This article discusses the evolution of fraud prevention techniques. Fraud-prevention systems have to balance several competing demands: catching fraudulent activity without blocking legitimate customers, adapting quickly to new attack patterns, processing decisions efficiently and keeping those decisions explainable.
It covers the period from the 1970s to the present, when companies moved from rules-based approaches to relying on ML and then eventually adopted hybrid approaches. We’ll look into the main driving forces that caused each shift, the problems each new approach tried to solve and who was first to make the move.
Rules-Based Era
In 1973, Visa launched VisaNet that brought computerised authorisation, clearing and settlement to card transactions (Dee Hock — In memoriam). The system relied on static rules to prevent fraudulent transactions.
Most of rules-based systems were concerned with card-present fraud. They relied on velocity checks, geo anomalies and BIN blocklists.
Rules shined when it came to explainability: they were easy to understand and audit. They were perfect to work with regulators.
Rules-based approach worked well in 90s and 2000s. But fraudsters were constantly adapting their tactics to overcome new security measures. Static rules, meanwhile, were too rigid to catch new fraud schemes. The rules couldn’t automatically find and update them to reflect increasingly complex attacks caused another problem.
Another hurdle was to constantly update various thresholds to maintain acceptable rates of false positives. They weren’t as big of a problem back then, but something worth considering nevertheless.
In order to catch up with fraud schemes, rule sets had become extremely complex and hard to maintain. In its Rules based vs machine learning in fraud prevention report, PayPal says that a rule-based system may work for small companies but it’s becoming too unwieldy when it grows beyond a certain point.
To deal with the evolving fraud tactics and get around the limitations of static rules, companies turned to Machine Learning techniques.
Move to Machine Learning
Visa deployed a neural network-based AI for transaction scoring in 1993 (Visa Prevents Approximately $25 Billion in Fraud Using Artificial Intelligence). It was only a reference indicator for its clients at that time. But it wasn’t until 2010s that machine learning models got wide adoption.
By that time, companies had accumulated high volumes of labelled data. Significant advances in neural architectures and gradient-boosted tree algorithms allowed companies to use that data to deploy machine learning systems in their pipelines. They supplemented the old rules-based algorithms and increasingly handled tasks that static rules struggled with.
Mastercard launched its Decision Intelligence platform in 2016. It analyses each transaction and checks it against the cardholder’s past behaviour. Apart from solving the problem of high maintenance cost of the static rules approach, the new platform allowed Mastercard and issuers to reduce false positives.
PayPal aimed at significant fraud reduction by adopting machine learning (Doing Big Things with Big Data at PayPal). They built an ensemble of deep learning and gradient boosting models. The system checked multiple parameters to score transactions: device fingerprint, account-level risk, transaction graph.
The company later reported a transaction loss rate of just 0.08% of its total payment volume, including losses from fraud (PayPal 2025 Form 10-K).
False Positive Crisis
Every fraud-prevention system has to balance two costly kinds of error: letting fraudulent transactions through and blocking legitimate ones. Most companies naturally aimed at catching as many fraudulent transactions as possible. In other words, they minimized false negatives to protect themselves from direct financial losses, operational costs and reputational damage caused by fraud.
But stricter controls naturally led to a higher number of false positives, which companies often ignored or considered acceptable. Research by Aite Group showed how expensive that trade-off could become. It projected that losses from false declines would reach $443 billion in 2021, exceeding the losses caused by fraud itself (Financial Institutions Ease Cardholder Frustration by Addressing Transaction False Declines with New Fiserv Technology).
More recent Aite-Novarica research put the average false-decline rate for US e-commerce merchants at 1.16%. With more than $960 billion in US online sales in 2021, that translated into over $11 billion in lost legitimate sales (New Experian Link).
But banks suffered from more than just financial losses. High rate of legitimate transactions being turned down caused customers to feel upset and angry. They might leave the offending companies and turn to their competitors, which led to higher churn. Or they went to complain to regulators, who asked the companies to prove that their decisions weren’t discriminatory. Either way, high false positive rate caused significant reputational damage as well as high fraud rate.
Some companies had started to work on keeping the false positive rate low long before the report was published. Mastercard’s Decision Intelligence, introduced earlier, was one example: the company reported that it cut false positives in half. With around 75 billion transactions a year, this reduction was reported to save hundreds of millions of US dollars.
Stripe also launched its Radar Engine in 2016 (A primer on machine learning for fraud detection). They took another approach and concentrated on the merchant. Stripe calculates an acceptable level of risk for each merchant and score transactions based on that level.
For example, a B2B or enterprise software company could tolerate some losses from individual transactions to keep its reputation for high-figure contracts. In Radar 2.0 testing in 2018, Stripe said the upgraded ML models reduced fraud by more than 25% compared with the previous models without increasing the false-positive rate.
The Explainability Problem
When large amounts of legitimate transactions were turned down and the affected people complained to regulators, they had to demand greater transparency and fairness in automated decision-making. The EU introduced GDPR in 2018 which strengthened requirements around automated decisions. In the UK, the Consumer Duty introduced in 2023 added further pressure on financial firms to demonstrate that their systems produced fair outcomes for customers.
Financial institutions were now required to explain their decisions when they turned down transactions. But it was very difficult, if possible at all, to do when the decisions were made by an ML model.
HSBC tackled this problem when it developed its Dynamic Risk Assessment platform in collaboration with Google Cloud (Harnessing the power of AI to fight financial crime). They introduced SHAP values to explain machine learning predictions by measuring how much each feature contributes to a final output, using rules from cooperative game theory. HSBC put this system into production in 2021. Two years later, Google Cloud made it available for other businesses through their Anti-Money Laundering AI.
