AFASA fraud controls raise the bar for transaction monitoring

At a glance

What this is: This is SumSub’s announcement of an AFASA fraud management bundle that blends rule-based detection with dynamic risk scoring for Philippine financial institutions.

Why it matters: It matters because IAM, fraud, and risk teams have to align transaction monitoring, authentication, and escalation workflows so suspicious activity can be stopped or contained before funds move.

By the numbers:

• SumSub’s Identity Fraud Report 2025-2026 recorded a 180% year-on-year increase in multi-step coordinated fraud globally.
• Deepfake attacks in the Philippines grew 61% year on year in 2025.

Context

AFASA is a Philippine fraud-management requirement, and the practical issue is how banks translate that obligation into controls that can act before a suspicious transfer completes. In identity terms, the problem sits at the intersection of authentication strength, transaction monitoring, and case handling.

The source article argues that a single control layer is not enough when scams are increasingly multi-step and AI-assisted. The governance question for financial institutions is whether detection, review, and recovery are wired together tightly enough to match settlement speed.

For banks, this is not just a compliance exercise. It is a test of whether fraud operations can treat transaction risk as a live decision problem rather than a retrospective investigation.

Key questions

Q: What breaks when transaction monitoring cannot act before settlement?

A: When monitoring only flags fraud after a payment clears, the institution loses its best intervention window and shifts from prevention to recovery. That weakens dispute handling, increases operational load, and makes suspicious activity harder to contain before funds leave the account. The control gap is latency between detection and action.

Q: Why do hybrid fraud controls work better than a single detection layer?

A: Hybrid controls work because fraud signals are uneven. Some cases are obvious and should be blocked immediately, while others require contextual scoring across identity, device, and transaction behaviour. A single layer either overblocks legitimate payments or misses coordinated fraud. The best model combines deterministic action with risk-based escalation.

Q: What are the signs that transaction monitoring is too slow for modern fraud?

A: Common signals include repeated suspicious transfers reaching settlement, excessive manual review after the fact, and intervention only when customers report loss. If controls cannot reject, hold, or verify a transaction while it is still pending, the monitoring stack is lagging the fraud pattern it is meant to contain.

Q: How should fraud, IAM, and case teams share responsibility for suspicious transactions?

A: Fraud operations should own the decision workflow, IAM should harden authentication and access signals, and case teams should preserve evidence and drive recovery. If those functions are split into separate queues with no shared decision model, suspicious activity moves faster than the organisation can coordinate a response.

How it works in practice

How hybrid transaction monitoring combines rules and risk scoring

Hybrid transaction monitoring uses two decision layers. Direct-action rules fire on strong signals such as blacklist matches, bot-like behaviour, or abnormal access patterns, while a separate scoring layer weighs behavioural anomalies, transaction deviations, and contextual inconsistencies. The operational advantage is that obvious fraud can be stopped immediately, while ambiguous cases can be routed for review or additional verification. This is more effective than relying on a single threshold because fraud patterns vary across customer segments, payment channels, and attack styles. In practice, the architecture has to preserve clear decision logic for rejects and holds while keeping the scoring model auditable enough for compliance and dispute handling.

Practical implication: separate hard-stop rules from scored review paths so the institution can justify both instant intervention and escalated review.

Why fund recovery has to be built into the monitoring workflow

Fund recovery is not a downstream back-office process if the monitoring stack is designed correctly. Once a suspicious transfer clears, recovery depends on how quickly the institution can freeze funds, preserve evidence, and trigger internal case handling. That means the monitoring workflow must understand directionality, because outgoing transfers need prevention-focused treatment while incoming funds need recovery-focused treatment. The article’s AFASA framing makes this distinction operational, not theoretical. If monitoring only flags suspicious activity after settlement, the institution has already lost the best recovery window and may be left with manual follow-up instead of containment.

Practical implication: map each transaction path to a prevention or recovery action before settlement rather than after case creation.

How AI-driven fraud changes the decision boundary

AI-assisted fraud changes the decision boundary because attacks can combine identity signals, behavioural manipulation, and contextual spoofing in a single flow. Deepfakes, automated activity, and coordinated multi-step fraud reduce the reliability of any one signal on its own. That is why the article emphasises aggregated risk scoring across multiple signal types rather than isolated checks. For practitioners, the technical shift is from single-event detection to correlated assessment across the whole transaction path. This matters most where fraud tools, KYC data, device telemetry, and case management need to share a common view of risk.

Practical implication: fuse identity, device, and transaction signals into one case view so AI-driven fraud cannot exploit a single blind spot.

