Fraud, AML and Financial-Crime Risk

Introduction and context

Digital banking has transformed the speed, reach and convenience of payments. The same characteristics also create new opportunities for fraudsters, organised criminal networks, terrorist financiers, cybercriminals and professional money launderers. A payment may be authorised within seconds, routed through several institutions and converted into cash or crypto-assets before a bank’s traditional control process detects abnormality.

Fraud and anti-money-laundering (AML) risks are related but not identical. Fraud generally involves deception or unauthorised conduct intended to obtain value. Money laundering involves disguising the criminal origin, ownership or control of assets. A fraud event may generate proceeds that are subsequently laundered; conversely, an account may be used for laundering without its holder being the original fraud victim or offender.

Effective financial-crime risk management therefore requires an integrated control environment covering customer due diligence, authentication, transaction monitoring, sanctions screening, fraud analytics, investigation, reporting and governance. The appropriate objective is not to eliminate all risk, which is impossible, but to reduce exposure to an acceptable level while preserving legitimate customer access and respecting legal rights.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Distinguish major payment-fraud, scam, account-takeover and money-laundering typologies.
2. Explain the risk-based approach to KYC, customer due diligence and enhanced due diligence.
3. Design transaction-monitoring, sanctions-screening and case-management controls.
4. Evaluate machine-learning applications using suitable performance and governance measures.
5. Analyse a complex digital-payment case and recommend proportionate interventions.
6. Discuss regulatory, ethical, operational and privacy implications of financial-crime controls.

1. The financial-crime risk landscape

1.1 Fraud, scam and laundering

A useful distinction is between the event, the mechanism and the proceeds:

• Fraud event: an unauthorised or deceptive act causing loss or improper gain.
• Scam: social engineering in which a victim is induced to authorise a payment or disclose credentials.
• Account takeover (ATO): unauthorised control of a genuine customer account.
• Money laundering: placement, layering and integration of criminal proceeds to make them appear legitimate.
• Terrorist financing: raising or moving funds for terrorist activity; funds may originate from either legal or illegal sources.
• Proliferation financing: financing the development or transfer of weapons of mass destruction and related materials.

The distinction between authorised and unauthorised payment is operationally important. In an ATO, the customer did not authorise the transaction. In an authorised push-payment scam, the customer may technically authenticate and approve it, but does so because of deception. A control designed only to detect stolen credentials will miss many scams.

1.2 The three-stage laundering model

The traditional model describes laundering as:

1. Placement: introducing illicit proceeds into the financial system, for example through cash deposits, prepaid instruments or payments to businesses.
2. Layering: creating complexity through transfers, rapid movement, multiple accounts, foreign exchange, trade transactions or virtual assets.
3. Integration: returning value to the economy in apparently legitimate form, such as property, business revenue, loans or investments.

The stages frequently overlap. Digital payments can compress them into minutes, and a single account may act as a mule account, collection account and onward-transfer account. Therefore, banks should analyse networks and flows rather than relying only on individual transactions.

2. Payment-fraud typologies

2.1 Card and payment-instrument fraud

Card-not-present fraud exploits stolen card numbers, expiry dates, security codes or digital-wallet tokens. Common methods include phishing, malware, data breaches, enumeration of valid card details and abuse of weak merchants. Controls include tokenisation, strong customer authentication where applicable, device intelligence, merchant-risk scoring, velocity limits and behavioural analysis.

Domestic and international transfers present different risks. Faster payments reduce the time available for intervention. Fraudsters may exploit newly created beneficiaries, unusual payment corridors, round-value transfers or a sudden change in transaction size. Confirmation-of-payee and beneficiary-name controls can reduce misdirection but cannot replace behavioural monitoring.

2.2 Social-engineering scams

Important scam typologies include:

Scam prevention requires intervention before or during authorisation. A warning that merely states “fraud may occur” is weaker than a context-specific message: “This is a new beneficiary and the recipient name does not match the account details. Have you been instructed by telephone to make this payment?”

2.3 Account takeover

ATO commonly follows credential theft, SIM swapping, malware, phishing, database compromise or exploitation of password reuse. Attackers may first alter contact details, register a new device, disable alerts, add beneficiaries and then transfer funds. A risk-based control sequence should therefore monitor the entire customer journey rather than only the final payment.

