The payment is often the final step, not the first warning
When a customer sends money to a fraudster, the transaction may appear voluntary.
The customer authenticated the payment. They selected the beneficiary. They confirmed the amount. They may even insist that the transfer is urgent and legitimate.
Yet the decision was not necessarily made freely.
In many scams, the victim has been manipulated over hours, days or months. The fraudster may have created urgency, fear, trust, secrecy or the promise of financial reward. By the time the payment reaches the bank, the customer may already be deeply committed to the false story.
This creates a fundamental challenge for fraud prevention.
If controls begin only when the customer presses “send,” the organisation may be intervening too late.
Effective scam prevention must consider the decision journey before the payment, not just the transaction itself.
How fraudsters influence customer decisions
Scam activity often relies less on technical sophistication than on psychological control.
Fraudsters construct narratives designed to make unusual behaviour feel necessary.
A customer may be told that:
- Their bank account is under attack
- Their money must be moved to a “safe account”
- A family member needs urgent financial help
- An investment opportunity is available for a limited time
- A payment is required to release winnings or funds
- A government agency or law-enforcement body is investigating them
- A romantic partner needs help with an emergency
- A supplier has changed its bank details
- They must keep the situation confidential
The details differ, but the techniques are often consistent.
Fraudsters use urgency to reduce reflection. They use authority to discourage challenge. They use secrecy to isolate the victim. They use small initial commitments to build confidence before requesting larger payments.
These tactics can change how a customer behaves across multiple channels.
That behaviour may create detectable signals before the loss occurs.
The limits of transaction-only controls
Traditional payment controls often evaluate factors such as:
- Transaction amount
- Beneficiary age
- Payment velocity
- Device risk
- Geographic location
- Previous customer activity
- Known beneficiary risk
These signals remain essential, but they may not fully capture scam risk.
A payment can look technically valid while still being the result of manipulation.
For example, the customer may be using their normal device from their usual location. They may successfully complete strong authentication. Their account may have sufficient funds. The beneficiary may not yet be linked to confirmed fraud.
From a conventional transaction-risk perspective, the payment may appear legitimate.
From a behavioural perspective, however, the customer may be acting very differently.
They may have logged in repeatedly, increased a payment limit, added a new beneficiary, spoken to customer service and attempted several transfers in a short period.
The transaction becomes more meaningful when viewed as part of that wider sequence.
Scam risk develops across a journey
A scam event can often be understood as a series of stages.
1. Initial contact
The fraudster reaches the customer through a telephone call, text message, email, social-media platform, dating application or online advertisement.
At this stage, the victim may not interact with their financial provider at all.
2. Trust or pressure is established
The fraudster develops a relationship or creates urgency.
They may impersonate a trusted organisation, demonstrate knowledge of the victim or provide small apparent returns from an investment.
3. The customer prepares to pay
The customer may log in more frequently, check balances, liquidate savings, increase payment limits or add a new beneficiary.
This stage can create the earliest visible signals for the financial institution.
4. The payment is attempted
The customer initiates one or more transfers.
They may ignore warnings because the fraudster has already explained why the bank might intervene.
5. Funds are moved or dispersed
The receiving account may rapidly transfer, withdraw or convert the funds.
At this point, recovery becomes significantly more difficult.
The strongest intervention opportunity may therefore exist before or during stage three, rather than at the end of stage four.
Behavioural signals before a scam payment
No single behaviour proves that a customer is being manipulated.
However, combinations of unusual events can indicate elevated risk.
Changes to payment capability
A customer may:
- Increase their daily payment limit
- Add several new beneficiaries
- Activate a new payment channel
- Move money from savings to a current account
- Request early release of a fixed-term product
- Sell investments before making a transfer
These actions may be entirely legitimate. Their importance depends on timing, customer history and the payment that follows.
Repeated or interrupted payment attempts
Fraudsters may instruct victims to retry transactions that are declined or delayed.
Relevant indicators include:
- Multiple failed transfers
- Repeated changes to payment values
- Payments split into smaller amounts
- Attempts through different channels
- A new beneficiary followed by immediate high-value transfers
- Continued activity after a warning or customer-service contact
This persistence can suggest that the customer is being coached.
Unusual digital behaviour
The customer may show changes in:
- Login frequency
- Session duration
- Navigation patterns
- Device use
- Time of activity
- Copy-and-paste behaviour
- Movement between account and payment screens
These indicators must be handled carefully and transparently, but they can add useful context to payment risk.
Customer-service interactions
Contact-centre data can reveal important warning signs.
A customer may ask how to increase limits, release funds or complete a blocked payment. They may appear unusually anxious, defensive or rehearsed. They may repeat language provided by the fraudster.
Staff may also hear another person coaching the customer during a call.
These signals are most useful when they can inform the payment decision quickly.
Why generic warnings often fail
Many payment journeys rely on standard warnings such as:
- “Are you sure you know this person?”
- “Your bank will never ask you to move money.”
- “This payment may be a scam.”
These messages can help, but fraudsters routinely prepare victims to ignore them.
