Payment security and fraud basics

IN ONE LINE

An everyday analogy: a bank branch never relied on one lock.

The door had a key, the vault had a combination, the teller checked signatures, large withdrawals needed the manager, and cameras recorded everything anyway.

Payment security works the same way — in layers, on the assumption that any single layer sometimes fails.

Some layers check who you are, some check whether this payment looks like you, some make a second person approve, and some just watch and remember.

The fraudster's job is to beat every layer at once; the defender's job is to make the layers fail independently, so that beating one tells you nothing about beating the next.

No single layer is the security; the layering is.

WHAT IT ACTUALLY IS

Threats cluster into a few families.

Customers are deceived into authorising payments themselves — impersonation and invoice-redirection scams — or their credentials are stolen and payments made for them.

Insiders can abuse access.

And the bank's infrastructure can be attacked directly, with fraudulent interbank instructions injected or systems manipulated.

Controls map onto the lifecycle: strong authentication and Verification of Payee at initiation; limits, dual authorisation, and anomaly monitoring in processing; network-level trust controls such as RMA governing who may even exchange messages between banks; and reconciliation afterwards, as the detective layer where injected or altered payments surface as breaks.

Sanctions screening is a neighbouring but distinct discipline — a compliance obligation, not a fraud control, even when one system hosts both.

HOW IT WORKS

Two practitioner themes.

First, speed changes the geometry: instant rails leave no overnight window in which to catch a payment, so controls migrate to before authorisation — real-time scoring, Verification of Payee results in the approval flow, friction added selectively when risk is high.

The recall exists, but recovery after the fact is uncertain by design, as every fraud-operations team learns.

Second, friction is a budget: every control spends customer convenience, and spending it uniformly means both annoying legitimate customers and under-protecting the risky moments; mature programmes spend friction where the signals concentrate.

Institutional designs vary widely — team structures, tooling, where fraud ends and disputes begin — and this topic stays at the pattern level deliberately: fictional examples only, and no playbook detail that would help the other side.

THE WORDS

Authorised push payment fraud

Fraud where the victim is deceived into authorising a payment to an account the criminal controls, so the bank's checks see a genuine instruction.

READ FIRST

• A day in payment operations

CONNECTED TO

• CHECKPOINT Payment operations checkpoint
• EXCEPTION LAB A warning that works: Verification of Payee returns NO MATCH

SOURCES

• Payments Signal editorial teaching models — Payments Signal