They should apply risk-based controls that intensify only when signals become unusual, rather than imposing the same challenge on every customer. That means using stronger verification for high-risk sessions, dormant accounts, or rapid changes in profile and payment behaviour. The goal is to reduce fraud without creating unnecessary friction for legitimate users.
How to tune fraud controls without turning every journey into a hurdle
The practical answer is to make friction proportional to risk. A low-risk returning customer should move through a lighter path, while a session with a new device, a dormant account, or an unusual payment pattern should trigger stronger checks. That is the most effective way to protect revenue and customers without normalising friction that slows everyone down.
The balancing act starts with deciding which signals actually justify extra challenge. Businesses should distinguish between routine variation and patterns that are materially associated with fraud, then reserve step-up verification for those cases. That keeps the baseline experience clean, while still giving the security team room to intervene when the behaviour becomes inconsistent with the account’s normal profile.
What risk-based verification should look like in practice
Risk-based controls work best when they are tied to observable events, not blanket policy. Common triggers include account recovery, profile changes, shipping or payment changes, impossible travel, repeated failed logins, or a sudden change in transaction velocity. NCSC UK Advice and Guidance is a useful reference point for organisations that need to align stronger verification with broader operational security discipline.
The UX design principle is simple: ask for more only when the risk signal rises. That can mean a one-time challenge, a re-authentication step, or a manual review rather than a full interruption of the journey. NIST SP 800-63 Digital Identity Guidelines is helpful here because it supports the idea of stronger assurance when the context demands it, rather than treating every interaction as equally sensitive.
For UK businesses, this usually means combining fraud rules with customer context. A new payee addition by a long-standing customer may merit a different response from the same action on a newly opened account. eIDAS 2.0, the EU Digital Identity Framework is a relevant external reference for the direction of travel in stronger, higher-assurance digital identity verification.
Where fraud prevention goes wrong, and why user friction rises
The most common failure is over-challenging legitimate users because the business cannot separate normal behaviour from suspicious behaviour. That creates avoidable abandonment, support contacts, and trust loss, especially when controls are applied uniformly instead of selectively. Fraud teams then get pressured to lower the bar, which can leave the organisation exposed in the opposite direction.
Another common issue is using signals that are too weak on their own. A single unusual event is not always fraud, and a control stack that reacts to every anomaly will quickly become noisy. Stronger decisions come from combining multiple indicators, then escalating only when the overall pattern supports it. FATF Recommendations are relevant because they reinforce risk-based customer due diligence and escalation rather than one-size-fits-all treatment.
Businesses also need to watch for control drift over time. A rule that starts out well calibrated can become too sensitive as fraud patterns, customer behaviour, or payment rails change. Periodic review is essential so the organisation does not keep imposing friction long after the underlying risk has moved on.
Risk and Threat Considerations
Fraud controls become risky when they are either too blunt or too predictable. If every user sees the same challenge, legitimate customers experience friction that is not matched to threat level. If the business never intensifies controls, attackers can exploit the easiest path, especially around account takeover, payment change, and recovery flows.
Failure mechanism: Static rules, weak signal fusion, or poorly tuned thresholds cause the business to challenge good users too often, or miss higher-risk sessions that warrant step-up verification.
Impact: The first outcome is abandonment and support burden; the second is preventable fraud loss, account compromise, and weaker trust in the customer journey.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack surface, NIST SP 800-63, CIS Controls v8 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Risk-based identity assurance and stronger verification match step-up checks for unusual sessions. |
| Recommendation — Apply higher assurance only when session risk justifies extra verification. | ||
| CIS Controls v8 | CIS-5 — Account Management | Balancing fraud and UX depends on managing account lifecycle and recovery exposure. |
| Recommendation — Review account and recovery paths for abuse-prone friction points. | ||
| NIST CSF 2.0 | PR.AA-05 — Managed Access Permissions | Selective challenge aligns with granting stronger access only when context warrants it. |
| Recommendation — Tighten access decisions when risk signals indicate elevated exposure. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Fraud journeys often depend on authentication strength at sensitive steps. |
| Recommendation — Harden authentication around recovery, payment, and profile-change flows. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access decisions and step-up checks need policy-driven consistency across customer journeys. |
| Recommendation — Define risk-based access policies for sensitive customer actions. | ||
Practitioner Guidance
What to prioritise: Start by identifying the few journey points where fraud risk and customer friction are both highest, then apply step-up controls there first. That usually gives the best return because it protects the most exposed moments without degrading the entire experience.
What to verify: Confirm that the same trigger does not always produce the same outcome. A dormant account, a new device, and a routine address update should not all generate identical friction, because the business is then treating different risk levels as if they were equivalent.
What good looks like: Legitimate users complete low-risk actions with minimal interruption, while suspicious activity receives a visible but proportionate challenge. The control should feel selective, explainable, and consistent rather than arbitrary.
Practitioner takeaway: The best balance is not “more security” or “less friction”, it is disciplined selectivity, where the business spends customer effort only when the risk signal justifies it.
Related resources from NHI Mgmt Group
- How do organisations balance fraud prevention and user experience in identity flows?
- How should online gambling platforms balance fraud prevention with user experience during major sporting events?
- How should trust and safety teams balance fraud prevention with customer experience when building digital businesses?
- How should teams design ID verification flows to balance KYC compliance, fraud prevention, and user experience?