Relevant signals include device reputation, geolocation, impossible travel, typing or navigation behaviour, SIM-change events, password resets, failed authentication, changes to profile data, payee creation and transaction velocity. No individual signal proves fraud; the value comes from combining independent indicators.

3. AML and KYC control architecture

3.1 Customer identification and risk assessment

Know-your-customer (KYC) begins with identifying and verifying the customer and, for legal persons, understanding ownership and control. A customer-risk assessment commonly considers:

• customer type, occupation and ownership structure;
• products and services used;
• geography, residence and transaction corridors;
• delivery channels and degree of anonymity;
• expected activity and source of funds or wealth;
• adverse media, sanctions and politically exposed person (PEP) information.

A risk score is a decision aid, not a substitute for judgement. One illustrative weighted model is:

Here, R is the composite risk score, xᵢ is the normalised score for risk factor i, and wᵢ is its weight. Each xᵢ should use a documented scale, such as 0 to 1, and weights must be approved and periodically validated. The model is applicable only when factors are defined consistently and the score is not treated as an objective probability of criminality.

Customer due diligence (CDD) is proportionate identification, verification, understanding of purpose and ongoing monitoring. Simplified due diligence may be suitable for demonstrably lower-risk situations where law permits. Enhanced due diligence (EDD) is appropriate for higher-risk customers, such as complex structures, high-risk jurisdictions, unusual wealth, certain PEP relationships or opaque sources of funds. EDD may include additional ownership evidence, independent source verification, senior approval and more frequent review.

3.2 Beneficial ownership

The beneficial owner is the natural person who ultimately owns or controls a legal entity or on whose behalf a transaction is conducted. Institutions should not stop at the immediate shareholder shown in a registry. They should examine ownership chains, voting rights, control through agreements, nominee arrangements and inconsistencies between declared business activity and actual flows.

3.3 Ongoing monitoring and risk refresh

KYC is not a one-time event. A customer’s risk profile should be refreshed after material changes, such as a new product, unusual activity, ownership change, adverse information or a significant change in transaction volume. Poor data quality, stale identity documents and fragmented customer records are major sources of control failure.

4. Transaction surveillance and sanctions screening

4.1 Rule-based monitoring

Rules remain valuable because they are explainable and easy to map to legal or policy requirements. Examples include:

• cash or transfer activity above a threshold;
• rapid pass-through of funds;
• multiple accounts sending to one beneficiary;
• transactions inconsistent with expected occupation or business;
• repeated payments just below a reporting threshold;
• unusual cross-border activity;
• dormant-account reactivation followed by large transfers.

A threshold is a screening trigger, not proof of suspicious activity. Excessive rules create alert volumes that overwhelm investigators and encourage superficial closure.

4.2 Network and behavioural analysis

Graph analysis represents accounts, devices, beneficiaries, merchants and addresses as nodes, with payments, logins or common identifiers as edges. It can reveal mule networks, funnel accounts, circular transfers and shared control. Behavioural models compare current activity with a customer’s own historical pattern and with peer groups.

Useful features include transaction amount, frequency, time, channel, beneficiary age, device, location, merchant category, counterparty concentration and time between receipt and onward transfer. Features must be assessed for stability, fairness, leakage and legal permissibility.

4.3 Sanctions screening

Sanctions screening may occur at onboarding, during periodic refresh and in real time before or after a transaction, depending on the institution’s obligations and risk. It should cover customers, beneficial owners, counterparties, vessels, entities and relevant payment messages.

Name matching is difficult because of transliteration, spelling variation, aliases, common names and incomplete data. A robust process combines deterministic matching, fuzzy matching, contextual information and trained human review. Screening against a list is not the same as establishing a true match. False positives must be resolved without arbitrary dismissal, while potential true matches require escalation and appropriate legal action.

4.4 Suspicious-activity reporting

Where reasonable grounds or the applicable legal standard are met, institutions file a suspicious-activity or suspicious-transaction report with the competent financial-intelligence unit. Reporting decisions should be based on facts, patterns and rationale, not on the customer’s ethnicity, nationality or other impermissible proxy. Tipping off the customer about a report may be prohibited.

