Breaking the Fraud Kill Chain — Where Banks and the Ecosystem Can Intervene

Alex: Welcome to the Nordic Fraud Briefing. Today we are breaking the fraud kill chain: where banks and the wider ecosystem can intervene before money disappears. I'm Alex, asking questions from the operations seat. Maya, you're taking the specialist role. Can we make this more demanding than a tour of familiar fraud controls?

Maya: Definitely. Let's ask which intervention changes the outcome, who can actually deliver it, and what evidence would convince us it worked. Both presenters are synthetic, created with Boson AI's Higgs Audio. Our reference date is the ninth of November, twenty twenty-six. The customer case is invented. This is an advanced operational discussion, with sources in the show notes.

Alex: Then start with a payment our bank authenticated correctly. The customer used her own phone, passed the checks, and insisted on sending. Our controls worked. Our customer still lost money. What did we misunderstand?

Maya: We confused confidence about the person with confidence about the purpose. Authentication can establish who is interacting, without establishing why they are paying. Strong authentication remains valuable. The joint European banking and central-bank fraud report says criminals are adapting, particularly through manipulation of payers. The answer is to preserve authentication and examine the deception that survives it.

Alex: So the payment is the middle of the story. How do we describe the rest without forcing every fraud into a cybersecurity diagram?

Maya: Use a working map: exposure and contact, manipulation, payment initiation, the receiving network, onward movement and cash-out, then recovery and learning. This is our organising framework, not a universal official taxonomy. Account takeover can involve unauthorised action; a scam can induce the genuine customer to act. Phishing can support either. We need to distinguish the decision being attacked, not just name the communication channel.

Alex: A kill chain sounds linear. Are we already oversimplifying?

Maya: Only if we mistake the drawing for the business model. Stages overlap. One network can recruit recipients while another grooms customers. Proceeds can finance the next campaign, and the same victim can be targeted again. FATF's new scam-compound report describes an integrated financial ecosystem. Our map is useful when it exposes dependencies and handoffs, not when it pretends every event follows one neat sequence.

Alex: Let's give that map a customer. Rachel sees an investment advertisement, speaks with an apparent adviser, then transfers money to an account the adviser provides. Where is the first meaningful break point?

Maya: Before Rachel becomes convinced. The platform can examine the advertiser and destination. Communications providers can disrupt abusive infrastructure. The bank can learn about known harmful destinations through lawful channels. None of those actors sees everything. For each handoff, ask four questions: what signal exists, how late it arrives, who can act on it, and who is accountable if the signal is wrong.

Alex: That's broader than putting an extra model in front of the payment. But how do I choose where to spend?

Maya: Look for an opportunity where a feasible intervention reduces expected harm across the chain. Include criminal adaptation, legitimate-customer cost, and operating capacity. Do not simply multiply independently advertised detection rates. Controls see different populations and their failures can be correlated. The difficult cases left by one control are precisely the cases the next control receives. Evaluate the combined process on the flow that actually reaches it.

Alex: Let's move upstream. If a platform removes a scam advertisement, can the bank count that as fraud prevented?

Maya: It can recognise a useful disruption, but should not convert every removed advertisement into an assumed saved payment. You need evidence about exposure, replacement, and downstream outcomes. Europol's current threat assessment describes a market in criminal infrastructure and services. That suggests targeting reusable enablers, while measuring how quickly they reappear. Removing one visible page may leave the operator's distribution and payment relationships intact.

Alex: What should platforms do more of, beyond responding to individual reports?

Maya: Examine connected advertiser accounts, destination changes, repeated abuse and impersonation patterns, with proportionate review. Preserve relevant evidence before a takedown destroys the trail. A bank's confirmed fraud case should ideally produce a usable, authenticated report about the advertisement or account involved. The platform needs a response path, not just a web form that accepts reports without telling anyone whether action followed.

Alex: And telcos? Caller identity checks should help, but they do not establish that the person speaking is honest.

Maya: Exactly. A trustworthy-looking number does not prove a trustworthy proposition. Telcos can address abusive traffic, impersonation and account misuse within their remit. Banks should explore lawful, technically reliable risk signals and validated callback routes. But do not treat an active call as proof of fraud, or assume banks may monitor private conversations. A useful signal needs a defined meaning, coverage, expiry and lawful route into a decision.

Alex: Suppose someone proposes sharing a risk flag saying a customer might be under pressure. That sounds useful and dangerously vague.

