Organisations should combine layered identity verification, real time fraud detection, and step up controls that activate only when risk increases. The goal is to protect transfers, card payments, and account changes without slowing trusted users unnecessarily. Effective programmes balance speed, cost, and security by using automated checks, clear rules, and continuous monitoring of suspicious behaviour.
Balancing customer experience with fraud controls
Digital money movement has to be protected at the point where trust is created, not after a payment is already irreversible. That means organisations should treat payment initiation, beneficiary changes, password resets, and device enrolment as higher-risk moments, while keeping routine low-risk activity fast and unobtrusive. The practical objective is not maximum friction, but proportionate friction.
Good programmes separate the payment rail from the risk decision. A low-value transfer from a familiar device may need only passive checks, while a new payee, unusual amount, or changed session context can justify stronger verification. NHI Mgmt Group’s Ultimate Guide to NHIs is useful here because it shows how overprivilege, stale secrets, and weak lifecycle control expand the blast radius when automated payment services or backend credentials are abused.
The key trade-off is that every extra challenge protects against some fraud, but also increases abandonment, call-centre volume, and customer frustration. Organisations that keep applying the same control to every transaction usually end up either overblocking legitimate users or underprotecting high-risk flows. The better pattern is to reserve harder checks for situations where risk has materially changed.
Controls that increase only when risk increases
The most effective control stack is layered and conditional. Combine identity verification, device and behavioural signals, transaction rules, and real-time detection so that no single signal decides the outcome. Step-up controls should be triggered by anomalies such as first-time beneficiaries, impossible travel, account takeover indicators, high-value transfers, or atypical payment velocity.
That approach works best when the decisioning engine is tuned to the business context. For example, merchants, banks, and fintech platforms often need different thresholds for card-not-present activity, internal account changes, and outward transfers. MITRE ATT&CK Enterprise Matrix is a strong reference for understanding the attacker behaviours behind credential abuse, privilege escalation, and lateral movement, while NIST Cybersecurity Framework 2.0 helps structure the broader govern, protect, detect, respond, and recover lifecycle around these controls.
Practitioners should also avoid treating step-up as a one-time design choice. Thresholds drift, fraud patterns change, and genuine customer behaviour evolves. If the control cannot be reviewed against measurable false-positive and false-negative rates, it becomes a policy statement rather than an operational defence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Money movement controls need risk-based decisioning that balances fraud reduction and customer friction. |
| PR.AC-7 — Identity Management, Authentication, and Access Control | Secure payment flows rely on strong identity checks for transfers and account changes. | |
| DE.CM-01 — Continuous Monitoring | Real-time fraud detection depends on ongoing monitoring of anomalous behaviour and transaction patterns. | |
| Recommendation — Define risk thresholds that trigger step-up checks only when transaction context materially changes. Apply adaptive authentication to strengthen verification for high-risk money movement events. Monitor payment activity continuously and alert on anomalies that indicate fraud or account takeover. | ||
| CIS Controls v8 | 6.3 — Require MFA for Externally-Exposed Applications | Customer-facing financial flows need stronger authentication at exposed entry points. |
| 6.8 — Unwanted Software and Code Execution Protections | Fraud often begins with account compromise or malicious automation that abuses digital payment workflows. | |
| Recommendation — Require MFA or equivalent step-up for high-risk customer-facing account actions. Block abusive automation and suspicious execution paths that enable payment fraud at scale. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Payment fraud frequently uses stolen or abused legitimate accounts to move money. |
| Recommendation — Hunt for valid-account abuse when transaction patterns change without obvious technical anomalies. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Automated payment services and backend integrations depend on secrets that must not become a fraud entry point. |
| Recommendation — Rotate and protect payment-service secrets to reduce abuse of backend transaction paths. | ||
Practitioner Guidance
What to prioritise: Protect the actions that change financial exposure first, especially adding a beneficiary, changing contact details, resetting access, and initiating an outbound transfer. Those are the points where fraud prevention delivers the highest value for the least customer friction.
What to verify: Confirm that step-up rules are tied to observable risk signals, not static assumptions. If the same challenge fires for every user and every amount, the organisation is paying friction everywhere and getting weak risk discrimination in return.
What good looks like: Trusted customers move quickly through low-risk flows, while suspicious sessions are slowed only when the evidence justifies it. The control should feel invisible when risk is normal and noticeably stronger when the transaction context changes.
Practitioner takeaway: The best fraud control is the one customers rarely notice, because it is triggered by context, not by habit; the objective is to make high-risk actions expensive for attackers and nearly frictionless for everyone else.
Related resources from NHI Mgmt Group
- How should travel businesses reduce booking fraud without creating too much friction for legitimate customers?
- How should organisations verify identity documents without creating too much friction?
- How should healthcare teams secure patient portal access without creating too much friction?
- How should organisations verify vendor payment changes without creating too much friction?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
