Latest / Fintech Conversations with Fexingo: Banking, Payments, and Financial Software Companies / How Bank Fraud Detection Is Evolving
Transcript
- Lucas: If these conversations are useful for what you're building or running, I want to remind you that listener support is what keeps this show ad-free and independent. A couple of dollars a month is genuinely what keeps these going — buy me a coffee dot com slash fexingo, if you've gotten something out of them today. That is F. E. X. I. N. G. O. Luna: Yeah, we appreciate that backing. It lets us dig into the messy technical details without worrying about sponsor constraints. So, let's get into the fraud detection angle. Lucas: Right. For the last decade, the standard answer to fraud was basically a giant spreadsheet of rules. If a transaction happens in a new country, block it. If the amount is over five thousand dollars, flag it. If the time of day is unusual, verify identity. It was rigid, and it was exhausting for everyone involved. But as of late twenty twenty-six, the industry has quietly pivoted away from those static thresholds toward adaptive machine learning models that score every single interaction in milliseconds. Luna: I saw a report from a mid-sized regional bank last week that claimed they cut false positives by forty percent using exactly this approach. Was that the outlier or the new baseline? Lucas: It is becoming the baseline. The key difference is that the old system treated every transaction as an isolated event. The new system treats it as part of a continuous behavioral stream. Think about it like this: the old model asked 'Is this transaction weird?' The new model asks 'Does this user act like themselves right now?' And by 'act,' I don't just mean password entry. I mean typing cadence, swipe velocity, even how they hold their phone based on gyroscope data. Luna: That sounds incredibly invasive if you aren't careful with the data retention policies. How do they balance that depth of analysis with consumer privacy expectations? Lucas: That is the critical tension point. Most of these behavioral biometric signals are processed locally on the device and never stored centrally. The bank gets a probability score, not the raw movement data. So Apple or Google can tell you your passcode was correct, but the bank only sees a green light or a red light on the risk score. It’s a privacy-preserving architecture, which is why regulators have been slower to crack down compared to other data-hungry fintech tools. Luna: So the friction moves from data collection to decision logic. What does that look like for the actual customer experience during a login? Lucas: Ideally, zero friction. That is the promise. If the model is confident, you just walk in. You don’t get SMS codes, you don’t get push notifications asking you to approve a transaction. You just access your account. The friction only appears when the confidence drops below a certain threshold, usually around eighty-five percent. Then, and only then, does the system ask for a secondary factor. It is dynamic authentication rather than static gatekeeping. Luna: But doesn't that create a vulnerability window? If the model is wrong, or if a bad actor mimics the behavior well enough, the door is wide open. Lucas: Absolutely. And that is where the training data matters. These models are trained on billions of anonymized interactions across different device types. The problem arises when a new type of attack emerges that hasn't been seen before. Adversarial AI is getting better at spoofing touchscreens. There have been documented cases where deepfake voice synthesis bypassed the older voice-printing systems. So the arms race is constantly shifting from human mimicry to synthetic media generation. Luna: Which means the banks have to update their models faster than ever. Does that mean more processing power, or just smarter algorithms? Lucas: Both, but mostly smarter algorithms. The latency requirements are brutal. You have maybe two hundred milliseconds to decide if a payment should go through before the user expects it to complete. You cannot run massive cloud-based neural networks for every single tap. You need edge computing solutions that run lightweight inference models directly on the smartphone or the point of sale terminal. It is a shift from centralized brainpower to distributed intelligence. Luna: I remember reading about how some credit card companies were still relying on three-day batch processing for fraud alerts. That seems completely incompatible with the speed of modern digital wallets. Lucas: Exactly. The old model was built for check clearing cycles that took days. The new reality is instant payments via systems like FedNow or real-time gross settlement networks. If you lose money to fraud in a real-time network, it is much harder to reverse. The cost of error goes up dramatically, which is why the investment in pre-transaction screening is so high right now. Banks are essentially buying insurance against immediate liquidity loss. Luna: So it’s not just about protecting the customer; it’s about protecting the bank’s own capital reserves. That changes the ROI calculation for these tech upgrades. Lucas: Precisely. In the past, fraud losses were treated as a cost of doing business, a small percentage of total volume. Now, with the speed of theft increasing, that percentage is creeping up. A one percent increase in fraud rates can wipe out the profit margin on a whole segment of retail lending. So C-suite executives are finally treating cybersecurity infrastructure as a core revenue protector, not just an IT expense line item. Luna: It makes sense. But does this centralization of fraud detection data create systemic risks? If one major vendor fails, do all their client banks fall together? Lucas: That is a legitimate concern known as concentration risk. Many regional banks rely on third-party providers like Feedzai or Sift for their fraud engines. If those providers have a glitch, thousands of transactions could be flagged incorrectly simultaneously. We saw a glimpse of this earlier this year when a major cloud provider had an outage