5. Case management and operational controls

An effective case-management system provides a controlled lifecycle:

1. alert generation;
2. triage and deduplication;
3. assignment according to skill and conflicts;
4. investigation and evidence collection;
5. decision and rationale;
6. escalation or regulatory reporting;
7. account action and customer communication;
8. quality assurance, closure and audit retention.

Each case should preserve an immutable audit trail, timestamps, alert source, reviewed accounts, evidence, investigator reasoning, approvals and final disposition. Service-level standards should distinguish urgent payment intervention from lower-risk periodic review.

A useful operational measure is alert precision:

Here, TP is the number of alerts correctly judged to represent a confirmed target event under the institution’s definition, and FP is the number of false positives. Precision measures the proportion of investigated alerts that are relevant. It is not the same as recall:

where FN is the number of relevant events missed by the system. These measures require a reliable labelled population. In AML, “confirmed” labels are incomplete because absence of a report does not prove absence of laundering; therefore metrics should be interpreted alongside investigator review, back-testing and outcome analysis.

6. Machine learning in financial-crime risk management

6.1 Appropriate uses

Supervised learning can rank fraud alerts when historical labels are sufficiently reliable. Unsupervised or semi-supervised methods can identify clusters and deviations where confirmed examples are scarce. Graph machine learning can detect relationships among accounts and devices. Natural-language processing can support adverse-media triage and extract information from case documents.

The model should normally support, not replace, accountable decisions. Human investigators remain responsible for interpreting context, challenging outputs and documenting outcomes.

6.2 Model-risk governance

A production model requires a defined purpose, population, target variable, training data, validation design, threshold policy, monitoring plan and owner. Key risks include:

• biased or incomplete labels;
• concept drift as criminals change tactics;
• data leakage, where future information enters training;
• proxy discrimination;
• opaque explanations;
• adversarial manipulation;
• excessive dependence on one vendor or data source.

Validation should include out-of-time testing, subgroup analysis, stability monitoring, challenger models and independent review. Thresholds should reflect the cost of missed fraud, unnecessary customer friction, investigation capacity and regulatory risk. A model that produces a high statistical score but cannot be explained adequately may be unsuitable for an adverse customer decision.

6.3 Combining rules and models

A practical architecture uses rules for hard constraints and legal requirements, models for prioritisation, and investigators for contextual judgement. A model score may be combined with rules, but the combination must be documented and calibrated. Model governance should include drift indicators, such as changes in score distributions, alert rates, precision, recall and customer-impact rates.

7. Risk-based control design

Control design should follow a cycle:

1. identify threats, vulnerabilities and potential consequences;
2. assess inherent risk by customer, product, channel and geography;
3. select preventive, detective and corrective controls;
4. allocate ownership and define escalation;
5. test operating effectiveness;
6. measure residual risk and improve the control.

Preventive controls include identity verification, strong authentication, transaction limits, beneficiary confirmation and sanctions blocks. Detective controls include anomaly monitoring, network analytics and post-transaction review. Corrective controls include recall attempts, account restriction, customer remediation, reporting, law-enforcement cooperation and root-cause analysis.

Controls should be proportionate. Blocking every unusual transaction may reduce fraud but cause financial exclusion, delayed salaries, harm to vulnerable customers and reputational damage. Conversely, a permissive system may privilege convenience over customer protection. Governance committees should therefore review both financial-crime outcomes and unintended customer impacts.

8. Illustrative case: the rapid-payments mule network

This is a fictional illustrative case.

Background

Northbridge Bank offers instant domestic payments and mobile onboarding. Its fraud engine detects unauthorised logins, while its AML system operates mainly through nightly batch rules. A customer segment of newly opened accounts begins receiving many small credits from unrelated individuals and sending larger payments to two crypto-asset platforms.

Problem

The accounts pass identity verification, have no direct sanctions hits and individually remain below several monitoring thresholds. Within three weeks, 42 accounts receive funds from 680 senders. Several accounts show a new device, a recently changed phone number and near-immediate onward transfers. Customer complaints reveal that some senders believed they were paying for investments or employment-related services.