Maya: It is both, until designed properly. Define the event, its provenance, uncertainty, permitted purpose and receiving party. Separate an observed fact from an inference. Specify correction and withdrawal when the inference proves wrong. Share the minimum needed for an authorised action, rather than building a permanent suspicion label. Operational urgency does not create a universal permission to exchange customer data.

Alex: Where does identity fit upstream? If we improve onboarding, shouldn't the rest of the receiving network become much harder to build?

Maya: Better identity and control checks can remove an enabling dependency, but identity is not the same as legitimate intent. Some accounts are acquired or compromised after opening. Criminals can also shift towards channels with weaker controls. Our recommendation is to connect onboarding findings with later account behaviour and confirmed outcomes. Evaluate fraud reduced, mistaken exclusions and displacement, rather than treating the number of rejected applications as a direct measure of network disruption.

Alex: I was looking for one national database. You're describing a set of reliable handoffs instead.

Maya: A shared service might help some handoffs, but centralisation alone does not fix weak evidence or unclear authority. Start with a narrow use case and test whether the recipient can do something useful before the signal expires. Include banks, platforms, telcos, public authorities and privacy specialists as appropriate. Agree what constitutes acknowledgement, action and closure. Otherwise the partnership can report impressive membership while cases still stall between organisations.

Alex: Back to Rachel. She has spent weeks talking to the adviser. Is the bank's warning now simply too late?

Maya: Not necessarily, but the intervention has to address her actual belief. A generic warning that scams exist may change nothing. She believes this opportunity is genuine. Ask what independent evidence supports the recipient, the investment and the instruction. Our recommendation is to interrupt the claimed source of authority and offer a safe verification route, rather than require the customer to tick a box saying she accepts the risk.

Alex: Let's talk about that payment moment. What is a better question than, are you being scammed?

Maya: Ask a neutral question that reveals the circumstances, not whether the customer recognises the crime. Who introduced this recipient? How was the instruction received? Has anyone asked you to conceal the reason or bypass a warning? Responses are evidence for review, not an automatic verdict. Avoid telling customers how to produce the answer that makes the payment proceed. The investigator needs context and a safe way to pause the interaction.

Alex: But a determined customer may give the answers the adviser told her to give. Does that make interviewing pointless?

Maya: It means interviewing is one control, not a truth machine. Combine relevant payment behaviour, recipient intelligence and the conversation. Give the investigator access to the reason for concern and authority to change the outcome. A long checklist with no discretion creates theatre. So does a specialist queue that cannot respond before the customer abandons it or tries another route. Capacity and decision rights belong inside the control design.

Alex: We raise the alert rate and call that a stronger control. But my specialist queue then doubles. Is that merely a staffing problem?

Maya: It is part of the model's operational performance. If intervention requires a human decision, detection without capacity can mean action after the useful window has closed. Test arrival rates, service times and severe peaks, not just average demand. Agree safe escalation and fallback behaviour. Tune the process against timely, effective decisions, while reporting the cases delayed or never reviewed. More alerts are not automatically more protection.

Alex: Would you delay every first payment to a new recipient?

Maya: I would test a proportionate intervention against a defined risk, not recommend a blanket delay. Some legitimate payments are urgent. The important question is what a delay enables: independent verification, specialist review, or new receiving-bank information. A timer that expires without changing the evidence may add frustration without much protection. Any hold needs an appropriate basis, a review path and a reliable way to release legitimate funds.

Alex: We also have verification of payee. If the name matches, haven't we resolved the recipient problem?

Maya: We have resolved a narrower question: whether supplied name and account details match under that service. That is not certification of the investment or the recipient's intentions. The Instant Payments Regulation addresses verification for euro credit transfers, with different implementation dates across jurisdictions. Do not assume every Swedish-krona payment is already covered. Nor should a mismatch be described as an automatic legal requirement to reject every payment.

Alex: Let me test the same idea on business email compromise. The finance team receives a supplier's new account details. Their employee authenticates the transfer perfectly.

Maya: Then strengthen the process that accepted the change. Independently verify payment-detail changes using a contact route established before the suspicious instruction, rather than a number inside that message. Separate changing the beneficiary from approving the payment where proportionate. Protect the supplier-master-data process as a security boundary. Authentication of the employee cannot repair a supplier record that the organisation has accepted on false evidence.

