Behavioral intelligence and device risk are now bank controls

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OneSpan's blog post: Banking fraud controls now need behavioral intelligence and device-risk signals to detect APP fraud, voice phishing, and remote-access scams that still pass conventional authentication and transaction checks.

Why it matters: It matters because IAM, fraud, and security teams in banking must move beyond static authentication and rules to judge session intent, device integrity, and user behavior across the full transaction journey.

Context

Dans la banque numérique, les contrôles qui identifient l'utilisateur ne suffisent plus à distinguer une transaction légitime d'une transaction manipulée. When legitimate customers can be coached, coerced, or remotely controlled into authorising payments, the security problem shifts from access verification to behavioural and device-level trust assessment.

The article argues that this is now a fraud-governance issue, not just a detection tuning issue. Banking programmes built around MFA, rule-based thresholds, and device fingerprints still miss the decision process behind the payment, which is where APP fraud and remote-access scams now succeed.

Key questions

Q: What breaks when banks rely only on MFA and transaction rules against APP fraud?

A: Those controls still validate the login and the payment, but they do not reveal whether the customer was manipulated into authorising it. APP fraud succeeds precisely because a legitimate user can satisfy the technical checks while acting under deception or coercion. Banks need session and device context to see the difference.

Q: Why do device-risk signals reduce fraud losses in digital banking?

A: They expose conditions that ordinary authentication cannot see, including overlays, remote-access tooling, malicious apps, and suspicious screen-sharing activity. When those signals are combined with user-behavior analysis, the bank can identify manipulated sessions before the payment is treated as trustworthy. That reduces false confidence in a technically valid transaction.

Q: How can banks tell a coached payment from a normal customer transfer?

A: They should look for interaction patterns that diverge from the customer's baseline, such as hesitation, rapid reversals, unusual pauses, abrupt bursts of activity, or a step-by-step navigation path that matches external instructions. A normal transfer is usually smoother and less externally paced. The key is to score the whole session, not a single event.

Q: Should fraud teams prioritize behavioral intelligence before tightening transaction thresholds?

A: Yes, when APP fraud and remote-access scams are a material risk. Thresholds help with obvious anomalies, but they often miss legitimate-looking payments driven by manipulation. Behavioral intelligence gives teams an earlier and richer signal, so it should be prioritized where the bank needs to judge intent, not just value or destination.

Technical breakdown

Why static transaction rules miss APP fraud

Authorized push payment fraud is not ordinary account takeover. The customer authenticates, sees the prompts, and approves the transfer, but does so under deception, coercion, or guided execution. That means the transaction can satisfy every visible control while the intent behind it is manipulated. Static rules catch amount, destination, and channel anomalies, but they do not model how the payment decision was formed. In practice, the control failure is not authentication at the edge. It is the inability to observe the session narrative that led to the approval.

Practical implication: fraud controls need session-context signals, not just transaction thresholds.

How behavioral intelligence detects guided or coerced sessions

Behavioral intelligence compares the current session against the customer's normal interaction pattern. Useful signals include time spent at each step, navigation pace, typing cadence, tap patterns, cursor movement, pauses, and abrupt bursts of activity after external instructions. These indicators can reveal guided transfers, stress-driven mistakes, or scripted remote control even when the login and payment look valid. The value is not in replacing authentication but in adding a second lens that sees how the user reached the decision. In banking fraud, the behaviour trail often tells the real story that the credential trail hides.

Practical implication: teams should correlate navigation, keystroke, and interaction patterns with payment decisions in real time.

Why device-risk signals matter when malware or remote access is present

Device-risk intelligence adds context that behavioral analytics alone cannot provide. A bank may see a familiar account on a familiar device, yet that device may be running overlay malware, a remote-access trojan, accessibility abuse, or an active screen-sharing session. In those cases, the device itself becomes part of the fraud path. The article's key technical point is that fraud detection must inspect the state of the endpoint during the transaction, not merely the identity of the customer. That shifts control design from user verification to environment trust assessment.

