Every risk team I speak with can tell me precisely who their customers are. Far fewer can tell me what those customers were doing at the moment the money moved. The blind spot is a quietly bleeding enterprise balance sheet through dispute fees, forced refunds, support hours, and, most catastrophically, the destroyed Lifetime Value (LTV) of legitimate users caught in the crossfire.
Static identity answers one narrow thing: who owns the credential being used? It says nothing about intent, pressure, coercion, or why a particular individual is moving a particular sum of money to a new location on a Tuesday afternoon.
Identity Isn’t Intent
Passing a document check is merely a snapshot in time, it is not a representation of an account behavior three months later.
Money muling activity jumped 69% across the first half of 2026, meaning nearly a third of all account fraud originates from accounts that were cleared during the initial onboarding checks.
The overfocus on the front-door onboarding creates a dangerous commercial paradox: platforms rely heavily on strict KYC, burning conversion in the process, but then go completely blind the moment the actual transaction occurs.
Static KYC creates a false sense of security at the front door while leaving the transaction window unguarded.[Text Wrapping Break]
Social Engineering Now Outpaces Authentication Controls
Strong customer authentication and 2FA perform exactly as designed against the attacks they were built for. The European Banking Authority and the European Central Bank published joint findings in December 2025 confirming that strong customer authentication remains effective against traditional unauthorized payment fraud, especially for card payments inside the EEA.
However, roughly 85% of European credit transfer fraud losses come from social engineering rather than account takeover (ATO). The massive surge in cheap and easy-to-use AI tools, voice clones, and automated scripts have industrialized human manipulation. Fraudsters no longer need to bypass your technical controls; they are using your KYC-approved customers to walk right past them.
When an exchange or payment platform processes these coerced transfers, the legacy stack approves it because it is coming from a clean, KYC-verified account. But the effect on the balance sheet is drastic:
- Chargeback and dispute ratios are elevated;
- More pressure on the support to mitigate distressed customers and recover funds;
- Increased payment processors scrutiny and regulatory pressure, pushing platforms toward VAMP/ECM monitoring thresholds;
- Mass customer churn, as legitimate users who get scammed or falsely declined abandon the platform permanently for a competitor.
Scam Losses Keep Climbing Across Every Major Market
Authorized scam losses and unauthorized fraud are moving in opposite directions. In the UK, authorized push payment (APP) losses climbed 19% to £576.4M as traditional unauthorized fraud fell 5%. Technical controls are successfully stopping account takeovers, but platforms remain completely unguarded against coerced transfers.
The same pattern can be seen internationally: American consumers reported $3.5B lost to imposter scams out of $16B in total fraud losses, Australians, in turn, reported $2.18B in total losses ($166.8M from payment redirection alone), and Singapore saw government impersonation losses surge 60% to S$242.9M despite an overall drop in scam volume.
Cross-border flows confirm this exposure, with 71% of European card payment fraud linked to international transfers, where fragmented data leaves no single institution holding a complete view of the transaction.
Impersonation Went Industrial
The FBI’s Internet Crime Complaint Center logs over 22K complaints and close to $893M in losses from AI-driven impersonation during 2025. Cheap voice cloning, deepfake videos, and automated social engineering tools have turned human manipulation from a manual task into an industrial weapon.
These tools bypass technical controls entirely by remote-controlling the verified account holder. For exchanges, PSPs, and payment rails, this lands on the P&L as authorized high-value transfers executing at compressed velocity—inflated ticket sizes, elevated dispute rates, regulator scrutiny, support queues full of distressed customers, and declining market trust.
Card Network Push Scam Liability Onto Acquirers: Mastercard’s Reality Check
If you think authorized scam losses are strictly the cardholder’s or issuer’s problem, think again. This year, card networks started actively shifting authorized scam losses to the acquiring ecosystem.
Mastercard’s revised merchant monitoring rules require acquirers and payment facilitators to open formal investigations within 72 hours of receiving scam signals filed under Fraud Type 56 (Manipulation of Cardholder.)
This is an immediate commercial threat. A formal classification now exists, linking scam losses to named merchants and to the acquirers who onboarded them. If authorization data, device signals, and static KYC checks all return 100% clean on coerced transactions, your current identity stack yields zero behavioral telemetry to defend your merchant when the 72-hour clock starts ticking.
Exposing Intent Without Killing Conversion
The solution isn’t adding thicker armor or more verification steps. Step-up friction (OTP prompts, repeated KYC re-submissions, forced delays) destroys top-line revenue. Over 60% of consumers abandon purchases after facing false declines or excessive checkout friction.
Intent must be evaluated passively at the session layer:
- Behavioral Dynamics: Session duration, dwell time, typing rhythm, and navigation paths that deviate from returning user baselines.
- Environmental Flags: Remote-access indicators, screen-sharing tools, and rapid payload velocity across compressed timeframes.
- Cross-Merchant Telemetry: Network-level patterns evaluating behavioral context across institutions that no single platform can observe in isolation.
Gathered passively from interactions the user is already making, this telemetry is scored in real time before authorization—improving fraud detection by over 40% while slashing false declines.
Stopping coerced fraud cannot come at the expense of checkout conversion. Step-up friction and false declines destroy top-line growth; 45% of users refuse to retry a transaction after a single failed attempt, and 42% abandon the platform permanently
Verification hurdles and step-up friction stall platform activation, with 70% of digital asset users abandoning platforms before completing their first transaction when hit with payment delays.
Verification proves ownership, it cannot detect manipulation. Traditional checks only confirm who holds the account; behavioral intent scoring reveals how that user is acting and whether they are being manipulated in real time. So, to catch social engineering without ruining conversion, risk engines must look beyond static identity and evaluate live user behavior.
That said, intent must be evaluated passively based on a thousands of data points at the session layer before authorization occurs, including but not limited to behavioral dynamics (session duration, dwell time, typing and scrolling cadence, navigation paths that deviate from returning user baselines), environmental flag (active remote-access software, screen-sharing indicators, rapid payload velocity across compressed timeframes), cross-merchant telemetry (network-level intent patterns observed across institutions that no single platform can detect in isolation).
Reallocating theFraud Dollar
Sanctions screening and regulatory compliance justify identity spending. But pouring more budget into static identity checks and step-up friction to stop social engineering is like building thicker armor against laser guns. Compliance needs identity verification. Risk engines need intent.
Sanctions screening, regulatory obligation, and basic account security all justify the identity spend, and every one of those obligations stays put. Keeping the bulk of the fraud budget parked there produces diminishing returns and leaves the front door open, given that the costliest attacks now arrive wearing a face the system already approved.
You don’t have two years to build contextual ML models from scratch as organized crime scales its AI operations. Behavioral intent scoring is a commercially available capability today, trained on cross-merchant data, deployed on live checkout rails, and running passively behind the transactions you are already approving.
More importantly, true strategic partners don’t just sell software licenses and leave you holding 100% of the chargeback risk. They back their AI decisioning with real balance-sheet skin in the game, assuming full financial liability transfer and guaranteeing approval rates.
The fraudsters rebuilt their tech stack some time ago. It’s time payment platforms stopped settling for tools that protect identity while quietly killing their growth.
