was an SoD conflict. Model performance was not segmented by customer type, and legitimate customers using virtual private networks were disproportionately challenged.

Approach and solution

Northbridge introduced a layered control design:

1. A cooling-off period and customer notification for high-risk beneficiary changes.
2. Transaction binding and step-up authentication for unusual payments.
3. A behavioural score using device novelty, beneficiary age, velocity, session context, and linked-account information.
4. Graph analysis to identify common devices, recipients, and rapid fund movement.
5. Separate authority for rule approval, emergency implementation, and case closure.
6. Real-time customer confirmation through a trusted channel, with accessible alternatives.
7. A case dashboard reporting net loss, detection time, containment time, recovery, false positives, and customer complaints.
8. Weekly review of false positives and monthly independent control testing.

Outcome

After the pilot period, the bank reported fewer account-takeover losses and faster containment. It also discovered that some controls were shifting fraud attempts toward call-centre impersonation. The bank therefore extended the assessment to social engineering and trained agents to identify coercion and unusual recovery requests. The apparent improvement was not accepted as proof of success until reporting definitions, exposure volumes, customer segments, and displaced channels were reviewed.

Learning points

The case demonstrates that fraud control is a system. A stronger model alone cannot compensate for weak beneficiary governance, poor SoD, or inadequate measurement. Controls must be sequenced across the attack path, monitored for displacement, and evaluated for both security and customer impact.

11. Governance, Ethics, and Regulation

Fraud controls operate within privacy, data-protection, consumer-protection, payment-services, employment, evidentiary, and anti-money-laundering obligations. Banks should establish a lawful basis for data processing, limit collection to legitimate purposes, protect sensitive data, define retention periods, and control cross-border transfers.

Fairness matters because fraud models can produce unequal false-positive rates across customer groups. A model that protects one group by frequently denying another group legitimate access is not automatically acceptable. Governance should require impact assessment, representative validation data, appeal or review mechanisms, accessible communications, and documented reasons for material adverse action.

Confidentiality must be balanced with timely warnings and lawful reporting. Staff should be able to report suspected internal fraud without retaliation. Investigations should respect due process, avoid premature accusations, and protect whistleblowers and customers.

Boards and senior managers should ask whether reported performance reflects real risk, whether losses are consistently classified, whether management incentives discourage reporting, whether critical controls depend on one person, and whether third parties and artificial-intelligence providers are adequately governed.

12. Contemporary Developments and Best Practice

Current fraud management is shaped by instant payments, open banking, deepfake-enabled impersonation, synthetic identity, mule-account networks, cryptocurrency flows, and criminal use of generative AI. Banks increasingly need coordinated intelligence sharing, privacy-preserving analytics, stronger payment confirmation, and controls that operate across products rather than within isolated silos.

Best practice includes:

• board-approved fraud strategy and risk appetite;
• complete scenario inventory linked to products and channels;
• layered controls combining prevention, detection, investigation, and recovery;
• clear ownership and robust SoD;
• risk-based, phishing-resistant authentication where feasible;
• independent model and control validation;
• consistent loss taxonomy and denominator-based metrics;
• rapid customer communication and fair remediation;
• intelligence sharing subject to law and privacy safeguards;
• post-incident learning and testing of corrective actions;
• regular challenge of assumptions, thresholds, and emerging threats.

No control is permanent. A mature institution treats every material incident as evidence about the control system, not simply as evidence of customer or employee failure.

Chapter Summary

Fraud risk management is an enterprise discipline covering governance, assessment, prevention, detection, investigation, recovery, assurance, and learning. Scenario-based assessment clarifies threats, vulnerabilities, controls, and impacts. Preventive controls reduce opportunity; detective controls identify anomalies; investigation establishes facts and supports proportionate action; recovery limits residual harm.

Segregation of duties, least privilege, authentication, transaction binding, and access review are central to both cyber and fraud control. Analytics and artificial intelligence can improve detection, but they require reliable data, model governance, human accountability, fairness testing, and explainability. Control testing must examine both design and operating effectiveness. Loss measures must distinguish gross loss, recoveries, reimbursements, costs, and customer harm. Performance indicators need clear definitions and denominators, because changes in alerts or losses can have several interpretations.

An effective fraud programme is adaptive. It combines technology with governance, skilled investigation, customer protection, ethical data use, regulatory compliance, and continuous learning.

Key Terms

Account takeover: Unauthorised control of a legitimate customer account.

Authentication: Verification of a user’s claimed identity.

Authorisation: Permission to perform a specific action or transaction.

Behavioural analytics: Analysis of activity patterns to identify deviations or risk.

Control effectiveness: The degree to which a control reduces the risk it was designed to address.

Expected loss: Probability-weighted loss across defined scenarios.

False positive: An alert that does not result in sufficient evidence of fraud.

Fraud scenario: A structured description of actor, method, weakness, and consequence.

Graph analysis: Analysis of relationships among accounts, devices, people, and transactions.