Practical implication: banks need device-state checks that detect overlays, remote sessions, and malicious app interference.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static fraud controls are now a boundary, not a strategy: MFA and rules-based monitoring still answer who logged in and what amount moved, but they do not answer whether the customer was manipulated during the session. That is why APP fraud, voice phishing, and remote-access scams keep clearing traditional controls. The practitioner lesson is that banking fraud governance now depends on intent visibility, not just authentication strength.

Behavioral intelligence turns the payment session into a governance surface: The decisive signal is no longer only the transaction record but the sequence of actions that preceded it. When users are coached step by step, the control gap is in the inability to distinguish deliberation from manipulation. Banking teams should treat session behavior as a first-class fraud control dimension, not as a secondary analytics add-on.

Device risk closes the blind spot left by customer identity alone: A known customer on a known device can still be operating through overlay malware, remote-access tooling, or accessibility abuse. That means the trust boundary sits inside the device as much as around the account. The practitioner conclusion is that fraud programmes must govern the endpoint as part of the identity decision, not as a separate security domain.

Banking fraud controls are converging with regulatory expectations: The article signals that behavioral and device intelligence are moving from differentiators to baseline expectations in payment security. That will force fraud, IAM, and compliance teams to align around evidence of session context and device integrity, not just authentication outcomes. The programme implication is a broader control model that can satisfy both fraud detection and supervisory scrutiny.

Session-intent risk is the named concept banks need to govern: The article's core insight is that the risk is not just fraudulent transactions, but legitimate sessions with illegitimate intent. That concept is operationally important because it forces control owners to model how a payment decision formed, not only whether a payment matched a rule. Practitioners should use this lens when redesigning fraud controls for digital banking.

What this signals

Session-intent risk: Banks should treat the path to authorisation as part of fraud governance, because a valid login no longer proves a valid payment decision. The control question is shifting from whether the customer authenticated to whether the customer decided freely.

For practitioners, the practical change is that fraud and identity teams must share the same evidence model. If device state, session behaviour, and payment context are not correlated, the bank is left defending a technically valid transaction that may still be fraudulent.

For practitioners

• Expand transaction review beyond amount and beneficiary Add session sequence, navigation pace, and interaction rhythm to fraud decisioning so the bank can distinguish a legitimate payment from a coached or coerced one.
• Correlate device-risk signals with user behavior Inspect for overlays, remote-access sessions, malware indicators, and accessibility abuse before approving a payment that otherwise appears normal.
• Instrument live-session anomaly detection Score rapid context shifts such as pauses, abrupt bursts, and step-by-step instruction patterns because those are often visible before the fraudulent transfer completes.
• Review fraud controls against APP and remote-access scenarios Test whether current authentication and rules would still fail when a real customer is manipulated through a trusted device or screen-sharing tool.

Key takeaways

• The article shows that payment fraud now exploits legitimate customers and compromised devices, not just stolen credentials or obvious account takeover.
• Static controls still miss the behavioral and device signals that explain why a transaction happened, which is why fraud can look legitimate at the system level.
• Banks need to evaluate session intent, device integrity, and transaction context together if they want to limit APP fraud and remote-access scams.

Key terms

• Behavioral Intelligence: Behavioral intelligence is the use of session patterns to judge whether an action looks normal for a specific user. In banking, it compares cadence, navigation, pauses, and correction patterns against prior sessions to detect coercion, guidance, or automation that authentication alone cannot reveal.
• Device Risk Intelligence: Device risk intelligence is telemetry that assesses whether an endpoint is healthy enough to trust during an identity event. It includes signals such as overlays, malware, remote-access tooling, accessibility abuse, and unusual connectivity, all of which can change the meaning of an otherwise valid transaction.
• Authorised Push Payment Fraud: A payment scam in which the victim is persuaded to authorise the transfer themselves. The transfer is technically authorised, but the decision is corrupted by deception, which makes liability, evidence, and prevention harder to separate from standard transaction controls.
• Session-intent risk: Session-intent risk is the possibility that a technically valid banking session is being used for an illegitimate decision or payment. The term shifts attention from simple authentication outcomes to the behavioral and device evidence that shows how the authorisation was formed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.