that disrupted authentication services for several fintech apps. It wasn't catastrophic, but it showed how fragile the dependency chain really is. Luna: So diversification is the strategy here. Having backup systems, or maybe even hybrid models where local rules trigger alongside external AI scores. Lucas: Hybrid models are definitely the safe harbor. Pure AI reliance is risky because AI can hallucinate or misinterpret context. A good system uses AI for the heavy lifting but keeps simple, hard-coded rules as a final safety net. Like, if a transaction exceeds the daily limit by more than ten times, no amount of behavioral similarity should override that block. Some fundamental guardrails must remain immutable. Luna: I wonder if consumers are even aware that this level of scrutiny is happening in the background. Do they feel safer, or just more monitored? Lucas: Most people don't notice it unless it stops working. When you log in instantly and your transfer goes through immediately, you assume it’s just good design. You don’t think about the fact that a computer analyzed your keystroke rhythm and decided you’re probably you. The best security is invisible security. But when it fails—when you get locked out for suspicious activity—that’s when the trust evaporates instantly. Luna: And that friction creates customer churn. People will switch banks just to avoid being falsely accused of fraud. It’s a huge competitive disadvantage if your risk engine is too aggressive. Lucas: It is. We are seeing a market where banks compete on 'frictionless experience' as a feature. Marketing campaigns highlighting 'instant approval' and 'no extra steps' are directly tied to their fraud detection capabilities. It’s a product differentiation strategy rooted in backend engineering. The bank with the most accurate model wins the customer because they offer the smoothest experience without sacrificing safety. Luna: So accuracy is the new marketing dollar. Which brings me back to that regional bank case. Did they share any specific metrics on how quickly they iterated their models after a breach attempt? Lucas: They mentioned a feedback loop time of under four hours. That used to take weeks. They use automated labeling where customer service reports of fraud are fed directly back into the training dataset. Within hours, the model learns to recognize the new pattern. It’s a self-correcting system that evolves in near real-time. That speed is what actually separates the leaders from the laggards right now. Luna: Four hours is incredible. It feels like we’re moving from a periodic review cycle to a continuous improvement cycle for financial security. Lucas: It is continuous. And it requires a cultural shift in banks too. Security teams can’t just be the 'no' department anymore. They have to work closely with product teams to ensure that the risk controls don’t break the user journey. It’s a collaborative engineering challenge, not a compliance checklist. Luna: Do you think this level of sophistication will eventually trickle down to smaller businesses? Or will only big banks afford these advanced systems? Lucas: Cloud-based APIs are making it accessible. Small merchants can now plug into enterprise-grade fraud detection for pennies per transaction. The barrier to entry is dropping. But the complexity of managing it remains. Smaller players might outsource the entire function, whereas larger banks build custom solutions. Both approaches have merit depending on scale. Luna: Outsourcing feels like the pragmatic choice for a mom and pop shop. They don’t need to hire data scientists. They just need protection. Lucas: Exactly. And that democratization of security is good for the ecosystem. When even small nodes in the payment network are hardened, the overall resilience improves. It raises the floor for everyone. Luna: What about cross-border payments? Does this technology help with international fraud, which has always been a nightmare due to differing regulations? Lucas: It helps, but regulatory fragmentation is still the biggest hurdle. Data privacy laws in Europe, Asia, and the US differ significantly. Sharing behavioral data across borders can violate GDPR or similar frameworks. So many banks restrict their advanced models to domestic transactions only. International fraud detection relies more on traditional shared databases like SWIFT alerts, which are slower and less nuanced. Luna: So the innovation is strongest where the data stays local. That creates silos of security effectiveness. Lucas: It does. Until there is global harmonization on data sharing for fraud prevention, international payments will remain the wild west. Domestic real-time payments are secure. Cross-border ones are still largely guesswork based on reputation and historical relationships between correspondent banks. Luna: That’s a sobering distinction. Domestic convenience vs. international opacity. Lucas: Precisely. And as we move toward more integrated global commerce, that gap needs to close. Otherwise, the inefficiencies of international trade will stifle growth. Luna: Looking ahead, do you see quantum computing posing a threat to these current encryption and machine learning models? Lucas: Eventually, yes. Quantum computers could break current public-key cryptography. But for machine learning models, the impact is less clear. The bigger risk is that quantum simulations could generate perfect deepfakes that bypass behavioral checks. So the defense needs to evolve into multi-modal verification, combining biometrics with cryptographic proofs. It’s a long-term horizon, but banks are already investing in post-quantum cryptography standards. Luna: Future-proofing against attacks that don't exist yet. Classic tech planning. Lucas: It is necessary planning. Because once a breach happens, the damage is done. Prevention is the only viable strategy. Luna: This has been a really grounded look at the invisible machinery keeping our money safe. Thanks for breaking it down. Lucas: Anytime. Next time, we might look at how these same models are being used to detect merchant fraud, which is a whole different beast. Stay curious.