NHI Mgmt Group analysis

AFASA turns transaction monitoring into a live identity decision problem, not a retrospective fraud report. The article shows that banks are being pushed to make a decision before settlement, while the underlying attack patterns are increasingly multi-step and AI-assisted. That combination means the control boundary has moved upstream into detection, authentication, and escalation logic. Practitioners should treat fraud monitoring as part of the identity decision plane, not a separate analytics layer.

Hybrid rules plus dynamic scoring is the right pattern when one signal is never enough. Rule-based actions work for clear fraud indicators, but the article correctly pairs them with aggregated scoring across behaviour, transaction history, and context. This is the governance shape that matters when fraud blends automation, access anomalies, and profile inconsistency. Banks should expect hybrid decisioning to become the default operating model for suspicious transaction handling.

Fund recovery is a control objective, not just an operational outcome. The AFASA framing makes prevention and recovery two sides of the same workflow, which is how transaction monitoring should be designed when settlement speed is the limiting factor. That pushes institutions to think in terms of hold, reject, verify, escalate, and recover as one chain. The practitioner lesson is that recovery capability must be engineered into the monitoring path before the payment clears.

Dynamic risk scoring creates a governance burden if thresholds and action logic are not explainable. The article highlights configurable thresholds and decision flows, which means institutions inherit responsibility for proving why a transaction was approved, held, or escalated. In financial services, that is not a minor implementation detail. The control only works when it remains defensible to compliance, operations, and customer dispute teams.

AFASA is accelerating the convergence of fraud operations and identity governance. Once banks must react in real time, device intelligence, KYC data, case management, and transaction monitoring stop being separate tools and start behaving like one control surface. That convergence will reward institutions that have already aligned identity, fraud, and risk operations. Practitioners should expect future fraud programmes to be judged on response speed, not just detection coverage.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Hybrid decisioning is becoming the practical baseline for fraud control. Banks cannot depend on a single signal when coordinated fraud combines automation, abnormal access, and behavioural manipulation. The stronger model is a layered one that can reject, hold, verify, or escalate based on the quality of the evidence.

Transaction monitoring is now part of identity governance in financial services. When suspicious activity depends on compromised access and profile inconsistency, the boundary between fraud operations and identity controls disappears. Practitioners should plan for tighter integration between authentication, device intelligence, and case handling.

Real-time intervention is the differentiator, not post-event analysis. If the control path cannot act before settlement, the programme has already accepted avoidable loss and recovery overhead. That changes the design goal from detection coverage to decision velocity.

For practitioners

• Align transaction paths to decision outcomes Map outgoing transfers to prevention actions and incoming funds to recovery actions so every suspicious transaction has a predefined response path before settlement.
• Separate hard-stop rules from scored reviews Use direct-action rules for blacklist matches, bot activity, and abnormal access, while reserving dynamic scoring for ambiguous cases that need review or extra verification.
• Unify device, KYC, and case data Feed device intelligence, customer profile data, and case management into one operating view so analysts can see why a transaction was flagged and what to do next.
• Document thresholds and escalation logic Record which score ranges trigger holds, rejects, step-up checks, or case review so compliance teams can explain intervention decisions consistently.

Key takeaways

• AFASA-linked fraud controls move banks away from passive monitoring and toward transaction decisions that can stop or hold suspicious activity in flight.
• The article points to multi-step coordinated fraud and deepfake-driven attacks as the pressure points that make single-signal detection too fragile.
• Banks need monitoring, authentication, device intelligence, and case handling to operate as one response chain if they want prevention and recovery to work together.

Key terms

• Hybrid Fraud Monitoring: A monitoring model that combines hard rules with scored risk assessment so obvious fraud can be stopped immediately and ambiguous activity can be reviewed. In practice, it links detection, verification, and escalation into one decision flow rather than treating them as separate tools.
• Continuous Risk Scoring: Continuous risk scoring assigns and updates an identity risk value as behaviour, entitlements, location, and privilege level change. It gives security teams a prioritisation mechanism for access decisions, but it only works when the score is tied to a clear governance action.
• Fund Recovery Workflow: The operational chain used to freeze, investigate, and reclaim funds after a suspicious transaction is identified. It depends on timely detection, evidence preservation, and clear ownership across fraud, operations, and customer support, especially when settlement speed limits intervention.
• Transaction Decisioning: Transaction decisioning is the process of approving, declining, or reviewing a purchase using multiple risk signals in real time. It goes beyond card verification to combine behavioural, device, and historical context so merchants can reduce fraud without blocking too many legitimate customers.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.