Playbook

The Modern Fraud Prevention Playbook

8 Ways to Avoid Risk & Accelerate Growth

By Alex Faivusovich

Table of contents
Text Link

Introduction to Modern Fraud Prevention

‍

Whether you're:

‍

  • A seed-round start-up in a hyper-growth market
  • A veteran company in your field
  • A neobank looking to revolutionize the space
  • A traditional credit union looking to revamp, or
  • A crypto exchange exploring new revenue vectors

‍

Expanding to new products, offers, and features is a critical part of your growth strategy.

‍

Typically, new offerings unlock access to more revenue, enhance the customer experience, and bring new opportunities for your business. But, they also hold a fair amount of fraud risk within them.

‍

This Modern Fraud Prevention Playbook will help you understand the rewards and risks associated with several product expansion scenarios to help you create a balanced pre-launch approach.

‍

Let's get started.

‍

‍

Scenario: Automated Clearing House (ACH)

‍

The Automated Clearing House (ACH) Network is a well-known money transfer method used by organizations to handle checks, direct deposits, cash transfers, and bill payments between businesses and individuals.

‍

Rewards

The ACH Network processed over $73 trillion in payment value in 2021.

It’s being regulated by Nacha and is considered to be the most popular payment rails worldwide.

It unlocks opportunities in terms of accepting and sending payments (debit and credit) from financial institutions and brokerage firms, sending and accepting payroll payments (employee wages), and bill payments.

Adding ACH payment as part of your offering can bring more “traditional” users to your platform, app, or exchange. And, with the current state and variety of integration platforms, you can expect no heavy lifting from an engineering perspective.

Generate revenue from fees on outbound transactions.

Risks

ACH is a “batch” processing system and most transactions clear within 3–5 business days.

In recent years, direct payments (requests to pull funds from an account) became popular among bad actors because they could take advantage of clearing days and abuse internal disputes policies.

Bad actors are pulling funds from accounts with insufficient balances, blocked/frozen accounts, or simply use their own 3rd party accounts and dispute the transaction several days after original initiation.

Those acts result in what are called “ACH Returns,” which have associated fees and may result in legal action taken by NACHA if certain return thresholds are exceeded.

Direct deposits are another potential risk factor to consider. In those cases, bad actors will push the payment to your accounts and the intended payee name on the deposit will usually don’t match the name of your account holder.

‍

Play

‍

The key to success is to establish a good product fit for your customer base, and understand the true needs of your customers and how they're expected to use this feature.

‍

For new account funding, it is vital to take the following actions:

‍

  • Verify 3rd party account ownership.
  • Have a clear idea who is the owner of the account the funds are being pulled from and how they're related to your account holder.
  • Adding ACH payment as part of your offering can bring more "traditional" users to your platform, app, or exchange. And, with the current state and variety of integration platforms, you can expect no heavy lifting from an engineering perspective.
  • Develop strong internal policies around who will get access to ACH payments.

‍

It is also pertinent to have documentation around what actions will be taken in case of ACH Returns with a strong monitoring strategy to keep track of ACH pulls and direct deposits.

‍

Pro Tip

Using Unit21, you can run this play in under an hour from rule strategy through to deployment. Without Unit21, this could take your team up to a month to deploy.

‍

Industry Standard With Unit21
Rule Strategy 1–2 Days based on availability of analytics team 15–20 minutes
Rule Creation Dependent on engineering resources* 5–10 minutes
Submitting Ticket to Engineering 1 Day Not required
Engineering Resources to Build & Edit Rules in Software 2–3 weeks (Dependent on resources) Not required
Total Time for Rule Strategy for Deployment 3–4 weeks 30–45 minutes

‍

* Based on a survey we found average risk teams get less than 15 hours of engineering time a week

‍

Additional Resources

‍

‍

‍

Scenario: Payment Cards (Visa, MC & AMEX)

‍

Payment cards can be separated into two categories: Debit and credit cards. Debit and credit cards are two of the most commonly used payment cards in the world. They both have similar characteristics, such as magnetic stripes, card digits, EMV chips, and CVV codes.



‍

Although they work in similar fashions, the two have inherent differences. A debit card uses funds from your bank account (meaning the transaction will be approved only if there are sufficient funds in the account), while a credit card is linked to a credit line that was underwritten and approved during the application process based on the customer’s creditworthiness. Purchases made with credit will allow customers more time to pay them back.



‍

Visa, Mastercard, American Express, and Discover are major credit card companies in the United States.

‍

Rewards

Payment card rails are very popular worldwide and many consumers hold a different variety of payment cards in their wallets.

Payment cards no longer represent “physical only” forms as they can be linked to mobile wallets and have digital-only options.

Issuing debit cards opens an opportunity to gain revenue from the interchange fees from the network while allowing your customer fast access to their funds via a payment form that is accepted by merchants and can resolve most of the consumer's day-to-day payment needs.

If you’re operating in the crypto space, this could be a great feature to offer off-ramp spend of fiats.

Risks

With the introduction of EMV Chips on cards and the high adoption of POS terminals among retailers, supporting chip transactions and risk exposure around card cloning and counterfeit copies of cards have significantly dropped. With that in mind, CNP (Card Not Present) Fraud has been on the rise ever since.

In recent years, direct payments (requests to pull funds from an account) became popular among bad actors because they could take advantage of clearing days and abuse internal disputes policies.

‍

Play

‍

Transaction monitoring based on historical customer profiling is the key to success when it comes to managing payment card risk.


‍

To prevent Card Not Present Fraud, organizations must take the following actions:

‍‍

  • Build a strategy based on risk levels and having unique associated rules to monitor your high/medium/low-risk levels.
  • Separate monitoring into Card present/EMV/CNP rules to have granular control of different fraud scenarios. 
  • Create a separate strategy for domestic and international monitoring. 

‍

Pro Tip

Understand the historical behavior of the user and deploy a monitoring strategy that looks for deviation.

‍

Additional Resources

‍

‍

Key Takeaways

Every new product or payment rail increases both growth opportunity and fraud exposure.

Faster and irreversible payments introduce higher risk and require stronger upfront controls.

Each payment method has unique fraud patterns and cannot be protected with a single strategy.

Fraud controls are most effective when designed before a product launches.

Customer behavior and deviations from normal use are the strongest fraud signals.

Scalable, automated fraud programs enable safe expansion without slowing growth.

‍

Learn more about Unit21

Unit21 empowers risk and compliance teams with fraud and AML infrastructure that reduces false positives, automates compliance, and streamlines SARs filing to enable businesses to grow.

We support over 150 fintech and crypto platforms such as Chime, Intuit, and Crypto.com through our risk and compliance infrastructure that enables them to reduce case times, false positives and instantly update rules to capture new fraud schemes while staying compliant.

Book a Demo →

Modern Fraud Prevention FAQs

Do you need separate products for each screening type?
What makes an AI agent appropriate for watchlist investigations in a regulated environment?
Does payment screening use the same rules as customer screening?
What is the difference between ongoing monitoring and onboarding screening?
What lists should a watchlist screening program cover?
See Us In Action

Boost fraud prevention & AML compliance

Fraud can’t be guesswork. Invest in a platform that puts you back in control.
Get a Demo