Can AI Detect Fraud Better?

The problem, in numbers

ASIC found that all four major banks already run transaction monitoring to detect fraud and scam patterns,^{Source 1} so the question is not whether banks use detection systems. It is whether they catch what matters. For scams in Australia, the answer has been: not much of it. Between July 2021 and June 2022, customers of the four major banks made $845 million of scam payments. The banks detected and stopped around $109 million, approximately 13%, and customers bore 96% of the scam losses.^{Source 1}

ASIC's follow-up shows the number can move. The share of scam payments detected and stopped by the major banks rose to 23% in 2022-23 and 24% in the nine months to March 2024.^{Source 2} ASIC said the improvement was primarily attributed to added friction on payments to digital currency exchanges and to better hold and behavioural biometric capabilities in detection systems.^{Source 2} Neither figure counts scams prevented before the customer made the payment.^{Source 1,Source 2}

What improves, and why

Two kinds of fraud look alike on a statement but differ in a model. In unauthorised fraud, someone else uses the card or the login, so the payment departs from the customer's own pattern. That departure is what behavioural models look for. In authorised fraud, the customer is persuaded to send the money themselves, from their own phone, with their own credentials. The behaviour can look normal because it is the customer acting.

UK figures show the split. In 2025 the UK industry stopped 70p in every £1 of attempted unauthorised fraud, £1.68 billion in total, and unauthorised losses fell 5% to £703.4 million. In the same year, authorised push payment losses rose 19% to £576.4 million.^{Source 3} UK Finance does not attribute the prevention figure to any one technology. In our reading, it reflects layered controls of which models are one part.

Where models help most visibly is in sorting. Rule-based monitoring raises alerts on fixed thresholds, and every alert costs an investigator's time. A peer-reviewed study at Norway's largest bank, DNB, trained a model on 2014 to 2016 transactions to rank which ones to investigate for money laundering, a neighbouring problem to fraud. On held-out test data, to find 95% of the transactions later reported to authorities, the model needed 36% fewer transactions reviewed than the bank's rule-based system; at 80% detection, 51% fewer.^{Source 4}

What the evidence actually says

The evidence supports a narrow claim strongly and a broad claim weakly. The narrow claim: on one bank's historical data, a learned model ranked risk better than fixed rules, so the same review effort caught more, or the same catch needed less effort.^{Source 4} The broad claim, that AI has made Australians safer from scams, the data cannot isolate. ASIC's improvement came from friction, payment holds and behavioural biometrics together,^{Source 2} and we found no source that separates the model's share.

Collaboration may matter as much as the algorithm. In a Bank for International Settlements simulation, collaborative analysis across institutions was more effective than the current siloed, rules-based approach, detecting potentially up to three times more money laundering in complex schemes and reducing false positives by up to 80%, though the BIS does not state the 80% baseline.^{Source 6} That is a simulation, not a live result. Australia has moved the same way: under the industry's Scam-Safe Accord, banks joined the Australian Financial Crimes Exchange to share scam intelligence in July 2024, and confirmation of payee is now live at participating banks nationally.^{Source 7}

The false-positive side is where ASIC's evidence is most revealing. The banks set detection rules and thresholds by weighing the rate of false positives, the impact on customers, including those caught by false positives, and the potential loss. Operational capacity, the ability to respond to alerts, was also a major driver.^{Source 1} In our reading, the threshold reflects how many alerts the bank can staff, not only what the model can see.

Where it falls short

• Fraud changes faster than labels arrive. In a study of more than 75 million card transactions over three years, the authors describe customer habits and fraudster strategies shifting over time, and most transactions never being checked by an investigator, so confirmed labels arrive late.^{Source 5}

• An alert is only as good as the response. ASIC described a bank whose system quarantined three payments for eight hours; the bank did not act in that window and the payments were released. Some channels cannot hold a payment in real time at all.^{Source 1}

• Scams look like the customer. In our reading, behavioural signals weaken when the real customer authorises the payment. UK authorised fraud losses rose while unauthorised losses fell.^{Source 3}

• Investigators see a fraction. Only a few alerts can be checked each day, so the authors argue alert precision matters more than global measures such as AUC.^{Source 5}

Where governance decides the outcome

Where to set the threshold is a decision about who carries the cost of being wrong. A low threshold delays more honest payments and needs more investigators; a high one leaves more scam losses with customers, who bore 96% of them in ASIC's 2021-22 data.^{Source 1} That choice used to sit inside the bank. It is moving into law. The Scams Prevention Framework, passed in February 2025, will require designated businesses, starting with banks, telcos and social media companies, to prevent, detect, disrupt, respond to and report scams, with fines of up to $50 million and pathways to compensation where a business fails to meet the standards. The release gives no start date.^{Source 8} Under the UK's reimbursement policy for authorised push payment scams, 88% of the money lost and claimed back from a payment firm was returned to victims, for claims closed between October 2024 and June 2025.^{Source 8} When the bank pays for a missed scam, the economics of a false positive change, and in our assessment the threshold should be revisited with them.

Write the threshold policy down, with the false-positive rate, the friction it imposes and the staffing it assumes. Monitor the model for drift. Check whether delays and blocks fall harder on particular groups of customers. Treat intelligence sharing as a privacy question as well as a detection one.

How to think about adoption

For a bank or payments business, the first decision is what to hold models to. Measure the share of scam and fraud value stopped, as ASIC does for scams, alongside the false-positive rate and the time from alert to action. Start where the evidence is strongest: ranking alerts so investigators see the riskiest first, and unauthorised fraud. For authorised scams, pair models with friction that gives the customer time to reconsider, and with shared intelligence about scam payees. Set the threshold as a policy, approved by people accountable for both the losses and the customer experience, and revisit it whenever the liability rules change.