Payments fraud continues to challenge financial institutions and money-movement businesses as criminals develop increasingly sophisticated ways to exploit weaknesses in identity verification, account security, and transaction processing. Traditional fraud prevention methods, particularly static rules built around previously identified attack patterns, are struggling to keep pace. Controls that once worked may no longer recognize new threats, while overly strict security measures can prevent legitimate customers from completing transactions.
The scale of the problem highlights the need for more adaptive approaches. According to the Association for Financial Professionals, 76% of U.S. organizations reported attempted or actual payments fraud in 2025. Among companies with more than $1 billion in revenue, two-thirds reported financial losses. Despite these risks, only 17% of organizations currently use artificial intelligence to combat payments fraud.
Identity-related fraud is another major concern. An analysis by the Financial Crimes Enforcement Network (FinCEN) found that 42% of Bank Secrecy Act reports in 2021 involved identity-related suspicious activity, representing $212 billion. Criminals exploited weaknesses during account creation, account access, and transaction processing. Compromised credentials created a particularly significant financial impact, while circumvention of verification was the most frequently reported identity exploitation method among money services businesses.
These challenges raise an important question for fraud and payments leaders: How can organizations reduce financial losses without creating unnecessary barriers for legitimate customers?
During an on-demand webinar hosted by Emerj CEO and Head of Research Daniel Faggella, Debjit Saha, VP of Engineering and Product, Risk and Compliance at MoneyGram, and Jeff Otto, Chief Marketing Officer at Riskified, discussed how businesses can respond to evolving fraud threats while maintaining a positive customer experience.
Their insights point to three important strategies: combining identity and behavioral intelligence, developing payment controls specific to each transaction rail, and applying verification measures according to risk and customer value.
Understanding Fraud Through Layered Identity Intelligence
Fraudsters continuously change their methods, making it difficult for organizations to rely on individual security signals or predefined rules. According to Debjit Saha, attacks can take many forms across web platforms, mobile applications, and physical locations. These include synthetic identities, account takeovers, compromised documents, mule accounts, and social engineering attempts through customer service channels.
Some criminals manipulate call center interactions to reset passwords or gain access to accounts. Others combine legitimate and fabricated personal information to create identities that appear authentic. These techniques make fraud increasingly difficult to identify through traditional verification processes.
Saha emphasizes that organizations need to evaluate multiple signals together rather than relying on a single indicator. Identity information, device details, IP addresses, login activity, and behavioral patterns can provide a more complete understanding of whether an interaction is legitimate.
This is particularly important because fraudsters understand how traditional controls work. When security systems rely heavily on predictable rules, criminals can study those patterns and adjust their behavior to avoid detection.
Jeff Otto adds another dimension to the problem: established customer accounts can become attractive targets because they already have a history of legitimate activity. Fraud prevention systems may pay closer attention to new customers whose behavior is unfamiliar, while older accounts may receive less scrutiny because they appear trustworthy.
Criminals exploit this confidence by stealing credentials and using compromised accounts to initiate fraudulent transactions. An account that was legitimate for years can suddenly become a vehicle for financial crime.
Otto explains that identity intelligence can help uncover connections that individual businesses may not see within their own customer databases. A person who appears to be a first-time customer at one organization may already have a history across a broader network. Machine learning and identity graphs can reveal these relationships and help identify suspicious identities when they reappear through new accounts.
His team’s analysis has also found that a disproportionately large share of losses can be traced to a very small portion of the customer base, estimated at around 20 basis points. This demonstrates the value of identifying connected identities and recognizing patterns that extend beyond individual transactions.
However, unusual behavior does not automatically mean fraud. As Saha points out, legitimate customers can change their habits because of new circumstances, financial needs, or personal situations. Fraud systems must therefore distinguish suspicious activity from reasonable changes in customer behavior.
A layered identity strategy begins with know-your-customer (KYC) verification and expands through device, IP, login, and behavioral information. Businesses should also consider network-wide identity history when evaluating new customers rather than depending exclusively on their internal records.
