Financial fraud: Part 2
The second instalment of this series examines the challenges facing financial institutions and how AI is changing the way they approach fraud prevention.
AS financial fraud becomes increasingly sophisticated, financial institutions face critical gaps in detecting scams before victims’ money leaves their accounts, particularly as instant payments and artificial intelligence (AI) reshape the fraud landscape.
Experts say one of the biggest challenges is moving fraud detection from a largely post-transaction exercise to real-time intervention at the point of authorisation, while breaking down organisational and information-sharing silos across the financial sector.
TrustDecision Chief Data & AI Officer Dr Simon Liu said many institutions still conduct their most comprehensive risk assessment after money had already moved.
“On instant rails, that is simply too late,” he said.
Liu said another major gap was organisational rather than technical, with fraud, anti-money laundering (AML) and cybersecurity teams still operating separately in many financial institutions.
“Fraud, AML and cyber teams still sit in silos at many banks, while the criminals run one continuous pipeline: scam the victim, mule the funds, launder the proceeds.
“Three departments chasing one criminal, each seeing a third of the picture,” he said.
He also stressed the importance of intelligence sharing between financial institutions, noting that mule networks were deliberately spread across multiple banks.
“No single bank can see it whole, which is why national infrastructure like the National Fraud Portal matters so much,” he said.
Social media fuels scam ecosystem
TRM Labs Head of Deployment Strategy, APAC, Jonno Newman said financial fraud should be viewed as an ecosystem rather than simply a problem involving cryptocurrency.
He said many scams, including romance and investment scams, begin on social media and messaging platforms, with cryptocurrency often used only at the final stage to move funds.
“Social media is the main vector for identifying potential victims in the first place,” Newman said.
He said information shared publicly, including a person’s relationship status, age and general demographic profile, could help scammers identify and target potential victims.
“Dating sites play their part too. This really is a whole-ecosystem problem, and industries need to come together to help disrupt it,” he said.
AI cuts both ways
ACCA Global Head of Risk Management and Corporate Governance for Policy & Insights Rachael Johnson said AI was making scams increasingly convincing, with fraudsters able to generate highly personalised messages, realistic websites and sophisticated impersonations.
She said the same technology could also strengthen fraud detection and prevention if deployed effectively by organisations.
“AI is changing both sides of the fraud landscape. While it enables fraudsters to create more sophisticated and convincing scams, it also offers organisations powerful tools to strengthen fraud detection and prevention,” she said.
Johnson said organisations needed to continuously strengthen their fraud risk management capabilities as Sarawak advanced its digital economy.
“Preparedness is not a one-time achievement — it requires ongoing investment in technology, strong governance, skilled professionals and regular fraud risk assessments,” she said.
She added that AI-generated scams, including deepfake voices, fake identities and highly personalised phishing attempts, were becoming increasingly difficult to identify.
Ultimately, she said, resilience against AI-driven fraud would depend on combining technology with human judgement, collaboration and ethical leadership.
AI detects patterns beyond individual accounts
Liu said AI and data analytics could be particularly effective in identifying organised fraud because conventional systems often assess accounts and transactions individually.
“Organised fraud is built to look normal one account at a time. Each mule account, viewed alone, is just someone receiving a transfer.
“What betrays the syndicate is what the accounts share,” he said.
These could include the same device or phone number being linked to multiple accounts, funds flowing in from numerous victims before being transferred through common cash-out points, or clusters of accounts displaying similar activity.
Liu said graph intelligence used in TrustDecision’s banking deployments had typically increased the detection of mule and organised-crime networks by three to five times compared with account-level controls.
He said false alerts could also decline because decisions were corroborated across a wider network rather than triggered by a single threshold.
“Mule accounts are the chokepoint of the whole scam economy. Every ringgit stolen in one of these scams has to pass through one,” he said.
He said dormant accounts suddenly becoming active, multiple accounts being opened or reactivated around the same time, repeated contact details and small test transfers could all provide early indicators of a developing mule network.
“Seen together across a graph of accounts, devices and fund flows, they show you a mule network being assembled, and a bank can restrict or investigate those accounts before a single victim’s money ever arrives,” he said.
Liu said this was particularly relevant in Sarawak, where authorities had charged growing numbers of mule account holders, including young people recruited with promises of easy money for allowing their accounts to be used.
He said detecting such networks early could protect both potential victims and individuals being recruited as mules.
The race against instant payments
Liu said the rapid growth of digital payments had created another major challenge for banks.
He noted that PayNet processed 8.44 billion digital payment transactions in 2025, while DuitNow QR transactions alone more than doubled to around three billion.
With instant payments, he said, financial institutions had only milliseconds to determine whether a transaction was legitimate.
“Once a DuitNow transfer is authorised, settlement is immediate, and the money can be split across a chain of mule accounts within minutes, well before any end-of-day review would catch it,” he said.
While the National Fraud Portal had made post-event tracing faster, Liu said tracing was primarily a recovery mechanism rather than prevention.
“The risk decision has to happen at the point of authorisation, in milliseconds, on every transaction, and it has to be right in both directions,” he said.
Banks, he added, faced a delicate balance between stopping fraudulent transactions and avoiding unnecessary disruption to legitimate customers.
Awareness does not always mean safe behaviour
Meanwhile, CelcomDigi Berhad Head of Sustainability Philip Ling said high public awareness of scams did not necessarily translate into safer digital behaviour.
Citing findings from the National Scam Awareness Survey 2024, alongside insights from the company’s S.A.F.E. Internet initiative, he said Malaysians remained susceptible to scams despite being familiar with common tactics.
“While most Malaysians are familiar with common scam tactics, their awareness does not always translate into safe digital behaviours or preventive actions when confronted with sophisticated scams.
“This presents an opportunity for the public and private sectors to work together to strengthen long-term digital resilience,” he said.
As digital transactions continue to accelerate and AI gives scammers new tools to exploit trust, experts say financial institutions will need to move beyond conventional fraud controls towards real-time detection, cross-sector intelligence sharing and more sophisticated network analysis.
The third instalment of this series will explore how AI is changing the way financial institutions approach fraud prevention, as well as practical measures and policies to strengthen protection against scams.
