Network intelligence is becoming the baseline for fraud defense

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Feedzai's blog post: Shared, network-derived intelligence changes fraud detection when institutions can no longer rely on their own transaction history alone.

Why it matters: It matters because fraud teams, IAM leads, and financial crime practitioners need detection models that can learn from cross-institution patterns without forcing raw data sharing or disrupting existing controls.

By the numbers:

• According to Nasdaq Verafin, $579.4 billion was lost to bank fraud and scams in 2025.
• That figure was $53.3 billion higher than in 2023.
• Feedzai says its network intelligence layer draws on $19 trillion in annual payment transactions.
• Feedzai says the network processes 140 billion annual network-wide events.

Context

Fraud detection fails when each institution only sees its own transactions, because the threat pattern often emerges across banks, payment rails, and customer journeys rather than inside a single ledger. That creates a governance gap between local signal ownership and network-scale fraud behaviour, especially as APP scams, synthetic identity fraud, and AI-enabled deception move faster than isolated models can adapt.

Feedzai frames the problem as one of collective visibility rather than individual model quality. In that sense, the article is about the boundary between fraud operations and identity governance: when shared signals are missing, institutions are left to make risk decisions on partial evidence, which is exactly where modern fraud rings expect them to be.

Key questions

Q: What breaks when fraud detection relies only on an institution’s own data?

A: Local-only fraud detection fails when the attack pattern is distributed across many institutions, because each bank sees only a fragment of the campaign. That leaves APP scams, mule activity, and synthetic identity behaviour invisible until losses accumulate. The control gap is not model sophistication alone, but the absence of network-level context that can connect repeated behaviour across participants.

Q: Why does fraud-as-a-service increase risk for online businesses?

A: Fraud-as-a-service lowers the skill barrier and turns criminal capability into a purchasable service. That expands the pool of attackers, increases attack volume, and makes abuse more repeatable. For merchants, the risk is not only more fraud attempts, but more coordinated phishing, account takeover, and payment abuse that can bypass static controls and manual review.

Q: How should financial institutions use federated learning for fraud detection?

A: Use federated learning when you need shared fraud intelligence but cannot move raw customer data into a central repository. The model can learn from distributed signals while keeping records in each institution’s environment. The key governance check is whether the network improves detection without weakening privacy, residency, or audit boundaries.

Q: When should fraud teams prioritise shared intelligence over internal model retraining?

A: Prioritise shared intelligence when fraud typologies are evolving faster than your local labels and when the same patterns are appearing across multiple institutions. Internal retraining still matters, but it cannot close a visibility gap created by isolated data. If the threat is ecosystem-wide, the response must be ecosystem-wide as well.

Technical breakdown

Why siloed fraud models miss cross-institution patterns

A fraud model trained only on an institution’s own history can recognise local anomalies, but it cannot infer a coordinated campaign that hops from bank to bank. That limitation is structural, not just statistical. If the same mule account, device fingerprint, or scam script appears across many institutions, each individual model sees only a fragment of the attack. Network-derived intelligence solves for that by aggregating confirmed patterns across participants, then scoring new activity against those learned signals in real time. The practical effect is earlier recognition of emerging typologies, especially in fast-moving payment environments where local labels arrive too late to help. Practical implication: treat network-level signal sharing as a detection architecture problem, not a model-tuning problem. See the Fraud and Cyber Convergence Guide.

Practical implication: Prioritise cross-institution signal ingestion where fraud typologies routinely move across organisational boundaries.

How federated learning preserves privacy while improving fraud scoring

Federated learning is a model-training pattern in which each participant keeps raw data in its own environment while contributing learned signals to a shared model. That matters for fraud programs because traditional consortium data-sharing often collides with privacy, residency, and legal constraints. In this approach, the network learns from risk patterns without pooling customer records or exposing personally identifiable information. The governance challenge shifts from data centralisation to model quality assurance, calibration, and eligibility controls for contributors. That is why minimum-history thresholds, label counts, and bias checks matter: they keep low-quality or unstable models from contaminating the network. Practical implication: validate how shared fraud intelligence is trained, filtered, and calibrated before treating it as compliant. See the Fraud Prevention Platform Buyer's Guide.

Practical implication: Require proof that shared fraud intelligence can improve detection without moving raw customer data out of scope.

Why real-time scoring and explainability matter in fraud operations

A real-time risk score is only useful if analysts can interpret it quickly enough to act before funds leave the account. That is why the combination of a standardised score range and human-readable explanations is operationally important. It reduces ambiguity in review queues, supports threshold setting, and helps teams distinguish between routine noise and genuinely network-confirmed risk. In financial crime operations, explainability is not a reporting luxury; it is what allows a decision engine to be trusted under pressure and defended later in audit or dispute handling. Practical implication: test whether your scoring layer produces decisions your analysts can explain in seconds, not just numbers the model can generate. Read Fraud Prevention Guide for Digital Businesses.

Practical implication: Use explainability requirements to reduce alert fatigue and improve escalation quality in real-time fraud reviews.

Threat narrative

Attacker objective: The attacker’s objective is to scale successful fraud across many institutions while keeping each one blind to the broader campaign.