Verification becomes particularly important during high-risk events, such as account creation or changes to linked bank accounts. Established customers should continue to be evaluated based on their current behavior instead of receiving automatic approval simply because of their account history.
By combining these signals, organizations can identify compromised identities more effectively while allowing legitimate customers to complete transactions with fewer unnecessary interruptions.
Why Payment Rails Require Different Fraud Controls
Not all payment methods carry the same risks. Credit cards and Automated Clearing House (ACH) bank transfers have different transaction costs, approval patterns, and dispute processes. For organizations that support multiple payment options, applying identical fraud controls across every payment rail can create unnecessary exposure.
ACH transfers are attractive because they generally involve lower processing fees and strong conversion rates. However, these advantages can also make them appealing targets for fraudsters.
Jeff Otto estimates that ACH decline rates can be around 1% to 2%, compared with 10% to 15% in some card payment categories. His team’s analysis also found that the average ACH transaction is approximately 3.6 times larger than the average card transaction.
The combination of higher transaction values and relatively low decline rates creates an opportunity for fraud rings. Otto notes that his analysis found ACH fraud attempts were 2.3 times higher than those involving credit cards.
The financial consequences can also be different. Card networks generally provide a representment process that allows merchants to challenge certain disputes. ACH transactions do not offer the same process. When a bank returns an ACH payment, the organization receives a return code, and recovering the full transaction value may be difficult.
This means a mistaken approval can expose a business to the entire value of a fraudulent ACH transaction.
Saha identifies bank account ownership as one of the most important ACH security concerns. A customer may successfully complete KYC verification but still attempt to fund a transaction using a bank account that does not belong to them.
Card fraud typically involves stolen payment card information being used to make purchases. Over time, card networks and payment providers have developed more mature controls to detect suspicious activity, including unusually large first transactions.
ACH controls, by comparison, have historically been less stringent in some areas. As defenses around card payments have improved, fraudsters may have shifted more attention toward ACH transfers. Real-time account verification solutions are becoming available to help confirm ownership, but Saha considers this an ongoing challenge for organizations.
These differences make it important to establish separate risk strategies for each payment method. Businesses should evaluate card and ACH transactions according to their specific exposure rather than assuming that a single approval model will work equally well for both.
Saha recommends monitoring approval rates separately based on customer type and payment method. New and existing customers should be evaluated independently, as should card and ACH transactions. This allows organizations to understand where fraud controls are working and where legitimate approvals may be unnecessarily restricted.
The broader objective is to maximize legitimate transactions while reducing financial losses. A payment method should remain commercially attractive, but its convenience should not come at the expense of inadequate risk protection.
Using Adaptive Friction to Balance Security and Customer Experience
Fraud prevention is not only a security issue. It is also a customer experience challenge.
Money-movement platforms operate in a competitive environment where customers can choose among multiple providers. A complicated verification process can cause frustration, interrupt transactions, and encourage customers to move to another service.
Debjit Saha describes an approach known as adaptive friction, in which additional verification is introduced only when risk signals justify it. Instead of requiring every customer to answer numerous security questions, the system allows low-risk transactions to proceed with minimal interruption.
This approach recognizes that not every customer presents the same level of risk. A customer with a consistent identity history and normal transaction behavior should not necessarily experience the same verification process as someone exhibiting suspicious activity.
Jeff Otto supports a similar strategy, emphasizing the importance of applying controls selectively. Organizations should increase scrutiny as risk rises rather than automatically declining every transaction that triggers a warning.
When identity information is consistent and behavior appears normal, a transaction may be approved immediately. If unusual activity emerges, the system can request additional information or temporarily delay fulfillment. More concerning cases can be escalated for manual review. When account compromise or fraud is confirmed, the business should block the transaction and apply measures to prevent further abuse.
The objective is to match the level of friction to the level of risk.
