The evolution of issuing fraud in fintech

Issuing fraud—fraud involving payment cards and digital payment methods—has evolved dramatically with the rise of fintech. This article explores how fraudsters have adapted to digital banking, the current threat landscape, and effective detection strategies.

What is Issuing Fraud?

Issuing fraud occurs when fraudsters use payment cards or digital payment methods that were issued to them (or obtained fraudulently) to make unauthorised transactions. This includes:

Card Not Present (CNP) Fraud: Online transactions without physical card
Card Present Fraud: Using stolen or cloned cards
Account Takeover: Gaining unauthorised access to payment accounts
Synthetic Identity Fraud: Using fabricated identities to obtain payment methods
Application Fraud: Obtaining cards through fraudulent applications

The Evolution: From Physical to Digital

Traditional Card Fraud (Pre-Fintech)

Characteristics:

Physical card theft or cloning
Skimming devices at ATMs and point-of-sale terminals
Mail interception
Limited to physical locations

Detection Methods:

Signature verification
PIN authentication
Geographic location checks
Spending pattern analysis

Early Digital Fraud (2000s-2010s)

New Techniques:

Online card-not-present transactions
Phishing for card details
Data breaches exposing card numbers
Cross-border online transactions

Challenges:

Reduced authentication friction online
Global reach of fraudsters
Difficulty verifying identity remotely
Rapid transaction execution

Modern Fintech Fraud (2010s-Present)

Sophisticated Techniques:

Account takeover through credential stuffing
Synthetic identity creation
Mobile payment fraud
Cryptocurrency integration
Real-time fraud at scale

Complexity:

Multiple payment channels
Instant transactions
Global reach
Automated fraud systems

Current Threat Landscape

1. Account Takeover (ATO)

How it works:

Fraudsters obtain credentials through:
- Data breaches
- Phishing attacks
- Credential stuffing
- Social engineering
Gain access to payment accounts
Make unauthorised transactions
Often combine with other fraud types

Detection Indicators:

Login from new device/location
Unusual transaction patterns
Rapid password changes
Multiple failed login attempts followed by success

Prevention Strategies:

Multi-factor authentication (MFA)
Device fingerprinting
Behavioural biometrics
Real-time monitoring

2. Synthetic Identity Fraud

Process:

Create identity using real and fake information
Build credit history gradually
Apply for payment cards
Use cards until credit limit reached
Abandon identity

Characteristics:

Long-term schemes (months to years)
Difficult to detect initially
Often involves money laundering
High financial impact

Detection:

Identity verification inconsistencies
Unusual credit building patterns
Data quality flags
Network analysis

3. Card Testing

What it is: Fraudsters test stolen card numbers with small transactions to verify validity.

Process:

Obtain card numbers (data breach, dark web)
Test with small transactions ($1-5)
Identify valid cards
Use for larger fraudulent transactions

Detection:

Multiple small transactions from same source
Rapid sequential transactions
High decline rates
Geographic clustering

4. Mobile Payment Fraud

Types:

Mobile Wallet Takeover: Unauthorised access to digital wallets
P2P Payment Fraud: Fraudulent peer-to-peer transfers
QR Code Fraud: Manipulated QR codes
App-based Fraud: Malicious apps stealing payment data

Challenges:

Mobile-specific attack vectors
Biometric spoofing
Device compromise
App security vulnerabilities

Detection Strategies

Transaction Monitoring

Key Metrics:

Transaction velocity (frequency and speed)
Amount patterns
Geographic patterns
Merchant category patterns
Time-based anomalies

Rules-Based Detection:

Transaction amount thresholds
Velocity limits
Geographic restrictions
Merchant category blocks
Time-of-day restrictions

ML-Based Detection:

Anomaly detection models
Behavioural analysis
Risk scoring
Pattern recognition

Behavioural Analysis

Indicators:

Unusual spending patterns
Changes in transaction behaviour
Device and location patterns
Time-based anomalies
Merchant preferences

Techniques:

Baseline establishment
Deviation detection
Trend analysis
Comparative analysis

Identity Verification

Methods:

Document verification
Biometric authentication
Knowledge-based authentication
Device fingerprinting
Behavioural biometrics

Challenges:

Balancing security and user experience
False positive management
Evolving fraud techniques
Regulatory compliance

Prevention Strategies

Multi-Layered Approach

Layer 1: Prevention

Strong identity verification
Secure authentication
Fraud education
Secure development practices

Layer 2: Detection

Real-time monitoring
ML-based detection
Rule-based systems
Behavioural analysis

Layer 3: Response

Transaction blocking
Account restrictions
Investigation workflows
Customer communication

Technology Solutions

Authentication:

Multi-factor authentication
Biometric verification
Device trust
Risk-based authentication

Monitoring:

Real-time transaction monitoring
ML-based fraud detection
Behavioural analytics
Network analysis

Data:

Identity verification services
Device intelligence
Threat intelligence
Shared fraud databases

Case Study: Detecting Synthetic Identity Fraud

Scenario

A fraudster creates a synthetic identity and gradually builds credit history over 12 months before applying for a payment card.

Detection Approach

Step 1: Identity Verification

Check for data inconsistencies
Verify against multiple data sources
Identify synthetic identity indicators

Step 2: Credit Building Analysis

Analyse credit building patterns
Compare to typical patterns
Identify unusual rapid credit building

Step 3: Application Analysis

Review application data quality
Check for identity inconsistencies
Analyse application patterns

Step 4: Network Analysis

Identify connections to other synthetic identities
Map identity creation networks
Detect coordinated fraud

Outcome

Detected synthetic identity before card issuance, preventing potential losses and identifying broader fraud network.

Regulatory Considerations

Compliance Requirements

PCI DSS: Payment card data security
GDPR: Data protection and privacy
PSD2: Strong customer authentication
AML/KYC: Identity verification requirements

Reporting

Suspicious activity reporting
Fraud statistics reporting
Regulatory notifications
Customer notifications

Best Practices

Continuous Monitoring: Real-time and batch analysis
Multi-layered Defence: Prevention, detection, and response
Data Quality: Accurate and complete data
Model Updates: Regular retraining and updates
Collaboration: Sharing intelligence across industry
Customer Education: Helping customers protect themselves

Future Trends

Emerging Threats

AI-Powered Fraud: Fraudsters using AI for attacks
Deepfakes: Synthetic media for identity fraud
Cryptocurrency Integration: Using crypto for fraud
Cross-Platform Attacks: Coordinated attacks across platforms

Evolving Defences

Advanced ML: More sophisticated detection models
Biometric Evolution: Enhanced biometric authentication
Blockchain: Immutable transaction records
Collaborative Defence: Industry-wide fraud sharing

Conclusion

Issuing fraud in fintech is constantly evolving. Fraudsters adapt quickly to new technologies and defences. Effective fraud management requires:

Deep understanding of fraud techniques
Continuous learning and adaptation
Data-driven detection approaches
Multi-layered prevention strategies
Collaboration across teams and industry

The key is to think like a fraudster while building systems that protect legitimate customers. This requires analytical thinking, technical skills, and a commitment to staying ahead of evolving threats.