Analysis

The fraud and AML teams initially investigate separately. Fraud analysts focus on sender complaints; AML analysts focus on threshold rules. A joint graph analysis shows common device identifiers, overlapping login locations, shared beneficiaries and a small group of controllers. The pattern is consistent with a mule network collecting scam proceeds and layering them through crypto-asset accounts.

The institution’s risk assessment identifies three failures: onboarding was treated as sufficient without behavioural review; monitoring was account-centric rather than network-centric; and batch processing delayed intervention. It also identifies a governance weakness because customer complaints were not linked to transaction-monitoring alerts.

Approach and solution

Northbridge introduces a risk-based intervention sequence:

• temporarily holds selected high-risk payments for manual review, subject to applicable law and customer-protection procedures;
• links complaint, device, beneficiary and account data in a case graph;
• applies enhanced due diligence to controllers and related businesses;
• attempts recalls and communicates safely with affected customers;
• files appropriate reports with the financial-intelligence unit;
• restricts or exits accounts according to documented policy;
• adds real-time signals for new-device events, rapid pass-through and shared control;
• performs a retrospective review of accounts using the same indicators.

The bank validates that the intervention does not rely on nationality, neighbourhood or other discriminatory proxies. It also creates a quality-assurance sample of closed alerts and records reasons for both release and restriction.

Outcome and learning points

The bank disrupts the network earlier in subsequent incidents and improves recovery rates, but alert volumes initially rise. After threshold calibration and investigator training, precision improves. The principal lesson is that fraud, AML, complaints, authentication and payments data must be connected. No single rule, list or model can identify the full risk.

9. Regulation, ethics and emerging developments

Regulatory expectations differ by jurisdiction, but common principles include risk-based AML programmes, customer identification, beneficial-ownership understanding, sanctions compliance, record keeping, suspicious-activity reporting, independent testing and senior-management accountability. Institutions must consult the law and regulator applicable to their operations rather than relying on generic international descriptions.

Privacy and data-protection duties require purpose limitation, data minimisation, security, retention controls and lawful processing. Financial-crime prevention does not justify unlimited surveillance. Customers should receive accurate explanations where legally permissible, and automated decisions should have appropriate review and appeal mechanisms.

Emerging developments include real-time payment fraud controls, privacy-preserving analytics, consortium intelligence sharing, digital identity, programmable payment safeguards and generative AI for investigator assistance. Generative AI can summarise evidence or draft investigative narratives, but it may hallucinate facts, reproduce bias or expose confidential data. It should not create unverified conclusions or independently determine a suspicious-activity filing.

Chapter Summary

Digital banking creates speed and convenience while increasing exposure to payment fraud, scams, account takeover and laundering. Fraud controls must distinguish unauthorised transactions from authorised payments induced by deception. AML controls require continuous KYC, beneficial-ownership understanding, risk-based CDD and EDD, sanctions screening and transaction surveillance. Effective monitoring combines rules, behavioural analysis and network intelligence. Case management must preserve evidence, reasoning, approvals and auditability. Machine learning can improve prioritisation and discovery, but requires reliable labels, validation, fairness assessment, drift monitoring and human accountability. The fictional Northbridge case demonstrates why fraud, AML, complaints and payment data should be integrated. Proportionate controls must protect the financial system without creating unjustified exclusion or privacy intrusion.

Key Terms

Fraud: Deceptive or unauthorised conduct intended to obtain value or cause loss.

Scam: Deception that induces a person to disclose information or authorise an action.

Account takeover: Unauthorised control of a genuine customer account.

Authorised push-payment scam: A scam in which the victim is deceived into approving a payment.

Money laundering: Concealing the criminal origin, ownership or control of assets.

Placement: Introduction of illicit proceeds into the financial system.

Layering: Creation of transactions or structures to obscure the proceeds’ origin.

Integration: Reintroduction of laundered value as apparently legitimate wealth.

KYC: Processes for identifying and understanding a customer.

CDD: Proportionate identification, verification, purpose assessment and ongoing monitoring.

EDD: Additional controls applied to higher-risk customers or relationships.

Beneficial owner: Natural person who ultimately owns or controls an entity or transaction.

PEP: Person entrusted with a prominent public function, together with relevant associated risks.

Sanctions screening: Checking customers and transactions against applicable restrictive lists.

Transaction monitoring: Analysis of activity for unusual or suspicious patterns.

