In This Article

While most institutions still patch aging playbooks with new rules, adversaries have already automated the evasion. The shift to adaptive AI isn’t a technology upgrade, it’s a structural reckoning.

There is a number that should unsettle every risk officer in financial services: $16.6 billion. That is what the FBI’s Internet Crime Complaint Center recorded in US fraud losses in 2024, a 33% jump over the prior year, and part of a five year cumulative toll exceeding $50 billion.[1] The Federal Trade Commission counted an additional $12.5 billion in consumer fraud losses the same year, a 25% increase over 2023.[2] And those are only the crimes that were reported.

The real cost is even more brutal when you factor in the multiplier effect. According to LexisNexis Risk Solutions’ 2025 True Cost of Fraud Study, every dollar lost to fraud costs North American financial institutions more than five dollars in total, up 25% from $4 just four years ago, once you account for investigation expenses, regulatory fines, and the grinding damage to customer trust.[3]

Against this backdrop, most institutions are still fighting a 21st century adversary with 20th century weapons. They are, quite literally, writing new rules to fight criminals who have already automated the evasion.

$ 16.6B

US fraud losses (reported) in 2024

FBI IC3 Annual Report, Apr 2025

+33%

Year over year growth in 2024 losses

FBI IC3 Annual Report, Apr 2025

$5.00+

Pages of architectural depth

LexisNexis Risk Solutions, Sep 2025

57%

Of institutions lost over $500K in direct fraud in 12 months

Alloy State of Fraud Report, 2024

The Architecture of the Status Quo and Its Cracks

Rule based fraud detection has a comprehensible elegance to it. A transaction exceeds $10,000? Flag it. A card is swiped in Lagos at 2 a.m. when the cardholder is in Dallas? Decline it. These deterministic rules, the same input always producing the same output, are the backbone of most institutional fraud programs.

According to the FFIEC IT Examination Handbook, the average mid market bank maintains between 300 and 800 active fraud detection rules across card, wire, ACH, and account level monitoring.[4] These libraries are built by seasoned fraud analysts and can be highly effective against known typologies. The Federal Reserve’s 2025 Payments Study found that institutions with mature rule based systems still catch 78–85% of known fraud patterns.[4]

That sounds respectable until you register two brutal truths: first, the 15–22% they miss is exactly where sophisticated fraud hides; and second, maintaining that rule library is a labor-intensive, slow-moving process. A 2025 Aite Novarica survey of 120 financial institutions found that the average fraud team spends 35% of its time writing, testing, and tuning rules.[4]

“Rules based systems cannot account for evolving fraud patterns and contribute significantly to false positives and operational inefficiency.”

— IBM, cited in Binariks Analysis of AI Powered Fraud Detection, Dec 2025

False positives are not merely an annoyance. When a legitimate transaction is declined, a real customer is turned away. That friction compounds into support calls, chargebacks, customer attrition, and reputational damage. The 73% of fraud decision makers who named reputational damage as their top concern post incident aren’t wrong to be afraid of it.[5]

And none of this addresses the deeper structural failure: fraudsters adapt faster than rule libraries can be updated. Every new rule is written in response to a pattern that already worked. By the time an analyst encodes it, the adversary has moved on.

The Maintenance Trap

Rule based fraud teams spend an estimated 35% of their time writing, testing, and tuning rules a percentage that grows with the library’s complexity. This is time not spent on investigation, analytics, or threat intelligence. It is, structurally, a treadmill.

What AI Powered Detection Actually Does Differently

The marketing around ‘AI fraud detection’ is unfortunately thick with vague promises. It is worth being precise about what modern machine learning systems actually do that rule engines cannot.

1. Pattern Detection Across Dimensions Humans Cannot Track

A rule checks one or a few conditions at a time. A supervised machine learning model trained on historical fraud data can simultaneously evaluate hundreds of signals, transaction amount, velocity, device fingerprint, geographic trajectory, time of day, merchant category, behavioral biometrics, and weight them probabilistically against each transaction. This is not incremental; it is architecturally different.

More importantly, unsupervised anomaly detection models can surface patterns nobody anticipated. According to McKinsey’s 2025 Banking Technology Report, institutions using unsupervised anomaly detection caught 35–40% more novel fraud patterns than those relying solely on rules or supervised models.[4] These are frauds that no rule would have caught because no analyst had seen the pattern before.

2. Graph Intelligence Fraud Is Networked, Detection Should Be Too

One of the most significant technical advances in fraud detection over the past several years is the application of Graph Neural Networks (GNNs). The insight is fundamental: financial fraud is not committed by isolated transactions. It is committed by networks of accounts, devices, phone numbers, IP addresses, merchants, and mules that operate in coordinated patterns over time.

