AI fraud detection for payment and e-money institutions: a 2026 playbook

The European Banking Authority and the European Central Bank published their latest joint report on payment fraud in December 2025, covering 2024 data. Total fraud rose, and its shape changed: fraud is moving from unauthorized transactions towards scams in which the customer is manipulated into making the payment themselves.

For payment and e-money institutions in Cyprus, many of which passport services across the EEA, the cross-border pattern matters: fraud concentrates where customers and counterparties are most diverse.

A rules-based system flags a transaction when it crosses a fixed threshold — an amount, a country, a velocity limit. A threshold tight enough to catch fraud also flags many legitimate payments; one loose enough to spare good customers lets fraud through. Every false positive costs analyst time and customer goodwill, and every new rule added to plug a gap adds more of them.

Rules also cannot see context. A €2,000 transfer is routine for one customer and alarming for another. A new beneficiary is unremarkable — unless five other new customers paid the same account this week.

Machine learning fraud detection estimates how likely each transaction is to be fraudulent by learning from confirmed cases and from each customer's normal behavior. Production systems usually combine three layers:

The scores feed a decision layer — approve, step-up authentication, hold, or send to an analyst — and every analyst decision flows back as a new label, so the system keeps learning as fraud patterns shift.

A graph represents customers, accounts, devices, beneficiaries and merchants as nodes, and the payments and shared attributes between them as edges. Organized fraud that looks innocent one transaction at a time becomes visible as structure: many new accounts paying one beneficiary, devices shared across unrelated customers, funds moving through short chains of accounts before cashing out.

Graph features — how many unrelated customers share a device, how close an account sits to known fraud, which communities form around a beneficiary — feed directly into the supervised model. That is how a graph approach cuts false positives and raises detection at the same time.

Fraud models are only as good as their features and labels. The strongest feature families are:

• Behavioral — amount, time and frequency compared with the customer's own history.
• Velocity — transactions per minute, hour and day, per customer, card, device and beneficiary.
• Device and session — new device, emulator or remote-access signals, login-to-payment time.
• Beneficiary — account age, first payment to this beneficiary, how many customers paid it recently.
• Network — graph features linking accounts, devices and counterparties.

Labels come from chargebacks, confirmed fraud reports, scam claims and analyst decisions. Many arrive weeks after the transaction, so training and evaluation must account for label delay, and models should be tested on recent, out-of-time data rather than a random sample.

Accuracy alone is meaningless when fraud is a tiny fraction of transactions. Measure what the business feels:

Under Annex III of the EU AI Act, AI used to assess the creditworthiness of individuals is high-risk, "with the exception of AI systems used for the purpose of detecting financial fraud." Fraud models therefore sit outside that high-risk category — read our EU AI Act guide for Cyprus fintechs for the full picture.

Other rules still apply. Recital 47 of GDPR recognizes that processing personal data strictly necessary for preventing fraud is a legitimate interest, but data minimization, transparency and security obligations remain. Under DORA, an external fraud-analytics vendor is an ICT third-party provider. And analysts, auditors and customers will ask why a payment was stopped, so every score should come with reason codes.

1. 01Weeks 1–3: baseline. Audit transaction, device and label data, and measure the precision and recall of the current rules — the benchmark to beat.
2. 02Weeks 4–8: first model. Engineer behavioral, velocity and network features; train and backtest on out-of-time data; review errors with fraud analysts.
3. 03Weeks 9–12: shadow and switch-on. Score live traffic in shadow mode, calibrate thresholds to analyst capacity, then run champion–challenger against existing rules with monitoring in place.

Keap Technologies builds fraud detection and AML models for payment and e-money institutions, brokers and fintechs in Cyprus, across the EU and in the US. Start a conversation.