1. Entry begins when a fraudster uses APP scams, synthetic identities, or social engineering scripts that appear normal inside a single institution’s data silo.
2. Credential harvesting or trust abuse follows when stolen data, compromised accounts, or mule infrastructure are reused across multiple institutions through fraud-as-a-service networks.
3. Escalation occurs as the same actor or ring rotates devices, accounts, and payment paths faster than any one bank can retrain its local model.
4. Impact is the successful transfer of funds or the quiet absorption of fraud losses by institutions that could not see the wider pattern in time.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fraud detection is becoming a network governance problem, not a single-bank tuning exercise. The article’s core insight is that fraud now behaves like a distributed system, with signals spread across institutions rather than concentrated inside one environment. That breaks the old assumption that local transaction history is enough to train effective controls. Practitioners should treat cross-institution intelligence as part of the control plane, not as an optional enrichment layer.

Fraud-as-a-service is the named concept that explains the new operating model of criminal scale. When stolen data, compromised accounts, AI tools, and infrastructure access are packaged for resale, attackers can iterate faster than any individual institution can. That forces fraud teams to think in terms of ecosystem exposure, not isolated cases. The practical conclusion is that detection maturity now depends on how quickly a network can learn from one participant and protect the next.

Identity signals are now embedded in fraud decisions whether IAM teams recognise it or not. Device reputation, account provenance, and behavioural trust are all identity-adjacent controls, even when they sit inside fraud tooling rather than IAM platforms. That makes the fraud and identity boundary increasingly artificial in practice. Where that intersection exists, teams should align fraud signals with identity governance processes so suspicious patterns do not remain trapped inside separate operational silos.

Privacy-safe collaboration is the only scalable alternative to raw-data pooling. The article shows why regulated institutions resist central repositories and why federated learning has become a more realistic operating pattern. The governance implication is clear: collaboration will be adopted only when privacy, residency, and auditability are preserved by design. Practitioners should demand that collective defense mechanisms preserve compliance boundaries while still improving detection quality.

Model precision alone no longer defines fraud resilience. The real differentiator is whether a program can recognise an attack family before local losses accumulate. That shifts attention from static rules and isolated machine learning outputs to shared intelligence, standardised scoring, and operational speed. Practitioners should judge fraud controls by how quickly they incorporate network-confirmed behaviour into live decisions.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Network visibility is becoming the new fraud control boundary: institutions that cannot learn from external behaviour will continue to detect attacks only after the same actor has already moved elsewhere. The operational question is no longer whether a model can score a transaction, but whether the program can absorb confirmed signals from the wider ecosystem quickly enough to matter.

The identity and fraud boundary is narrowing in practice because account trust, device reputation, and behavioural signals are now central to both fraud reduction and access governance. Teams that keep these functions isolated will keep recreating the same blind spots in different systems.

The next program inflection point will be measurement, not marketing. Fraud teams will be judged on how fast they recognise new typologies, how confidently they explain scores, and how reliably they preserve privacy while collaborating across institutions.

For practitioners

• Standardise network-derived fraud signals Map which fraud indicators can safely be consumed from external participants and which must remain locally controlled. Focus on device reputation, mule behaviour, APP patterns, and account trust signals. See the Fraud and Cyber Convergence Guide.
• Test federated learning governance Verify that raw customer data stays inside each institution’s environment while shared model updates, calibration, and exclusion controls are documented for audit and privacy review.
• Set score thresholds against real transaction volume Validate trigger points using actual payment mix and review capacity so that the scoring layer reduces noise without overwhelming analysts during peak activity.
• Align fraud and identity teams on shared signals Create a common operating model for suspicious accounts, device trust, and behavioural risk so that fraud and identity analysts act on the same evidence set.
• Measure how quickly new typologies reach live controls Track the time between a confirmed pattern appearing elsewhere in the network and its appearance in your own detections, then use that lag as a program metric.

Key takeaways

• Fraud losses are now large enough that isolated institution-level detection is structurally insufficient for high-volume financial crime.
• The article’s central evidence is that criminal networks move faster than siloed models because they reuse the same patterns across multiple institutions.
• Practitioners should focus on shared intelligence, privacy-safe collaboration, and operational explainability rather than on retraining local models in isolation.

Related NHI Mgmt Group resources: Fraud and Cyber Convergence Guide · Fraud Prevention Platform Buyer's Guide · Fraud Prevention Guide for Digital Businesses · Identity Fraud Prevention Guide

Key terms

• Fraud-As-A-Service: Fraud-as-a-service is the outsourcing of scam operations through rented tools, stolen data, and ready-made attack services. It lowers the skill needed to commit fraud and lets bad actors scale quickly across industries. For defenders, it means attacks are faster, cheaper, and more operationally organized than traditional one-off fraud attempts.
• Federated Learning: Federated Learning is a privacy-preserving machine learning method that trains models across multiple data sources without centralising the raw data. In identity security, it is attractive where sensitive records cannot be pooled easily. Its practical use in IAM remains limited because access policies, risk thresholds, and compliance needs differ widely between organisations.
• Network-Derived Intelligence: Fraud or risk intelligence built from signals observed across multiple organisations rather than from one institution’s internal history alone. It helps defenders recognise emerging patterns, coordinated actors, and repeated typologies that are invisible when each organisation looks only at its own data.
• Authorized Push Payment Scam: A scam in which a victim is manipulated into authorising a transfer to an account controlled by the attacker. Because the payment is authorised by the customer, standard fraud controls can miss it unless the detection layer understands behavioural, network, and contextual risk signals.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control design to the wider security decisions their programmes depend on.