Device intelligence closes the fraud and compliance blind spot in banking

At a glance

What this is: Fingerprint argues that banks are still managing fraud and compliance through siloed point solutions, which leaves them exposed to AI-driven fraud and weak cross-team visibility.

Why it matters: For IAM, fraud, and compliance teams, the key issue is not adding another control layer but creating a shared view of device and behavioural signals that can support faster identity decisions and better AML and KYC outcomes.

By the numbers:

• Only 27% of U.S. enterprises reported that fraud prevention was jointly owned by finance and security teams.

Context

Banks are running into a governance problem as much as a fraud problem. When fraud, identity, cybersecurity, and compliance teams work from different signals, each control sees only part of the user journey and the organisation loses the ability to connect intent, device behaviour, and regulatory evidence.

In banking, that gap matters because customer onboarding, account access, AML, and KYC decisions all depend on consistent identity and device context. The article frames the issue as a layered security model that became fragmented over time, which is a typical outcome in large financial institutions rather than an exceptional failure.

Device intelligence matters because it gives security and identity teams a persistent view of the same device across sessions, helping separate legitimate users from synthetic or automated activity without forcing every check to become a manual review.

Key questions

Q: What breaks when fraud, identity, and compliance teams do not share device signals?

A: Banks lose cross-session context, so each team sees only a partial view of the same user. That creates duplicated verification, slower investigations, and weaker detection of synthetic identities or account abuse. Shared device signals are what let institutions connect onboarding, login, and transaction risk into one decision path.

Q: Why do AI-driven fraud tactics create more risk for banks than static rule sets can handle?

A: AI-driven fraud can change appearance faster than periodic reviews or isolated alerts can correlate it. When synthetic identities, spoofed fingerprints, and behavioural mimicry are evaluated separately, the organisation misses the pattern across sessions. The result is higher false confidence and weaker resistance to coordinated abuse.

Q: What are the signs that a bank’s fraud controls are failing across sessions?

A: Repeated verification prompts, inconsistent decisions across channels, and alerts that cannot be tied back to the same device or user pattern are strong warning signs. If investigations require analysts to stitch together evidence manually, the control model is too fragmented to support timely fraud and compliance action.

Q: How should regulated organisations implement AML compliance without slowing customer onboarding too much?

A: Regulated organisations should use a risk based AML programme that starts with customer due diligence at onboarding, then applies ongoing monitoring based on risk level. The practical goal is to collect enough verified data to meet regulatory expectations, flag suspicious activity early, and avoid treating every customer as equally risky. That keeps controls proportionate while reducing friction for lower risk customers.

Technical breakdown

Why layered banking controls miss AI-driven fraud

Banks often stack controls as separate detection layers, but layered design only works when each layer shares context with the others. In practice, fraud detection, identity verification, and compliance evidence are frequently stored in different tools, which means no single system can recognise a user’s behaviour across sessions. AI-driven attackers exploit that fragmentation by changing signals faster than manual review can correlate them. Device intelligence closes part of that gap by persisting device-level context even when cookies disappear or browser attributes change.

Practical implication: build shared decisioning around a persistent device and behaviour signal, not around isolated point-in-time checks.

How device intelligence supports AML and KYC monitoring

AML and KYC programmes depend on being able to spot suspicious continuity across accounts, sessions, and behavioural patterns. Traditional static checks are weak at this because they validate a moment, not a relationship. Device intelligence helps by connecting multiple sessions to the same device or risk pattern, which can reveal mule activity, synthetic identity reuse, or repeated login abuse that single-event screening misses. That makes it a useful control layer for continuous monitoring rather than a replacement for identity proofing.

Practical implication: use device and behavioural correlation to enrich AML and KYC alerts so investigators see cross-session risk sooner.

Why shared signals reduce friction without weakening control

The operational trade-off in banking is usually framed as security versus customer experience, but the real issue is whether controls are coordinated. When teams each trigger their own checks independently, legitimate users get repeated prompts and false positives rise. A shared signal model reduces that duplication because the fraud, identity, and cybersecurity functions can draw on the same evidence. That does not eliminate scrutiny; it improves sequencing, so strong signals can be reused instead of re-collected.

Practical implication: rationalise overlapping verification steps so trusted users are recognised once and high-risk cases receive deeper review.