However, organizations must also consider how their fraud teams are measured. A team evaluated only on reducing fraud may introduce increasingly restrictive controls until legitimate customers begin abandoning transactions.
Otto warns that pursuing zero fraud without considering business performance can lead to significant revenue losses. Saha reinforces this point with the observation that eliminating fraud is easy if a business eliminates transactions.
Fraud prevention metrics should therefore reflect broader business objectives. Approval rates, total conversion, customer retention, and financial losses need to be considered together. Business leaders should participate in determining where stronger protections are necessary and where additional friction could damage customer relationships.
Customer Lifetime Value Should Influence Risk Decisions
Customer value is another important consideration when deciding how to handle suspicious transactions.
In ecommerce, businesses often use customer lifetime value (CLV) to understand the long-term revenue potential of different customer groups. Otto believes the same principle can improve fraud decision-making, particularly when a high-value customer’s transaction triggers a security control.
An automatic decline may prevent a potentially fraudulent payment, but it can also damage the relationship with a legitimate customer. A poor experience may cause that customer to stop using the platform altogether.
Otto points out that businesses should understand the potential long-term cost of losing a valued customer rather than evaluating every transaction as an isolated event.
In some situations, contacting the customer directly may be a better response than immediately declining the transaction. A business can confirm that the account has not been compromised and provide additional assistance. For valuable customers, a more personalized service experience may help resolve the issue while strengthening the relationship.
Saha sees an opportunity for AI to support this process by identifying valued customers who trigger fraud controls and routing them into appropriate exception workflows. These may involve manual review or a direct phone call to confirm the transaction.
However, customer value should never override legitimate security concerns. High-value accounts can also be compromised, which is why additional verification and human review remain important when suspicious activity appears.
Data quality is essential to making these decisions effectively. Saha explains that fraud models depend on the information available to them. Although customers may only answer a small number of questions, organizations can use a much broader set of data points behind the scenes to develop identity and behavioral graphs.
This enriched information helps fraud teams recognize changes in customer behavior, identify connections between suspicious accounts, and make more informed decisions.
According to Otto, applying identity and risk technologies more selectively creates a meaningful opportunity to improve approval rates and overall transaction conversion, potentially by hundreds of basis points.
Building a More Adaptive Approach to Payments Fraud
The insights shared by MoneyGram and Riskified demonstrate that effective fraud prevention requires a broader understanding of identity, payment behavior, and customer relationships.
Static rules alone cannot keep pace with criminals who continuously adapt their methods. Organizations need to combine identity verification with device information, behavioral signals, and network-wide intelligence to recognize threats that may otherwise appear legitimate.
They must also understand the differences between payment methods. ACH transfers and card transactions have distinct risk profiles, making rail-specific controls essential for protecting transaction value without unnecessarily restricting customer access.
At the same time, fraud prevention should not operate independently from customer experience and business performance. Adaptive verification allows organizations to apply additional security only when needed, while customer lifetime value can help determine when personalized review is more appropriate than an immediate decline.
Artificial intelligence can strengthen these strategies by analyzing large volumes of information, identifying patterns, and supporting faster risk decisions. However, its effectiveness depends on reliable data, appropriate controls, and clear business objectives.
Conclusion
Payment fraud is becoming more sophisticated, and financial institutions must move beyond static rules and isolated security checks to keep pace. Protecting customers and reducing losses require a more intelligent approach that considers identity, behavior, payment methods, and the broader context of every transaction.
The perspectives shared by Debjit Saha of MoneyGram and Jeff Otto of Riskified highlight three priorities for modern fraud teams: layered identity intelligence, payment-specific risk controls, and adaptive friction based on customer and transaction risk.
Ultimately, successful fraud prevention is not about declining as many transactions as possible. It is about recognizing the transactions that genuinely present a threat while making it easier for legitimate customers to move money.
By combining stronger identity intelligence with thoughtful verification and business-focused performance measures, organizations can reduce fraud exposure, protect customer relationships, and create a more secure and seamless payments experience.