Alex: We've concentrated on account transfers. How does this map help an acquirer or a merchant-risk team?

Maya: Follow the equivalent dependencies: how the merchant reaches customers, what is represented at purchase, who controls the merchant account, and where settlement proceeds go. Payment authentication does not establish that goods or services will be supplied. Complaints, refunds and chargebacks can provide later evidence, but arrive on different clocks. Apply controls to the actual scheme and your role. Do not import an account-transfer rule into acquiring and assume the same legal powers, evidence or customer remedies.

Alex: I'm revising my position. The question isn't just whether to add friction. It's what uncertainty the friction resolves, and who acts during it.

Maya: Yes, and measure whether that happened. Record the concern, evidence obtained, decision and eventual outcome. Check false stops and repeat attempts alongside confirmed scams. A payment that disappears from one channel may have moved to another institution or rail. Our recommendation is to investigate that possibility rather than declare every abandoned payment a successful prevention. The customer outcome matters beyond the bank's own completed-transaction statistics.

Alex: Now the receiving side. Rachel's bank sends the payment, and another institution receives it. Why does the industry still discuss this as mainly the sending bank's problem?

Maya: Because that is where the victim is most visible. Yet the receiving institution may see relationships and onward activity the sending bank cannot see. Treat receipt as a fresh detection opportunity. Understand the account's expected use, changes in control, incoming relationships and onward movement. A successful onboarding check is a historical observation. It does not establish that the account remains under the same person's control or is being used legitimately today.

Alex: So new-account screening is necessary but doesn't cover an older account that has been taken over or repurposed.

Maya: Correct. Monitor lifecycle changes and relevant network behaviour, not just account age. Shared devices, contact details or payment relationships may help identify a pattern, but they are not proof that everyone connected is criminal. Families and small businesses share infrastructure legitimately. Preserve the provenance and confidence of each link, and distinguish what a graph suggests from the evidence needed for a restrictive decision.

Alex: How far beyond the first recipient should the analysis go?

Maya: Far enough to examine the actual path to cash-out, within the institution's visibility and lawful cooperation. The British Financial Conduct Authority's September review describes operational tracing of one hundred and forty cases. It found important activity beyond the first receiving account. That selected exercise is evidence to challenge a first-account-only view, not a universal claim that every fraud follows the same number of hops.

Alex: A supplier says a newer graph model will solve the receiving-account problem. What would persuade you, beyond a better benchmark?

Maya: Evidence on the institution's relevant cases, with a realistic information cutoff and an executable intervention. Compare against a credible baseline, including existing rules and investigators. Examine incremental detection at a manageable review volume, stability and legitimate-customer impact. Then test how the output changes action. A graph can expose connections that individual-account analysis misses, but it cannot manufacture missing visibility or turn an uncertain connection into proof.

Alex: I want to turn that into a graph score. What would you challenge before approving it?

Maya: Whether the graph existed in that form when the decision had to be made. Later complaints and account closures can leak future knowledge into testing. Check time stamps, changing identities, incomplete coverage and how labels were obtained. Then examine the proposed action. Prioritising an investigator's queue and automatically restricting a customer's access are different uses. A good ranking result does not establish that both actions are justified.

Alex: And if the receiving bank identifies a suspected mule, is immediate closure the obvious success metric?

Maya: Closure counts alone are weak. An account may be compromised, its holder deceived, or a link wrongly inferred. Appropriate action depends on the facts and legal powers. Preserve evidence, investigate related exposure, protect legitimate customers and coordinate where permitted. Measure the interruption of harmful flows and the resolution of cases. Closing a visible account without addressing the surrounding network may simply move the activity.

Alex: What can the receiving bank send back that actually helps the sending investigator, without disclosing everything about its customer?

Maya: Agree a lawful, bounded exchange with clear meanings. For example, whether an intervention request was received, whether funds remain available for an authorised process, and what further information is required. The exact content depends on the applicable rules and authority. A vague flag with no time stamp or response route is much less useful than a narrowly defined, timely response that the receiving team is permitted and equipped to provide.

Alex: Let's follow the money after receipt. Should we optimise every institution's alert speed and assume the chain gets faster?

Maya: No. Optimise the complete response path. Detection can be quick while approval, communication or execution is slow. Identify the clock that matters: when the relevant funds can still be intercepted. Map the delay from signal to acknowledgement, decision and effective action, including evenings and weekends. An excellent model feeding an unattended inbox is not an effective real-time intervention.