Threat narrative

Attacker objective: The attacker aims to pass as a legitimate banking customer long enough to open, access, or abuse accounts without triggering coordinated fraud or compliance detection.

1. Entry begins when fraudsters use AI to create synthetic identities, spoof device fingerprints, or mimic normal behaviour at scale.
2. Escalation occurs when fragmented controls fail to connect repeated device, browser, or network patterns across sessions and accounts.
3. Impact follows as bad actors slip through onboarding or account access checks, increasing exposure to account takeover, money mule activity, regulatory penalties, and customer friction.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fragmented fraud governance is now the core banking blind spot: the article shows that isolated tools create a false sense of coverage because each team sees a different slice of the same event. Fraud, IAM, cyber, and compliance only become operationally useful when they share signals at the point of decision. For practitioners, the lesson is to treat signal fragmentation as a governance defect, not a tooling inconvenience.

Device intelligence is a governance layer, not just a detection feature: its value is in persistent context across sessions, which allows banks to recognise returning users and detect behavioural reuse even when surface identifiers change. That is especially relevant where identity proofing, access decisions, and AML controls all depend on the same user journey. For practitioners, the priority is to align device context with identity risk decisions.

AI-driven fraud has turned static review into a timing problem: the article’s 41% survey figure and 54% exposure for financial institutions point to attacks that evolve faster than quarterly audits or delayed alerts can respond. The named concept here is cross-session identity drift, where a user looks legitimate in each individual check but suspicious when activity is correlated over time. For practitioners, this means detection must move closer to issuance and access decisions.

Compliance and fraud cannot be treated as separate operating models: AML, KYC, and fraud prevention all depend on the same evidence, yet many institutions still separate ownership and accountability. That separation creates duplicated checks, missed correlations, and audit trails that do not reflect how risk actually manifests. For practitioners, the implication is to unify governance around shared evidence rather than separate departmental workflows.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Device intelligence should be treated as part of the identity control plane: the real gain is not better fingerprinting on its own, but a shared evidence layer that can support fraud, access, and compliance decisions together. When banks keep those functions separate, they multiply friction and slow their response to AI-assisted fraud.

Cross-session identity drift is the pattern banks need to watch: an actor can look ordinary in one check and suspicious only when activity is correlated over time. For IAM and fraud programmes, that means the detection problem has moved from single-event verification to relationship-aware decisioning.

For practitioners

• Define a shared device-risk signal model Create a common set of device, browser, and behavioural signals that fraud, IAM, and compliance teams all consume before they build separate rules.
• Map duplicate verification steps across journeys Identify where onboarding, login, and transaction checks are independently reasking the same questions and remove redundant prompts for low-risk users.
• Correlate cross-session patterns into AML alerts Feed repeated fingerprints, geolocation mismatches, and account clustering into investigations so analysts can spot mule and identity misuse earlier.
• Align fraud ownership with security governance Set explicit ownership for fraud prevention across finance, security, and identity teams so signal sharing is a requirement rather than an afterthought.

Key takeaways

• Banks are exposed when fraud, IAM, and compliance controls operate as disconnected point solutions.
• AI-driven fraud now moves fast enough that periodic reviews and isolated alerts miss important cross-session patterns.
• The practical response is to share device and behavioural signals so legitimate users face less friction and suspicious activity surfaces earlier.

Key terms

• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
• Cross-Session Correlation: Cross-session correlation is the practice of linking events across accounts, devices, infrastructure, and time to reveal coordinated behaviour. It is the difference between seeing one clean session and seeing an abuse campaign that only becomes visible when many clean sessions are analyzed together.
• Synthetic Identity Document Fraud: Synthetic identity document fraud is the use of fabricated or AI-generated identity documents to impersonate a real or invented person. It targets verification workflows by presenting fake passports, driver’s licences, or IDs that can look credible enough to pass basic checks unless teams use stronger authenticity and anomaly detection controls.
• Persistent Risk Signal: A persistent risk signal is a piece of evidence that remains meaningful across sessions, even when superficial identifiers change. Banks use these signals to recognise repeat behaviour, reduce duplicate checks, and support faster fraud and compliance decisions.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is useful for practitioners who need to connect identity control design with broader security decision-making.