The financial fraud landscape

Financial fraud costs European companies between 1% and 5% of their annual revenue, according to the Association of Certified Fraud Examiners (ACFE). The scale of the problem far exceeds manual detection capabilities.

Traditional fraud detection systems operate with fixed rules: "alert if a transfer exceeds 10,000 EUR," "alert if there are 3 transactions in 3 different countries within 24 hours." These rules are necessary but insufficient. Fraudsters know them and evade them. They structure operations just below the thresholds (smurfing), use intermediaries, and exploit the blind spots of rule-based systems.

AI changes the paradigm: instead of looking for predefined patterns, it learns what normal behavior looks like and detects deviations. It does not look for what you expect to find; it looks for what you do not expect.

Types of financial fraud

• External fraud: identity theft, card fraud, phishing, fake invoices from non-existent suppliers.
• Internal fraud: embezzlement, fictitious expenses, bribes, undisclosed conflicts of interest, accounting manipulation.
• Money laundering: placement, layering, and integration of illicit funds.
• Tax fraud: VAT evasion (carousel fraud, fake invoices), income concealment, abusive transfer pricing.
• Cyber fraud: BEC (Business Email Compromise), ransomware with financial extortion, payment system manipulation.

Fraud pattern detection with AI

AI for fraud detection fundamentally uses two approaches: supervised and unsupervised learning.

Supervised learning

The system learns from historical examples of confirmed fraud. It is trained with transactions labeled as "fraudulent" or "legitimate" and learns to distinguish them. Very effective for known, recurring fraud types.

Common techniques:

• Random Forest and Gradient Boosting: the most used algorithms in production for their balance between accuracy and explainability.
• Neural networks: for more complex patterns, especially in card fraud detection where there are millions of transactions.
• Sequence models: analyze the temporal sequence of transactions, not each transaction in isolation. A 500 EUR payment is normal; 50 payments of 500 EUR in 48 hours is not.

Unsupervised learning

Does not need prior examples of fraud. Learns what is "normal" and alerts when something deviates. Crucial because it detects new types of fraud never seen before.

• Clustering: groups customers or transactions by similarity. Outliers (points that do not belong to any cluster) are suspicious.
• Isolation Forest: identifies anomalies by isolating observations. Anomalies are easier to isolate than normal points.
• Autoencoders: neural networks that learn to compress and reconstruct normal data. When they cannot accurately reconstruct a transaction, it is anomalous.

Transaction anomaly detection

Anomaly detection is the most direct application of AI in financial security. Every customer, every supplier, every account has a behavioral pattern. When something deviates from that pattern, it needs investigation.

Behavioral profiling

AI builds a dynamic profile for each entity based on:

• Usual volume: how much this customer normally moves per day, week, month.
• Temporal patterns: when they operate (hours, days of the week, seasonality).
• Usual counterparties: who they normally transact with (suppliers, customers, banks).
• Geography: where they operate from, where their counterparties are located.
• Transaction types: wire transfers, cash, cards, checks.

A significant deviation from any of these parameters generates an alert. Not a binary alert (fraud/not fraud), but a risk score indicating the degree of anomaly.

Network anomalies (network analysis)

Beyond individual transactions, AI can analyze relationship networks. Two companies sharing the same director, the same registered address, and the same suppliers could be a circular invoicing scheme. A customer receiving funds from a recently created company in a high-risk country and immediately transferring them to another jurisdiction has a typical money laundering pattern.

Graph analytics identifies these complex structures that go undetected in traditional transactional analysis.

Real-time transaction monitoring

Modern fraud detection systems operate in real time: each transaction is evaluated before being processed. The challenge is doing it in milliseconds to not affect the user experience.

Monitoring system architecture

1. Ingestion: transactions enter the system in real time (streaming).
2. Enrichment: contextual data is added (customer profile, history, blacklists, geolocation data).
3. Scoring: the AI model assigns a risk score between 0 and 100.
4. Decision: based on the score, the transaction is automatically approved (<30), sent for manual review (30-70), or blocked (>70).
5. Feedback: human analysts' decisions feed back into the model to improve future predictions.