Advances in Fraud Techniques
While companies moved to more sophisticated measures to prevent fraud, fraudsters improved their methods as well. Rapid development of generative AI allowed them to launch new kinds of attacks at scale.
One of such attacks is Authorised Push Payment (APP) fraud. Fraudsters manipulate victims into authorising the payments themselves. While it had been possible to use this techniques before, advances in generative AI allowed them to automatically generate highly personalized messages.
APP fraud is the most rapidly expanding form of fraud now. UK Finance report says that this type of fraud caused losses of £460 million in the UK in 2023. The most challenging part of dealing with it is that each transaction seems completely legitimate. The victim initiates the transfer, approves it on their device, nothing suspicious. How can the financial company spot a problem?
Revolut approached this problem by adding a specialized layer to their fraud-detection system (Revolut launches AI feature to protect customers from card scams). They rolled out the system in 2024.
Revolut reported a 30% reduction in losses from investment-related card scams after introducing the feature. Separately, in October 2023 they reported a 35% reduction in APP fraud since June 2023, and its broader proprietary fraud system prevented more than £475 million of fraud in 2023 (Revolut doubles Financial Crime Headcount to Combat Rising Industry Fraud).
Evolution of Anti-Fraud Approaches Into Hybrid Systems
Companies naturally wanted to use a single system for fraud detection, whether it was a rules-based or an ML-based one. It’s easier to maintain and to explain to management and stakeholders. But evolution of fraud threat and increasing regulatory requirements pushed teams to adopt hybrid systems.
Just like Revolut added a specialized layer to target one specific form of fraud, other companies’ systems evolved to multi-layered architectures.
In addition to layers specific to some threats, many companies integrated rules-based layers for zero-tolerance matters, such as compliance with sanctions. They replaced resource-intensive ML-models with lightweight encoders for high-volume classification work. Some companies added graph analysis stages to spot fake identities and other fraud enabled by generative AI.
Eastwind, a data analytics provider for mobile operators, implemented a hybrid approach in its SMS-firewall solution deployed in 2025. This solution targets another form of fraud. Mobile operators offer special plans for companies who need to send OTP-codes to their clients. The operators don’t allow their clients to use personal numbers to send the codes.
The primary concern is that this could train users to accept OTP messages from ordinary personal numbers, making them easier targets for fraudsters impersonating legitimate companies. Nevertheless some companies buy large numbers of personal SIMs and use them to send OTP codes more cheaply.
Eastwind’s firewall solution check for OTP codes in SMS messages sent from personal numbers. Many clients operate in emerging markets and can’t afford extensive infrastructure to run an anti-fraud system built with ML-models in real time. But fraudsters keep on coming up with new ways of masking their OTP codes which requires an AI to catch these new trends.
The hybrid approach allowed EastWind to solve the problem of evolving fraud schemes while operating within available resources. Real-time processing is performed by the rules-based layer. Some messages are filtered as suspicious and sent to an asynchronous ML-layer for additional checks.
The results of these checks are inspected by a trained professional who may find new trends and update the rules. This human-in-the-loop approach keeps resource requirements low while helping analysts identify new fraud patterns, update the rules and keep decisions transparent and explainable. (Eastwind — EW SMS Firewall success story in Burundi).
Behavioral Analytics
Hybrid architectures can also incorporate additional sources of evidence when transaction-level signals are not enough. One increasingly important example is behavioral analytics, which examines how users interact with their devices and can complement rules, ML models and human review in fraud-prevention systems.
This method has been in development since 2011 when BioCatch, the leading provider of solutions for behavioral analysis, was founded (About BioCatch). Their platform was first adopted by Nuance Security Suite in 2017 (Nuance Teams with BioCatch to Expand Fraud Detection Across Digital Customer Care Channels). It is in use at some 30 of the world’s leading banks.
The strength of the method is that it analyzes the way the user uses their device. Unlike most traditional approaches that work at the level of transaction, this method reads signals that are hard to reproduce or even read by fraudsters.
BioCatch logs over 3,000 cognitive behavioral markers to build a detailed profile for each user. Among many factors, they look at key stroke dynamics, how hard the user swipes, where and how they move their mouse.
The approach has proved effective in practice. In one case, a large Latin American bank added BioCatch as another layer on top of its existing transaction-monitoring system. The bank increased its fraud-detection rate to more than 90% while cutting false positives by roughly two-thirds (Top LATAM Bank Drastically Increases Fraud Prevention & Reduces False Positives by 66% with Behavioral Intelligence).
Conclusion
Fraud prevention has evolved in response to changing threats and changing limitations. Rules-based systems offered transparency and control, but became increasingly difficult to maintain as fraud schemes grew more complex. Machine learning helped companies analyse larger amounts of data and detect patterns that static rules struggled to capture, while introducing new problems around false positives and explainability.
This pushed companies towards hybrid architectures. Rules remained useful for clear-cut decisions, ML models handled more complex scoring, and specialised layers were added for particular threats, behavioral analysis and human review. The examples from Revolut, EastWind and BioCatch show how different techniques can work together inside the same system.
Fraudsters continue to adapt as well. Generative AI has already made some attacks easier to scale and personalise, so fraud-prevention systems will have to keep evolving. The central lesson is that there is no single final solution. Effective systems depend on combining the right tools for the particular threats, constraints and decisions they have to handle.
(Top, featured image via Tara Winstead on Pexel)
