Fraud prevention is moving beyond the boundaries of individual banks. As payments become faster and scam networks become more coordinated, a single institution can have only a partial view of suspicious activity. One bank may see an outbound payment, another the recipient account and a third the next transfer in the chain. The risk pattern emerges across the network rather than inside one ledger. Research from the BIS Innovation Hub has helped make this shift more visible by testing whether payment-system analytics can supplement the monitoring performed by individual banks and payment service providers.
The limits of institution-by-institution monitoring
Banks have spent decades building transaction-monitoring systems around their own customers, accounts and products. That model remains essential, but it was designed for a world in which payment activity often left more time for review and where many risks could be inferred from the behaviour of a single account. Instant payments and digital scams challenge both assumptions.
A customer can now be persuaded to send money in seconds, while mule accounts can disperse funds across several institutions before an alert is investigated. A bank may correctly identify an unusual transfer yet lack visibility into the wider network receiving and redistributing the proceeds. The result is an information asymmetry: criminals can operate across institutions while controls are frequently organised within them.
The Basel Committee and Financial Stability Institute discussion of digital fraud emphasises that digitalisation improves convenience and efficiency but also creates risks for banks and the wider financial system. The response increasingly requires coordination rather than simply stronger controls at individual firms.
Payment systems can become a source of intelligence
Payment infrastructures occupy a unique position because they can observe flows between participating institutions. That does not mean they should replace bank-level monitoring. It means they may be able to identify patterns that are difficult for any single participant to see, such as unusual concentration of incoming payments, repeated chains of transfers or clusters of accounts connected through timing and transaction behaviour.
Project Hertha explored exactly this idea using a synthetic transaction dataset. The BIS report found that system-level analytics could provide supplementary signals to help banks and payment service providers identify illicit accounts, particularly when patterns were novel. The important word is supplementary: local knowledge of customers remains critical, but network signals can add context.
This creates the possibility of a two-layer model. Banks continue to conduct customer due diligence, monitor behaviour and investigate alerts. Payment networks or shared utilities generate ecosystem-level risk signals that can be distributed back to participants. The value may lie in combining both perspectives.
The move from rules to relationship patterns
Traditional fraud systems often rely on rules: transaction size, location, device change, velocity or unusual beneficiaries. These remain useful because they are understandable and easy to govern. However, organised fraud can deliberately stay below thresholds or distribute activity in ways that look ordinary when viewed one account at a time.
Graph analytics and machine-learning techniques can instead focus on relationships. They can examine how accounts are connected, how quickly funds move through a network and whether multiple users exhibit similar behavioural signatures. This can help identify mule networks and coordinated attacks without relying on one obvious red flag.
The shift is consistent with broader work on trust in fast payments. BIS Innovation Hub material on scalable and open finance highlights low-latency fraud and cyber-risk management as an important requirement for fast-payment systems. As transaction times compress, analytical systems may need to move from post-event detection toward pre-transaction or in-transaction decisions.
Data sharing becomes the governance challenge
Network-level fraud prevention immediately raises difficult questions. What data can be shared? Who operates the shared utility? How are false positives corrected? Can a bank challenge a network-generated risk score? How are privacy, competition and customer-protection obligations balanced?
These questions are not reasons to avoid collaboration. They are reasons to design it carefully. Shared intelligence does not necessarily require unrestricted access to raw customer data. Systems can be designed around limited attributes, pseudonymised identifiers, risk signals or privacy-enhancing techniques. The objective is to reveal patterns while minimising unnecessary exposure of personal information.
Governance will be as important as model accuracy. Banks will need confidence that external signals are reliable, explainable and subject to clear accountability. Regulators will need confidence that collaboration does not create a black-box infrastructure in which customers can be blocked without meaningful review.
Customer protection moves closer to transaction execution
As fraud controls become more real-time, banks may intervene earlier in the payment journey. That could mean stronger authentication, confirmation prompts, transaction holds or requests for additional context. The design challenge is to prevent fraud without turning every payment into a cumbersome process.
The best systems will likely use risk-based friction. A familiar payment between known parties may proceed instantly. A payment with multiple high-risk signals may trigger additional verification. A transaction associated with a network-level risk cluster may be delayed for review. This makes customer experience part of fraud architecture rather than a separate design concern.
Banks will also need better communication. A customer who understands why a payment is being delayed is more likely to accept a protective control than one who encounters an unexplained block. Clear messaging, appeals processes and rapid case resolution can become important components of trust.
Fraud prevention becomes a shared capability
Banking has long relied on shared infrastructure for clearing, settlement, identity standards and cybersecurity information. Fraud prevention is increasingly moving in the same direction. The competitive advantage may not come from keeping every signal proprietary, but from combining industry-level intelligence with institution-specific customer knowledge and response capabilities.
This does not eliminate the need for investment inside banks. Institutions still need modern data platforms, real-time decision engines, model governance and skilled investigators. But it changes what good looks like. A strong fraud function may increasingly be judged by how effectively it connects to external signals, contributes validated intelligence back to the ecosystem and turns shared information into timely action.
In a faster payments environment, the bank with the best isolated model can still miss a scam that is visible only across the network. That is why fraud prevention is becoming less of a standalone control function and more of a shared infrastructure problem.
Key questions
Why is bank-level monitoring no longer enough on its own?
Coordinated fraud often spans several institutions, so no single bank sees the complete transaction network.
What is network-level fraud analytics?
It uses payment-system or shared ecosystem data to identify suspicious relationships and patterns that may not be visible within one institution.
Will shared analytics replace bank fraud teams?
No. Network signals are most useful as a supplement to customer knowledge, transaction monitoring and investigation inside each bank.
What is the biggest obstacle?
Governance around privacy, data sharing, explainability, accountability and false positives is likely to be as important as the technology itself.