Traditional ML models that analyze individual transactions in isolation miss this entirely. GNNs model the relationships between entities and propagate risk signals across the graph. Research published in 2025 at ICAART demonstrated that heterogeneous temporal GNN frameworks significantly outperform conventional techniques in identifying fraudulent transactions by capturing dynamic user interactions, temporal patterns, and contextual behavior.[6] A published implementation using Neo4j achieved 91% accuracy and an AUC of 0.961, successfully identifying coordinated fraud rings while keeping false positives low.[7]

This matters particularly for authorized push payment (APP) scams, where customers are tricked into initiating payments themselves. The transaction is technically ‘authorized’, making it invisible to rules that look only at the transaction, but detectable to a graph model that can see the behavioral context.[8]

3. Speed Commensurate With Real Time Payment Rails

Credit card authorizations happen in under 100 milliseconds.[9] The rise of instant payment networks, Faster Payments in the UK, UPI in India, Pix in Brazil, means fraud decisions must now be made in seconds, for transactions that are irrevocable once sent. Rule engines can execute quickly, but they cannot adapt. An AI model that is retrained continuously can narrow its inference window while simultaneously evolving its detection logic.

4. A Dramatic Reduction in False Positives

Arguably the most commercially significant advantage of ML-based fraud systems is the reduction in false positives. Danske Bank’s well-documented transition from rule-based to AI-powered detection resulted in a 60% reduction in false positives and a 50% increase in true fraud detection.[10] Banks deploying modern AI systems now report up to a 98% success rate in fraud identification, compared to far lower rates with pure rule systems.[10]

The mechanism here is contextual evaluation. Where a rule might flag any transaction over $5,000 in a new country as suspicious, a well-trained model understands that this particular cardholder travels frequently, has made similar transactions before, and used a recognized device from a hotel network, and clears the transaction appropriately.

While most institutions still patch aging playbooks with new rules, adversaries have already automated the evasion. The shift to adaptive AI isn’t a technology upgrade, it’s a structural reckoning.

60%

Reduction in false positives at Danske Bank after AI adoption

Vertu / Industry Case Studies, 2025

35–40%

More novel fraud patterns caught by unsupervised anomaly detection

McKinsey Banking Technology Report, 2025

71%

Of financial services firms using AI for risk assessment in 2025

Thomson Reuters Survey, cited by Flagright, Jan 2026

11%

Of bot traffic identified by WAFs in real world testing

DataDome Global Bot Security Report, 2025

The Signal You’re Actually Missing: Intent vs. Identity

The most important conceptual shift in AI based fraud detection is one that rarely gets named plainly: the move from verifying identity to inferring intent.

Rule based systems are fundamentally identity systems. They ask: is this a known card? A known device? A known location? AI systems can ask a harder and more useful question: is this transaction consistent with this person’s behavior, and with the behavior of non fraudulent actors in similar contexts?

This matters because the most sophisticated fraud attacks don’t fail identity checks. Synthetic identity fraud, where a fictitious identity is assembled from real Social Security numbers, real addresses, and fabricated other details, passes identity verification. Account takeovers using stolen credentials pass it. Social engineering that tricks the actual customer into pushing funds passes it entirely. US lenders faced $3.3 billion in exposure from synthetic identities tied to newly opened accounts in the period examined by recent regulatory data.[11]

Behavioral biometrics, real time identity graph analysis, and continuous model retraining can catch what identity checks cannot, because they are looking at the texture of behavior rather than the presence of credentials.[11]

“Fraud detection must shift from reactive rule sets to adaptive AI models. Static, point in time controls are architecturally incompatible with AI powered fraud campaigns that evolve in real time.”

The Honest Complications

Any account of AI fraud detection that does not engage its genuine complications is advocacy, not analysis. There are three problems worth taking seriously.

The Explainability Imperative

A neural network that flags a transaction with 95% confidence is, from a regulatory standpoint, useless if you cannot explain why. The OCC’s 2024 guidance on model risk management (building on SR 11-7) explicitly requires that institutions using AI for fraud detection must be able to explain individual decisions in a manner that is ‘understandable to informed but non technical stakeholders.’[4] The OCC, Federal Reserve, and CFPB are watching, and fair lending implications of opaque AI decisioning are not hypothetical.[11]

This is a solvable problem; logistic regression, decision trees, and gradient boosting methods can be highly effective and are inherently more interpretable than deep neural networks, but it requires deliberate architectural choices rather than deploying the most powerful model available and hoping regulators don’t ask hard questions.

