Fraud attacks can now be assembled with commercially packaged software, distributed across accounts and devices, and altered faster than banks can rewrite a conventional fraud rule.
“We’re seeing fraudsters leverage commoditized SaaS toolkits sold on dark web marketplaces to orchestrate scams, card testing attacks and synthetic identity fraud at industry scale,” AWS Head of Payment Networks Paul Chang told PYMNTS.
Traditional rule-based systems are insufficient for detecting the range of attacks banks are seeing.
“Banks are really responding by moving beyond static rules towards adaptive AI-driven defenses that use machine learning to score transactions in real time, learn from emerging fraud patterns and continuously retrain models as attack vectors shift,” he said.
One of the new components is the transaction foundation model, or TFM. Rather than examining only the characteristics assigned to an individual payment, these models can learn from long sequences of financial activity.
Chang described TFMs as “large-scale AI models pre-trained on billions of financial events,” which can include payments, mobile banking activity, marketing data and product interactions.
The models generate representations, or embeddings, from sequences of financial behavior. That gives fraud systems another source of information beyond labeled fraud cases and manually engineered features.
TFMs aren’t intended to displace machine-learning systems already operating inside banks, Chang said.
Fraud Rings Require a Network View
Sequences of transactions can reveal one type of pattern. Fraud rings create another because their activity can be dispersed among accounts, identities, IP addresses and devices.
Banks are investing in graph databases and graph neural networks to find these relationships, Chang said.
“A lot of these are done by fraud rings, and they operate with complex networks of accounts, devices and transactions to hide their activities,” he said.
Graph neural networks can treat accounts, transactions and devices as nodes and examine how they connect. IP addresses and shared devices are examples of relationships that can help identify activity that another model might miss, Chang said.
AWS offers Amazon Neptune for mapping transactional relationships. Banks can combine the resulting graph embeddings with sequence embeddings from transaction foundation models and the handcrafted features already used by established fraud detection systems, Chang said. Adding these embedding layers has consistently improved fraud detection. Stripe’s Radar reduces fraud by 32% on average, and Razorpay identified five times more fraudulent or disputed transactions without increasing the number of alerts.
Detection, however, accounts for only part of the workload. Banks also must investigate alerts, assemble evidence and determine whether cases require further action.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Agentic artificial intelligence is starting to enter that process.
Institutions are using AI agents to retrieve information from sources, including device records and customer profiles, follow bank-specific operating procedures, and prepare investigation summaries and recommendations, Chang said.
“The human is still in the loop,” he said.
Investigators can use the assembled information to determine the next step rather than manually gathering each element of the case.
Chang drew a boundary around the agent’s role in regulated decisions.
“The agents assemble the evidence, surface key insights and prepare recommendations with citations to underlying records, but the human analysts basically retain the final authority on case dispositions and SARs filings,” Chang said.
Whether these systems work consistently depends heavily on the data underneath them. Banks may hold customer, transaction and risk information across core banking platforms, mainframes and separate applications.
“They need a unified, governed and AI-ready platform before any advanced fraud detection model can deliver on its promise,” Chang said.
AWS helps customers build the semantic layer, ontology and knowledge graph on their own enterprise data through its Context Ontology Accelerator and AWS Context. The tools are intended to establish machine-readable definitions of products, customers, policies, rules and the relationships among them, Chang said.
A governed knowledge graph can keep an agent tied to defined business relationships rather than allowing it to infer connections that aren’t present in the underlying records, Chang said.
“Every answer traces back to a formal rule, a defined relationship or governed metric that regulators can audit,” he said.
For all PYMNTS AI coverage, subscribe to the daily AI newsletter.