Device and behavioral intelligence are closing banking fraud gaps

At a glance

What this is: This is an analysis of why banks’ traditional fraud controls miss authorised payment fraud and why device and behavioral intelligence are becoming necessary to detect manipulated customers and compromised devices.

Why it matters: It matters because IAM and fraud teams must govern more than authentication outcomes; they need signals that reveal intent, session anomalies, and device compromise inside live banking journeys.

Context

Banks have moved beyond basic authentication and transaction rules, yet authorised fraud still slips through because the customer often looks legitimate at the point of payment. The governance gap is not login assurance alone, but the absence of controls that can evaluate behaviour, device condition, and session context in the same decision.

In banking fraud prevention, the identity question is no longer only who authenticated. It is whether the transaction was reached through coercion, coaching, remote device control, or device compromise. That shifts the control problem from static fraud flags to live session intelligence across the user journey.

Key questions

Q: How should banks detect fraud when the customer is genuine but manipulated?

A: Banks should look beyond authentication and examine how the payment session unfolds. Behavioral changes, unusual pauses, rapid instruction-following, and device signals such as overlays or remote access tools can reveal coercion even when the customer logs in successfully and approves the transaction themselves.

Q: Why do MFA and transaction rules miss authorised push payment fraud?

A: Because they verify identity and payment attributes, not intent. APP fraud often uses the real customer on a real device, so the transfer looks valid unless the bank can see session behaviour, device compromise, or external coaching that changed the customer’s decision path.

Q: What are the signs that a banking session is being coached or remotely controlled?

A: Look for slowed inputs followed by sudden bursts, repeated pauses before sensitive steps, uncharacteristic mouse or touch movement, screen overlays, active remote-access tools, and calls or messages that occur during the transaction window. Those signals suggest the user is not acting independently.

Q: Should fraud teams prioritise device intelligence over behavioral analytics?

A: No. The strongest outcomes come from using both together. Behavioral analytics shows how the user is acting, while device intelligence shows whether the endpoint is compromised, manipulated, or being remotely observed. Either signal alone can miss part of the fraud path.

Technical breakdown

Why traditional fraud controls miss authorised push payment scams

Traditional fraud controls are built to spot abnormal transactions, failed authentication, or known bad actors. APP fraud breaks that model because the payment is authorised by the real customer, often on a familiar device, through a genuine banking session. The fraud is hidden in the path to authorisation, not always in the transaction fields themselves. That means rules keyed to amount, destination, or login success can look healthy while the customer is being manipulated in real time. The core technical issue is signal absence: the control stack sees identity confirmation but not coercion, coaching, or device takeover.

Practical implication: banks need detection logic that evaluates session behaviour and device state before authorisation is finalised.

How behavioral analytics turns session activity into fraud signals

Behavioral analytics builds a baseline for how a customer normally interacts with the banking channel, then compares live activity against that baseline. Signals such as typing cadence, navigation rhythm, pauses, touch patterns, and step timing can show coaching, stress, or remote control even when the login was valid. This is not about biometrics alone. It is about session pattern analysis that can distinguish a normal user from a guided or manipulated one. When combined with fraud models learned from confirmed cases, the system can recognise interactions that resemble coercion or remote access rather than ordinary banking behaviour.

Practical implication: banks should treat behavioural deviation as a real-time risk input, not a post-transaction investigative artefact.

Why device intelligence is the missing control layer

Device intelligence adds the environmental view that traditional fraud systems lack. A device can be compromised through overlays, malware, remote-access tools, or abuse of accessibility services, and the customer may still complete a valid-looking payment. Device risk signals can show whether the session is running alongside screen-sharing software, whether the device is under remote control, or whether malware is manipulating what the user sees. That matters because the bank must decide not just whether the customer is trusted, but whether the endpoint is acting like an honest participant in the transaction. In fraud operations, endpoint condition is part of identity assurance.

Practical implication: banks should combine device risk telemetry with session signals to block compromised-device fraud paths earlier.

Threat narrative

Attacker objective: The attacker wants a legitimate-looking authorised payment that moves money while bypassing controls designed to detect conventional fraud patterns.

