Topic starter
12/06/2026 9:54 pm
TL;DR: Banks are facing more coordinated cybercrime, cheaper phishing services, API exposure gaps and faster fraud paths through real-time payments, according to Arkose Labs and Datos Insights. The message for IAM teams is that detection and progressive proofing must move earlier in the flow, before attackers turn small openings into customer loss and operational damage.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Defending the Enterprise: New Insights from Banking Industry Experts on Fraud and Cyber Threats”.
By the numbers:
- 59% of financial institutions are still in the dark about their API exposure, according to Arkose Labs.
Key questions
Q: What breaks when banks only detect fraud after a transaction is underway?
A: Post-transaction detection breaks when attackers can move from phishing or account takeover to money movement faster than analysts can react.
Q: Why do hidden APIs create fraud and access risk for financial institutions?
A: Hidden APIs expand the attack surface because teams cannot secure or monitor what they have not inventoried.
Q: How do banks know if progressive proofing is working?
A: Progressive proofing is working when risky sessions are challenged early, suspicious registrations are slowed or stopped, and fewer fraudulent events reach the transaction stage.
Practitioner guidance
- Implement progressive proofing at login and registration Add risk checks before a session is trusted, not only after a payment is initiated.
- Inventory exposed APIs across customer journeys Create and maintain a complete API inventory that includes mission-to-mission, process-to-process and customer-facing endpoints.
- Tune fraud controls for cybercrime-as-a-service scale Assume phishing kits, reverse-proxy tools and automated takeover attempts will arrive at subscription scale.
Bottom line: Banks are dealing with fraud patterns that move faster than traditional after-the-fact monitoring can contain.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
13/06/2026 12:18 am
Proactive detection is now a fraud control, not just a security control. Banking fraud has moved far enough upstream that waiting for post-transaction review is structurally too late. When attackers can buy phishing capability, automate account takeover and reach exposed APIs, the control point has to move toward login and registration decisions. For practitioners, that means fraud, IAM and application security can no longer operate as separate queues.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should fraud teams prioritise login controls or transaction monitoring first?
A: Fraud teams should prioritise the earliest control point that can reliably stop abuse in their environment. If attackers are using phishing, automation or exposed APIs to reach accounts quickly, login and registration controls usually deserve more weight than transaction-only monitoring because they shorten the path to loss.
👉 Read our full editorial: Proactive detection is becoming essential in banking fraud defence
This post was modified 3 days ago by NHI Mgmt Group