Deloitte’s 2025 EMEA Model Risk Management Survey found that AI is now among the most frequently deployed tools for fraud detection across European financial institutions, and that governing those models is one of the sector’s most pressing compliance challenges.[12]

Data Quality and Bias

Machine learning models are only as good as their training data. A model trained on historical fraud data inherits the biases of the human analysts and rule systems that labeled that data. If prior systems were more likely to flag transactions from certain geographies or demographic groups, the model learns that pattern. McKinsey’s 2024 State of AI in Risk report noted that nearly half of organizations deploying AI lack clear governance frameworks for those systems.[13]

Model risk management frameworks need to extend explicitly to AI, with board level accountability, explainability requirements, and bias detection built into the model development lifecycle from the outset not bolted on after deployment.[11]

The Hybrid Reality

The narrative that AI makes rules obsolete is factually wrong. Rule based systems remain superior in specific, critical domains: regulatory thresholds (BSA/AML reporting requirements are statutory, a model cannot waive a Currency Transaction Report), known fraud typologies where determinism is operationally valuable, and as a failsafe baseline when models behave unexpectedly.[4]

The strongest fraud operations in 2025 and 2026 are hybrid. Rules provide an auditable, explainable floor. AI provides adaptive intelligence above that floor, catching what rules miss, reducing false positives, and surfacing novel threats. Organizations seeking the best fraud detection solution have found that a hybrid, AI first approach is the clear winner over either pure approach.[3]

What the Evidence Supports

A well designed hybrid system, rules for known typologies and regulatory thresholds, AI for behavioral anomaly detection and novel pattern identification outperforms both pure approaches on detection rates, false positive rates, and total cost. Neither technology alone is sufficient.

The 44% of North American financial institutions that still primarily rely on manual processes[3] are not being cautious. They are being left behind.

Where This Is Going

Several vectors are accelerating the pressure on institutions that have not yet made the shift.

First, adversaries have industrialized AI powered fraud. Deepfake driven identity fraud, AI generated phishing at scale, and automated credential stuffing operations mean that static rule libraries are not just slow to update; they are outgunned. Reported identity and related fraud losses in financial services reached $12.5 billion in 2024, up 25% over 2023, with synthetic identities as a primary driver.[11]

Second, the real time payment infrastructure is expanding globally. As A2A rails scale, Pix in Brazil, FedNow in the US, Faster Payments in the UK, the window for fraud intervention narrows to seconds, and the irrevocability of settled transactions makes post hoc recovery nearly impossible. Detection must move upstream, into the transaction authorization flow.[8]

Third, regulatory tolerance for inadequate model governance is shrinking. The EU AI Act, adopted in 2024, introduces mandatory documentation, testing, and human oversight requirements for high risk AI systems and fraud detection at financial institutions almost certainly falls into that category. Regulators in the UK, Hong Kong, Singapore, and the US are all developing or tightening AI model governance expectations.[13]

The Diagnosis

The fraud signal most institutions are missing is not a new fraud typology. It is the systemic signal that their detection architecture is falling structurally further behind with every year they defer the transition to adaptive, AI driven systems.

Rule based detection is not wrong; it is incomplete. It is an excellent answer to the fraud landscape of ten years ago. Today’s fraud is networked, adaptive, identity aware, and in many cases AI generated. Meeting it requires systems that can learn continuously, evaluate context rather than just flags, and surface patterns that no analyst anticipated.

Satish Lalchand of Deloitte put it plainly: banks need AI’s ability to ‘detect unknown cases of known fraud schemes’ and to find how criminals are ‘changing to evade detection.’[14] That is a description of a moving target, which means the only appropriate response is a moving defense.

The 44% of financial institutions still primarily relying on manual processes[3] should ask themselves a hard question: if their rule library was designed to catch yesterday’s fraud, what is it missing today?

Comparison: Rule-Based vs. AI Powered Fraud Detection

Dimension Rule Based Systems AI/ML Systems
Adaptability Static – requires manual updates for each new pattern Continuously retrains on new fraud data
Novel threat detection Blind – can only catch patterns rules anticipate Unsupervised models catch 35-40% more novel patterns (McKinsey)
False positive rate High – blunt thresholds flag many legitimate transactions Significantly lower through contextual evaluation
Explainability Fully deterministic – auditable by regulators Varies by model type; deep neural nets require interpretability work
Network/ring fraud Weak – evaluates transactions in isolation Graph Neural Networks map relationships across accounts, devices
Maintenance burden Fraud teams spend ~35% of time maintaining rules Automated retraining; human oversight for model governance
Regulatory compliance Statutory thresholds (e.g., CTR filings) are deterministic Requires model risk management documentation per OCC/SR 11-7
Intent inference Identity focused; misses behavioral context Evaluates user intent, behavioral biometrics, and velocity
Best verdict Necessary baseline; superior for known patterns and regulatory rules Superior for novel threats, false positive reduction; requires governance

Sources & References

Accelerating business clockspeeds powered by Sage IT

Field is required!
Field is required!
Field is required!
Field is required!
Invalid phone number!
Invalid phone number!
Field is required!
Field is required!
Plan with our Experts
Share this article, choose your platform!
Related Articles