Alex: The obvious proposal is to block onward payments whenever a concerning inbound payment arrives. What's the hidden difficulty?

Maya: The evidence and authority may be incomplete, and the account may contain legitimate money as well. You need proportionate decision rules, investigation, escalation and release arrangements. Do not confuse a suspicious pattern with a final finding of criminal ownership. Also test what happens when a message is duplicated, late or corrected. A rapid response system must handle legitimate customers and uncertain information as carefully as it handles speed.

Alex: Does moving into crypto mean the trail is over?

Maya: It changes the investigative environment. Banks, virtual-asset service providers and competent authorities may each hold different parts of the evidence. On-chain visibility does not automatically identify a person, establish ownership, or grant a power to freeze assets. The practical priority is a timely, well-supported referral to the actor able to act lawfully. Avoid both extremes: assuming nothing can be done, or assuming a transaction trace guarantees recovery.

Alex: Rachel received a small payment back earlier. She says that proves the investment works. Our investigator might find that reassuring too.

Maya: A previous payout establishes that a payment occurred, not that the proposition is legitimate. In our invented case, investigate the whole relationship and the evidence supporting the claimed investment. Do not let one apparently reassuring transaction erase other concerns. More generally, challenge the assumptions behind both suspicious and reassuring signals. Context can reduce risk or increase it; the investigator needs to explain why, rather than treating a single feature as a verdict.

Alex: Where do fraud operations and anti-money-laundering teams need to change their relationship?

Maya: Around decisions and feedback. Fraud teams may need rapid customer protection; financial-crime teams may identify wider networks and reporting obligations. Connect the workflows so urgent action does not wait for a long investigation, while evidence is retained for that investigation. Suspicious-activity reporting, customer reimbursement and payment intervention are different processes. Completing one does not prove the others happened. Allocate owners and check the handoffs in a realistic exercise.

Alex: Could we do more damage to the network by removing a shared enabler than by stopping Rachel's transfer?

Maya: Potentially, which is why prevention and investigation should exchange intelligence. A recurring recipient relationship, abusive communications service or laundering facilitator can connect many cases. But don't claim a takedown permanently eliminates the criminal capacity. Track replacement and recurrence. Coordination with law enforcement can support action on infrastructure beyond a bank's authority. The bank's immediate duty to handle Rachel's case remains, while that wider work develops.

Alex: So my dashboard needs two horizons: protect this customer now, and reduce the network's capacity to harm others later.

Maya: And the bridge between them is usable evidence. Retain the relevant transaction identifiers, event times, decision history and verified links under appropriate retention and access controls. Record what is observed separately from what is alleged. An investigator should not have to reconstruct a fragmented trail from screenshots while funds move. Better evidence also makes it possible to correct a mistaken inference rather than propagate it indefinitely.

Alex: Rachel realises the investment was false and calls us. Let's make this the recovery drill. What happens in the first operational handoff?

Maya: Establish a trusted contact, capture the essential payment facts and activate the appropriate intervention route promptly. Separate urgent preservation and interception requests from the longer narrative investigation. Identify who owns contacting the receiving institution and, where needed, the police or other competent authority. Tell Rachel what has been initiated and what remains uncertain. Speed helps only when the request reaches someone with the authority and information to act.

Alex: Suppose the first receiving institution says the money has already moved. Does our recovery process stop there?

Maya: No, but the next step depends on visibility, jurisdiction and the relevant authority. Preserve the first institution's usable response and route the available trail promptly through the permitted process. Don't assume an ordinary recall obliges every subsequent institution to freeze funds. The exercise should test a negative first response, an incomplete trail and an out-of-hours handoff. A workflow that succeeds only when the first recipient still holds everything is too narrow.

Alex: Where does INTERPOL's rapid intervention mechanism fit? Can the customer or our analyst simply press a global freeze button?

Maya: No. It facilitates rapid international law-enforcement cooperation through the relevant authorities. Published INTERPOL cases show that cross-border interception can be possible. They do not establish a universal success rate or guarantee that every institution can initiate the mechanism directly. The operational lesson is to maintain tested escalation routes before the emergency, with clear ownership across time zones and enough reliable information for the authority receiving the request.

Alex: People use intercepted, recovered, returned and reimbursed almost interchangeably. Why does that matter to a fraud leader?

