How should banks and digital businesses reduce fraud without adding too much customer friction?

Banks and digital businesses should pair identity verification with risk-based authentication so they can challenge only the interactions that look suspicious. The goal is to reduce fraud while keeping legitimate customers moving. That means using behind-the-scenes checks, step-up only when needed, and aligning controls to the risk of the transaction rather than treating every user the same.

Why Fraud Controls Fail When They Treat Every Customer the Same

Fraud prevention works best when it distinguishes normal behaviour from elevated risk, because most legitimate customers do not behave like attackers all day. Banks and digital businesses run into friction when they apply blanket challenges, static rules, or repeated step-up checks to low-risk activity. That slows conversion, pushes users away, and still misses the fraud that blends into ordinary usage.

The real issue is not whether to use authentication, but how to apply it with enough context to avoid turning every login or payment into an obstacle. Risk-based decisions let organisations reserve stronger checks for unusual device patterns, high-value actions, impossible travel, account takeover signals, or changes in behavioural profile. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces the broader control principle: protection should be proportionate to the sensitivity and risk of the action, not applied as a blunt default.

In practice, many teams discover that customers tolerate one well-placed challenge far more readily than a constant stream of low-value interruptions.

How Risk-Based Authentication Reduces Friction Without Weakening Defences

The practical model is to separate background assurance from visible user challenge. Background checks can examine device reputation, IP velocity, session consistency, account age, transaction amount, historical spending patterns, and whether the request fits the customer’s normal profile. If the interaction looks ordinary, the system should keep the journey short. If it looks abnormal, the system can require a step-up action such as an MFA prompt, re-verification, or a temporary hold.

This is where fraud control becomes a design problem as much as a security problem. A strong approach limits customer friction by reducing unnecessary prompts, but it also limits attacker freedom by making risky actions harder to complete in one uninterrupted flow. The best programs do not rely on a single signal. They combine multiple signals so that a suspicious login from a new device is treated differently from a routine login on a known device, and a high-value transfer is treated differently from a balance check.

For digital businesses with high transaction volume, the value is cumulative: fewer false positives, fewer abandoned sessions, and better detection of account takeover patterns that would otherwise be hidden inside normal traffic. NHIMG’s guide to Ultimate Guide to NHIs is useful here because it shows how modern security programs increasingly depend on reliable identity signals and lifecycle discipline rather than one-time checks alone.

Use invisible risk scoring first, then reveal friction only when the score crosses a meaningful threshold.
Differentiate authentication strength by action type, not just by user identity.
Treat device and session continuity as part of the trust decision, not as a separate monitoring problem.
Review false positives regularly, because over-triggering step-up checks is one of the fastest ways to erode adoption.

When systems cannot combine behavioural, device, and transaction signals cleanly, risk-based authentication tends to collapse into either over-challenging customers or under-protecting high-value actions.

Common Variations, Trade-offs, and Failure Points

Tighter fraud controls often increase abandonment, so organisations have to balance detection strength against customer effort. That trade-off becomes sharper in mobile-first products, instant payments, and account recovery flows, where even small delays can cause legitimate users to quit or contact support. The right balance usually depends on the value of the action, the confidence in the signals, and the customer segment involved.

There is no universal standard for this yet. Some organisations prefer conservative challenge rates for new accounts, while others lean on adaptive models that become stricter only after a sequence of anomalies. The common mistake is to optimise for fraud loss alone and ignore customer lifetime value, support burden, and the reputational cost of false declines. Another frequent failure is using rules that are too static, so fraudsters learn exactly which behaviours avoid extra checks.

NHIMG research on CI/CD pipeline exploitation case study is not about customer authentication directly, but it illustrates a broader control reality: when attackers find the weakest trust boundary, they use it repeatedly unless detection and response adapt. The same pattern appears in fraud systems that never tune thresholds or review step-up outcomes.

For banks, the most fragile cases are account recovery, first-time payees, and high-risk transfers. For digital businesses, they are onboarding, password resets, and checkout flows where a single extra prompt can materially affect conversion. In both settings, controls tend to break down when fraud teams and product teams optimise separately and no one owns the end-to-end user journey.

Risk and Threat Considerations

The material risk is that fraud prevention either becomes too weak to stop account takeover and payment abuse, or too aggressive and drives legitimate users into abandonment, support queues, and workarounds. Attackers benefit when the same friction is applied to every user, because it creates predictable paths around controls and makes high-risk activity harder to distinguish from normal behaviour.

Failure mechanism: Static challenge rules, weak signal fusion, and poor threshold tuning let fraudsters exploit routine flows such as login, password reset, payee addition, and recovery. Once the environment is predictable, attackers can pace their activity to stay below alert thresholds or target whichever step has the least scrutiny.

Impact: The business either absorbs fraud losses through compromised accounts and fraudulent transactions, or it absorbs customer loss through unnecessary friction, failed conversions, and degraded trust in the service.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	Risk-based authentication depends on adaptive identity assurance and access control decisions.
Recommendation — Apply PR.AA to tune authentication strength to transaction risk and user context.
CIS Controls v8	6 — Access Control Management	Fraud reduction requires limiting access and step-up only where trust changes materially.
Recommendation — Harden access workflows so high-risk actions trigger stronger verification than routine use.
NIST SP 800-63	IAL/AAL — Identity Assurance Level / Authenticator Assurance Level	Customer friction should align with the assurance level needed for the transaction.
Recommendation — Select assurance levels that match the sensitivity of the action being performed.
NIST Zero Trust (SP 800-207)	5 — Policy Decision and Enforcement	Adaptive fraud controls need real-time policy evaluation before granting sensitive access.
Recommendation — Use policy decisions to permit, challenge, or deny based on current risk signals.
MITRE ATT&CK	T1110 — Brute Force	Fraud and account takeover commonly exploit repeated credential attempts and weak challenge logic.
Recommendation — Detect and throttle repeated authentication abuse patterns before they reach account control.

Practitioner Guidance

What to prioritise: Put the strongest friction only where the blast radius is highest, such as recovery, new-device access, beneficiary changes, and high-value transfers. Low-risk journeys should stay almost invisible unless the risk score materially changes.

What to measure: Track step-up rate, false-decline rate, recovery friction, abandonment at challenge points, and fraud caught per challenge. If a control raises prompts without reducing fraud or improving loss containment, it is probably too blunt.

Decision rule: If the action can directly move money, change account control, or reset trust, treat it as a higher-risk decision even when the session looks normal. If the action is informational or low impact, avoid adding challenge just because the user is new or the device is unfamiliar.

Practitioner takeaway: The best fraud control is not the most restrictive one; it is the one that concentrates friction on the few moments where risk genuinely changes, while leaving ordinary customers alone.