Gross confirmed loss: Confirmed financial loss before recoveries and reimbursements.

Least privilege: Granting only the access necessary for an authorised task.

Net loss: Gross confirmed loss less defined recoveries and reimbursements.

Residual risk: Risk remaining after controls are applied.

Risk appetite: The level and type of risk an institution is willing to accept.

Segregation of duties: Separation of incompatible responsibilities among people or systems.

Step-up authentication: Stronger authentication required when risk increases.

Synthetic identity: An identity assembled from real and fabricated information.

Transaction binding: Linking approval securely to transaction details.

Whistleblowing: Reporting suspected misconduct through protected channels.

Review Questions

Short Answer Questions

1. Distinguish fraud risk from ordinary operational error.
2. What is the difference between inherent risk and residual risk?
3. State two examples of incompatible duties.
4. Why should gross loss and net loss be reported separately?
5. What is a false positive in fraud detection?

Long Answer Questions

1. Explain the complete enterprise fraud-management cycle and the responsibilities of the three lines of defence.
2. Discuss how customer authentication, transaction binding, and behavioural analytics can be combined to manage account-takeover risk.
3. Explain the role of control testing, including the difference between design effectiveness and operating effectiveness.
4. Evaluate the governance and ethical risks of using artificial intelligence in fraud detection.
5. Discuss why fraud-control performance indicators require consistent definitions, denominators, and interpretation.

Analytical / Application Questions

1. Design a fraud risk assessment for a bank launching instant payments. Identify at least five scenarios, key controls, owners, and residual-risk measures.
2. A bank has gross confirmed fraud loss of 4,000,000 monetary units, recoveries of 600,000, and reimbursements of 500,000. Calculate net loss and explain why recovery rate and reimbursement rate should be reported separately.
3. Analyse the Northbridge Bank case. Recommend three additional controls, identify possible customer harms, and propose indicators that would test whether fraud was reduced rather than displaced.

Multiple Choice Questions with Answers

Question 1

Which activity is primarily a preventive fraud control?

A. Post-incident trend analysis

B. Cooling-off period for a newly added beneficiary

C. Investigation of a confirmed case

D. Calculation of recovery rate

Correct Answer: B. Cooling-off period for a newly added beneficiary

Question 2

In the expected-loss expression EL = ∑(pᵢ × Lᵢ), what does pᵢ represent?

A. The control effectiveness for scenario i

B. The monetary loss for scenario i

C. The probability of scenario i during the defined period

D. The number of alerts generated by scenario i

Correct Answer: C. The probability of scenario i during the defined period

Question 3

Which pair represents incompatible duties in a payment process?

A. Viewing a public fraud report and attending training

B. Creating a beneficiary and independently reviewing a monthly dashboard

C. Creating a beneficiary and releasing the payment

D. Receiving a customer complaint and recording its reference number

Correct Answer: C. Creating a beneficiary and releasing the payment

Question 4

What is the principal purpose of transaction binding?

A. To eliminate the need for customer authentication

B. To link approval securely to meaningful transaction details

C. To guarantee that every transaction is legitimate

D. To replace all fraud investigations with automation

Correct Answer: B. To link approval securely to meaningful transaction details

Question 5

A bank reports gross confirmed loss of 2,000,000, recoveries of 300,000, and reimbursements of 200,000. What is net loss?

A. 1,300,000

B. 1,500,000

C. 1,700,000

D. 2,500,000

Correct Answer: B. 1,500,000

Question 6

Which statement best describes a false positive?

A. A confirmed fraud event missed by every control

B. An alert closed without sufficient evidence of fraud

C. A recovered fraud loss

D. A control that operates exactly as designed

Correct Answer: B. An alert closed without sufficient evidence of fraud

Question 7

Why is a rising alert count not automatically evidence of worsening fraud performance?

A. Alerts are never useful for fraud management

B. It may reflect improved detection, increased threat, or data-quality changes

C. Alert counts always measure net loss directly

D. A rising alert count proves that controls are ineffective

Correct Answer: B. It may reflect improved detection, increased threat, or data-quality changes

Question 8

Which is a suitable model-governance practice?

A. Allowing undocumented threshold changes by one operator

B. Removing human review from all high-impact decisions

C. Monitoring model drift and validating performance over time

D. Using protected attributes without justification

Correct Answer: C. Monitoring model drift and validating performance over time

Question 9

What does residual risk mean?

A. Risk before any controls exist

B. Risk remaining after controls are applied

C. Only the amount recovered after fraud

D. The number of rejected alerts

Correct Answer: B. Risk remaining after controls are applied

Question 10

Which control arrangement best addresses an operations supervisor who can approve a rule change and close resulting cases?

A. Give the supervisor broader privileges

B. Remove all case documentation

C. Separate rule approval, implementation, and case-closure authority

D. Stop measuring false positives

Correct Answer: C. Separate rule approval, implementation, and case-closure authority