KYC and AML: compliance with AI

KYC (Know Your Customer) and AML (Anti-Money Laundering) are regulatory requirements that oblige financial institutions and certain obligated subjects to identify their customers, assess their risk, and monitor their operations.

Automated KYC

The AI-powered KYC process includes:

• Identity verification: ID/passport OCR, facial biometric verification, checking against official databases.
• Sanctions list screening: automatic search against sanctions lists (OFAC, EU, UN), PEPs (Politically Exposed Persons), adverse media (negative news).
• Risk assessment: automatic customer scoring based on profile, expected activity, country of origin, business sector.
• Enhanced due diligence: for high-risk customers, AI automatically collects additional information from public sources and generates a dossier.

AML with AI

The three phases of money laundering and how AI helps detect each:

• Placement: introducing cash into the financial system. AI detects structured cash deposits, use of cash-intensive businesses as fronts.
• Layering: moving money to obscure the trail. AI analyzes transfer chains, circular transactions, use of opaque jurisdictions.
• Integration: giving illicit funds an appearance of legitimacy. AI detects disproportionate real estate investments, luxury asset purchases, fictitious invoicing.

Anti-money laundering prevention

Anti-money laundering regulations establish obligations for obligated subjects. AI helps fulfill these obligations more efficiently and effectively.

Obligated subjects and AI

Not only banks are obligated. Laws typically include:

• Financial institutions (banks, insurers, fund managers).
• Professionals (lawyers, notaries, auditors, tax advisors).
• Real estate developers and property agents.
• Casinos and betting houses.
• Jewelers and luxury goods dealers.
• Foundations and associations.

For all these subjects, AI can automate: special examination of suspicious transactions, suspicious activity report (SAR) generation, and documentation retention for the legally required period.

False positive reduction

The biggest problem with fraud and AML detection systems is not the frauds they miss: it is the false positives. A typical bank generates between 10,000 and 50,000 alerts per month, of which 95% or more are false positives. Each alert must be manually investigated by an analyst, at a cost of 15 to 50 EUR per alert.

Why there are so many false positives

• Overly broad rules: "alert if the transaction exceeds 10,000 EUR." There are thousands of legitimate transactions above that threshold.
• Lack of context: a 50,000 EUR transfer is suspicious for a student but normal for a construction company.
• Name screening: name-matching algorithms generate massive false positives (a common name appearing on a sanctions list triggers alerts for everyone with that name).
• Regulatory fear: institutions prefer to over-alert than under-alert, because regulators penalize for failing to detect, not for overwhelming analysts.

How AI reduces false positives

• Contextual scoring: instead of binary rules, AI assigns a score that accounts for the customer's profile, history, and transaction context.
• Prioritization: alerts are ranked by risk score. Analysts investigate the highest risk first, not the most recent.
• Auto-closure of low-risk alerts: alerts below a threshold score are automatically closed with documented justification, freeing analysts for real cases.
• Learning from analyst decisions: when an analyst dismisses an alert as a false positive, the model learns not to repeat the same alert in the future.

The best implementations report 50-70% reductions in false positives, translating to millions in investigation cost savings and analysts who can focus on cases that truly matter.

Internal fraud detection

Internal fraud is the hardest to detect because the fraudster knows the controls and has legitimate system access. The ACFE estimates internal fraud represents 5% of the victim company's revenue, with a median duration of 12 months before discovery.

Signals AI can detect

• Segregation of duties: an employee who creates suppliers and approves payments to the same supplier.
• Ghost suppliers: suppliers that only receive payments from a specific employee, with addresses matching employee addresses.
• Anomalous credit notes: returns or credits that do not correspond to prior sales.
• After-hours access: an accounting employee accessing the payment system at 2 AM.
• Inconsistent lifestyle: an employee with a 30,000 EUR salary who declares 15,000 EUR in annual entertainment expenses.

Forensic analysis with AI

When there are suspicions of internal fraud, AI can perform forensic analysis of the suspect's transactions: search for splitting patterns (dividing transactions to avoid approval controls), analyze relationships with suppliers and customers, and reconstruct the chronology of suspicious operations.

Ejercicio practico

Puntos clave