1. Entry begins with social engineering or impersonation, where a fraudster convinces the customer to engage through a trusted channel such as a phone call or messaging app.
2. Credential access or session abuse follows when the customer logs in normally, installs remote-access software, or completes authentication on the fraudster’s instructions.
3. Escalation occurs as the attacker gains visibility into the live session, manipulates screen content, or directs the victim through transfer steps that appear legitimate.
4. Impact is the authorised transfer of funds under deceptive conditions, with the bank seeing a genuine customer and a successful transaction rather than an obvious intrusion.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authorized fraud is a control-design problem, not a customer-verification problem. Banks can authenticate the customer and still miss the fraud because the transaction was engineered through coercion or device compromise. The article shows that traditional transaction monitoring optimises for suspicious payments, while modern fraud often looks operationally normal until the moment of authorisation. Practitioners should treat payment fraud as a journey-control issue, not a login-only issue.

Device and behavioral intelligence form the real decision layer in digital banking fraud prevention. Authentication tells you who entered the session, but not whether the session is being coached, mirrored, or remotely manipulated. This is a governance shift for fraud and IAM teams alike: the control boundary has moved from access grant to in-session trust evaluation. Banks that still rely on identity proof alone are governing the wrong event.

Coerced-authorisation fraud reveals a named concept: session intent drift. The customer’s intent changes between authentication and payment completion because external pressure, guidance, or remote control reshapes the decision path. That drift is why static rules miss the attack, even when the same device and account are reused. Practitioners need to recognise that the transaction may be legitimate in form while illegitimate in intent, and that distinction must be detectable inside the session.

The fraud stack is converging on continuous evidence, not point-in-time checks. The article’s device, behavioral, and regulatory themes point in the same direction: banks are being pushed toward controls that observe how the session unfolds, not just whether it succeeded. That direction aligns with broader identity security practice where trust must be re-evaluated as conditions change. For banking teams, the practical conclusion is that fraud detection, authentication, and device telemetry can no longer be run as separate islands.

Regulatory pressure is turning behavioral analytics from an enhancement into a baseline expectation. The article notes that forthcoming regulation is expected to require device intelligence and behavioral intelligence in transaction monitoring. That means the market is not just adopting a new technique, it is redefining what counts as defensible fraud governance. Practitioners should plan for a world where the absence of behavioral evidence becomes a control gap, not a tuning preference.

What this signals

Session intent drift: banks should expect the customer’s decision path to change between login and payment approval when fraudsters coach, pressure, or remotely control the session. The control objective is no longer just to confirm identity, but to detect when intent has been externally altered before the transfer completes.

Device telemetry is becoming fraud governance, not a side channel. When overlays, accessibility abuse, or remote-access tools can be present on a trusted device, the bank needs to treat endpoint state as part of the authorisation decision rather than a separate security concern.

For practitioners

• Deploy behavioral session scoring Measure typing cadence, navigation rhythm, step timing, and pause patterns during payment flows so coercion and coaching create detectable anomalies before transfer completion.
• Add device risk telemetry to payment decisions Check for overlays, remote-access tools, accessibility abuse, side-loaded apps, and unusual connection properties before approving high-risk banking actions.
• Correlate external contact with transaction timing Flag calls, messaging, or remote-assistance events that occur during or just before a payment session because those interactions often explain manipulated-authorisation fraud.
• Separate customer authenticity from transaction intent Design fraud decisioning so a successful login does not equal safe authorisation, especially where the device or session shows signs of coaching or remote control.

Key takeaways

• Modern banking fraud increasingly succeeds without stealing the customer’s identity, because the attacker manipulates the customer or the device instead.
• Traditional MFA and transaction monitoring are blind to the session-level signals that reveal coaching, coercion, and remote control.
• Banks need behavioral and device intelligence together if they want to stop authorised fraud before the payment is completed.

Key terms

• Authorised Push Payment Fraud: A payment scam in which the victim is persuaded to authorise the transfer themselves. The transfer is technically authorised, but the decision is corrupted by deception, which makes liability, evidence, and prevention harder to separate from standard transaction controls.
• Behavioural Analytics: Behavioural analytics compares current activity against normal patterns to detect anomalies that may indicate abuse or compromise. In identity programmes, it is used to spot suspicious access behaviour that rule-based monitoring can miss, especially when attackers mimic legitimate workflows.
• Device Risk Intelligence: Device risk intelligence is telemetry that assesses whether an endpoint is healthy enough to trust during an identity event. It includes signals such as overlays, malware, remote-access tooling, accessibility abuse, and unusual connectivity, all of which can change the meaning of an otherwise valid transaction.
• Runtime Intent Drift: The gap between what an AI agent was meant to do and what it actually decides to do during a live session. This matters because the identity may remain valid while the action path changes, making static permission reviews insufficient for real control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.