Mule account: Account used to receive, move or disguise criminal proceeds.

False positive: Alert incorrectly identifying a target event.

Precision: Proportion of positive alerts that are relevant under the chosen definition.

Recall: Proportion of relevant events detected by a system.

Model drift: Deterioration or change in model behaviour as data or criminal patterns evolve.

Review Questions

Short Answer Questions

1. Distinguish an account takeover from an authorised push-payment scam.
2. Describe the placement, layering and integration stages of money laundering.
3. Why is beneficial-ownership analysis important for legal-entity customers?
4. What is the difference between precision and recall in alert evaluation?
5. Identify three indicators that may signal account takeover.

Long Answer Questions

1. Explain how a bank should design a risk-based KYC, CDD and EDD framework.
2. Compare rule-based transaction monitoring with behavioural and network analytics.
3. Discuss the principal governance requirements for machine-learning models used in financial-crime compliance.
4. Explain how sanctions-screening false positives and false negatives should be managed.
5. Evaluate the ethical tension between fraud prevention, privacy and financial inclusion.

Analytical / Application Questions

1. A new account receives 80 unrelated payments and transfers most funds onward within ten minutes. Design an integrated fraud and AML investigation plan, including data sources, immediate controls and escalation decisions.
2. A fraud model has TP = 900, FP = 100 and FN = 300. Calculate its precision and recall, and explain why management should not select a threshold using either metric alone.
3. Design a case-management workflow for a potential sanctions match involving a common name, incomplete date of birth and an urgent international payment. Identify the decisions, evidence and governance controls required.

Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes an authorised push-payment scam from an account takeover?

A. The payment is made through a digital channel.

B. The victim is deceived into approving the payment.

C. The transaction may involve a new beneficiary.

D. The bank can investigate it after execution.

Correct Answer: B. The victim is deceived into approving the payment.

Question 2

Which laundering stage involves introducing illicit proceeds into the financial system?

A. Integration

B. Layering

C. Placement

D. Reconciliation

Correct Answer: C. Placement

Question 3

What is the primary purpose of enhanced due diligence?

A. To remove all higher-risk customers automatically

B. To apply additional scrutiny to higher-risk relationships

C. To replace customer identification

D. To guarantee that no suspicious transaction occurs

Correct Answer: B. To apply additional scrutiny to higher-risk relationships

Question 4

Which control is primarily preventive?

A. Post-incident root-cause analysis

B. Suspicious-activity reporting after review

C. Beneficiary confirmation before payment

D. Retrospective alert-quality testing

Correct Answer: C. Beneficiary confirmation before payment

Question 5

If TP = 80 and FP = 20, what is precision?

A. 20%

B. 50%

C. 80%

D. 100%

Correct Answer: C. 80%

Question 6

Which pattern is most suggestive of a mule account?

A. Stable salary credits and regular household expenses

B. Long-term savings with no external transfers

C. Many unrelated incoming payments followed quickly by onward transfers

D. A single verified payment to a known utility provider

Correct Answer: C. Many unrelated incoming payments followed quickly by onward transfers

Question 7

Why can a sanctions-screening name match not by itself establish a true match?

A. Sanctions lists never contain aliases

B. Names may be common, transliterated or incomplete

C. Screening is only relevant after a transaction settles

D. Beneficial owners are never screened

Correct Answer: B. Names may be common, transliterated or incomplete

Question 8

Which statement about machine learning in financial-crime compliance is most appropriate?

A. A model score is automatically proof of criminal conduct.

B. Human investigators are unnecessary when recall is high.

C. Models require validation, monitoring and accountable human governance.

D. Historical labels are always complete and unbiased.

Correct Answer: C. Models require validation, monitoring and accountable human governance.

Question 9

What does recall measure?

A. The proportion of positive alerts that are relevant

B. The proportion of relevant events detected

C. The average time to close a case

D. The percentage of customers screened

Correct Answer: B. The proportion of relevant events detected

Question 10

Which case-management practice best supports auditability?

A. Deleting investigator notes after closure

B. Allowing undocumented manual overrides

C. Maintaining evidence, rationale, approvals and timestamps

D. Assigning every alert to the same investigator

Correct Answer: C. Maintaining evidence, rationale, approvals and timestamps