Maya: Because they describe different outcomes. Funds provisionally stopped are not necessarily finally confiscated or returned to the victim. Reimbursement can protect the customer even where the criminal still has the proceeds. Legal processes and competing claims may affect return. Report each state separately. Otherwise a bank may overstate recovery, misunderstand its remaining exposure, or believe that a generous reimbursement outcome demonstrates that the criminal network has been disrupted.

Alex: Give me a real measurement example, with the caveats attached.

Maya: The UK Payment Systems Regulator's dashboard reports that eighty-nine per cent of reimbursable claim value was returned in the first quarter of twenty twenty-six. That concerns reported, closed claims within a specified Faster Payments scope. It is not the share of all fraud proceeds recovered. Its scope also differs from broader older industry data. A percentage is useful only after you understand the population and the outcome it measures.

Alex: And the independent evaluation suggesting lower scam losses? Can I claim the reimbursement rules caused that reduction?

Maya: Treat it as evidence with a method, not a slogan. The commissioned evaluation estimated lower comparable losses using several evidence sources and contribution analysis. It was not a randomised trial proving a single cause. Reporting changes, other interventions and displacement complicate attribution. For our own programmes, define the comparison and follow-up period before celebrating. Ask whether the improvement persists when customers, channels and later-confirmed cases are included.

Alex: What about Rachel after the claim is closed? Our process often treats that as the end.

Maya: The risk can continue. Provide clear follow-up, safe contact routes and warnings about false recovery offers without blaming the victim. Check whether access, credentials or connected accounts need protection in the particular case. Record unresolved concerns and ensure appropriate support. Our recommendation is to include repeat victimisation in the outcome measure. Closing a case administratively is not the same as restoring a customer's safety.

Alex: Let's turn this into a programme a fraud professional could defend. How do we show that a particular break point works?

Maya: Define the decision, eligible population, comparison, observation window and customer-harm measures. Use controlled testing where ethical and operationally appropriate, or a carefully justified phased comparison. Account for delayed fraud labels and changing attack mix. Do not remove established protections recklessly to create a clean experiment. The objective is a credible estimate of additional benefit, with uncertainty, rather than a dashboard designed to confirm the project was successful.

Alex: Additional benefit sounds simple until both banks claim they saved the same payment.

Maya: Exactly. Maintain a shared understanding of the event and its state where lawful. Distinguish attempted amount, prevented debit, intercepted proceeds, eventual return, customer loss and reimbursement. The same money can appear in several operational systems without representing several separate savings. Attribute contributions transparently instead of adding every headline together. Also report legitimate funds delayed, mistaken restrictions and the time taken to correct them.

Alex: What should we test about displacement? We cannot observe the whole financial system.

Maya: Be honest about that boundary. Look for repeat attempts in channels you can observe, use permitted partner feedback, and follow a defined set of customer cases over time. A lower loss rate in your channel may reflect prevention, migration, reporting changes or customer selection. Those explanations are not interchangeable. Record what evidence distinguishes them, and label the remaining uncertainty instead of silently treating missing visibility as zero harm.

Alex: If I have one cross-sector exercise next month, which one would you choose?

Maya: Follow Rachel's case from advertisement to final customer outcome. Ask the platform, telco, sending bank, receiving bank and relevant authority to identify their signal, authority, response time and feedback. Use a legitimate look-alike case as well, so the exercise tests correction and release. Find the slowest unresolved handoff. Assign an owner and a measurable improvement, then repeat the exercise. A contact directory without a tested decision process is not enough.

Alex: And where would you put the first investment if the exercise exposes five gaps?

Maya: Rank them by expected harm reduced, feasibility, legitimate-customer impact and the dependencies needed to act. Start with a concrete bottleneck you can change and measure. That could be receiving-side response capacity, safer supplier-detail verification, or a functioning partner escalation path. It need not be the most sophisticated model. Require an owner for the complete outcome, because a locally excellent control can still fail at the next handoff.

Alex: Then my learning today is this: authentication is one question, a recipient match is another, and neither settles whether the purpose is genuine. We need action at several stages, but we also need to know whether those actions actually changed the customer's outcome.

Maya: That's the right challenge. Map the chain, identify who can break each dependency, and test the handoffs under real operational conditions. Protect the customer, investigate the network and measure both effectiveness and harm. This has been the Nordic Fraud Briefing on breaking the fraud kill chain. Sources and the full dialogue are on the episode page. Thank you for listening.