The customer may have been told that the warning is automatic, that bank staff are involved in the fraud or that disclosing the true reason for the payment will prevent it from being processed.
As a result, a generic message shown at the final confirmation screen may have limited impact.
Effective warnings should be:
- Relevant to the payment type
- Specific to the customer’s actions
- Delivered at the right moment
- Written in plain language
- Designed to interrupt urgency
- Supported by a clear path to help
A customer paying a supposed investment provider should receive different guidance from someone sending money to a new romantic partner or responding to an impersonation call.
Context improves the chance that the warning will challenge the fraudster’s narrative.
The importance of meaningful friction
Fraud teams often seek to reduce customer friction.
That is generally appropriate, but not all friction is harmful.
In high-risk situations, carefully designed friction can create time for reflection and investigation.
Examples include:
- A cooling-off period for certain high-risk payments
- Additional questions about the payment purpose
- Independent verification of a new beneficiary
- A specialist scam-risk conversation
- Delayed limit increases
- A temporary hold while risk is reviewed
- Requiring the customer to end an active telephone call before proceeding
The purpose of friction should not be to frustrate legitimate customers.
It should be to disrupt the fraudster’s control.
A short delay can be highly effective when the scam depends on urgency and continuous coaching.
Asking better questions
Customer questioning is a critical part of scam intervention.
Poor questions can be answered with a simple “yes” or “no,” especially when the victim has been coached.
For example:
“Do you know the person you are paying?”
A romance-scam victim may answer yes. An investment victim may believe they know the company. A safe-account scam victim may think they are following instructions from their bank.
More effective questions explore the situation without assuming the answer.
Examples include:
- How did you first come into contact with the recipient?
- What are you expecting to receive in return?
- Has anyone asked you to keep this payment secret?
- Has anyone told you what to say if your bank asks questions?
- Are you currently speaking with someone who is guiding you?
- Have you independently verified the request using trusted contact details?
- Why does the payment need to be made today?
The objective is not simply to collect information.
It is to create a moment in which the customer can reconsider the story they have been given.
Connecting fraud intelligence across channels
A customer’s scam journey may involve several parts of an organisation.
The mobile application may see a new beneficiary. The contact centre may receive a limit-increase request. The branch may process a savings withdrawal. The fraud platform may detect an unusual payment.
If these events remain separate, each may appear low risk.
When connected, they may reveal a clear escalation pattern.
A more effective approach combines signals from:
- Digital banking
- Branch activity
- Contact-centre interactions
- Payment systems
- Beneficiary intelligence
- Device and authentication data
- Customer complaints
- Confirmed scam cases
This allows risk to be assessed across the entire journey.
It also helps ensure that information disclosed to one team is available when another team must make a decision.
Beneficiary risk remains essential
Customer behaviour is only one side of the problem.
The receiving account may provide equally important evidence.
A beneficiary may be:
- Newly opened
- Receiving funds from several unrelated customers
- Linked to previous scam reports
- Rapidly dispersing incoming payments
- Connected to known mule accounts
- Sharing devices or contact details with other suspicious entities
The strongest scam detection often combines sending-customer vulnerability with receiving-account risk.
A payment from a customer showing unusual behaviour to a beneficiary linked to multiple disputes should be treated differently from either signal in isolation.
This is where collaboration between sending and receiving institutions becomes particularly valuable.
Supporting the customer after intervention
Stopping the payment is not the end of the process.
A customer who has been manipulated may remain convinced that the payment is genuine. They may attempt the transfer elsewhere, use another account or return after speaking again with the fraudster.
Post-intervention support can include:
- A specialist follow-up conversation
- Clear explanation of the scam indicators
- Guidance on securing accounts and devices
- Review of recent payments
- Referral to appropriate support services
- Monitoring for repeated attempts
- Documentation of the fraudster’s contact methods
- Advice on reporting the incident
The tone of the interaction matters.
Victims may feel embarrassed, frightened or defensive. Blame can reduce cooperation and make future losses more likely.
A calm, evidence-based approach is more effective.
Measuring prevention, not just detection
A mature scam-prevention programme should measure more than declined payments.
Relevant outcomes include:
- Scam losses prevented
- Customer abandonment after targeted warnings
- Value recovered
- Repeat payment attempts
- Time between first risk signal and intervention
- False-positive rates
- Customer complaints
- Beneficiaries identified through confirmed cases
- Effectiveness of different warning messages
- Performance of branch, digital and contact-centre interventions
Organisations should also review successful scam payments.
Each case can reveal which earlier signals were available, which teams held relevant information and where intervention failed.
This creates a continuous feedback loop.
Move the control point earlier
Scam prevention is often treated as a payment-screen problem.
In reality, the customer’s decision may have been shaped long before the payment was initiated.
The strongest controls recognise that scams are behavioural journeys. They identify changes in customer activity, connect events across channels, assess beneficiary risk and intervene at the moment when the fraudster’s influence can still be disrupted.
The critical question is not only:
“Does this payment look suspicious?”
It is also:
“What happened before the customer decided to make it?”
That earlier context may provide the best opportunity to prevent the loss.