A fraud event that begins during digital onboarding can quickly become account takeover, card abuse and mule account activity. Yet many banks still manage fraud through disconnected systems for cards, payments, digital banking, onboarding and investigations. Excessive fragmentation creates blind spots, and fraudsters exploit them. An enterprise-wide fraud strategy, including artificial intelligence (AI), helps financial institutions cut losses, improve customer experience and respond to more sophisticated threats.
Governments are shifting in the same direction. Australia is applying a whole-of-ecosystem approach through its Scams Prevention Framework (SPF). In India, security protocols, including AI-based fraud detection, vary across institutions, but the Reserve Bank of India (RBI) and financial institutions are working together more closely on anti-fraud measures and customer-awareness campaigns.
India Sounds the Alarm for Regulators, Banks and Consumers
India’s banking sector has gone through a digital transformation. The Unified Payments Interface (UPI), a real-time payment system, has made mobile wallets, internet banking, card payments and other transactions faster and more accessible. Unfortunately, rapid digitization has also given cybercriminals a wider base to exploit. Payment fraud is now one of the biggest risks for banks and customers; cases are growing in both volume and sophistication.
Several factors make India vulnerable, including traditional phishing and voice phishing, UPI spoofing, SIM swap attacks, and malware and remote access apps:
- Rapid Digital Adoption: Many people entering the digital economy are unaware of basic secure online practices.
- Instant Payments: UPI transactions happen in real time, leaving banks little time to detect and block fraudulent transfers.
- Uneven Implementation: Despite RBI guidelines, how institutions apply security protocols varies.
- Social Engineering: Fraudsters exploit trust and inexperience.
Banking and Regulatory Response
The RBI and financial institutions have taken several steps to combat payment fraud:
- Mandatory two-factor authentication for most transactions
- Transaction limits for UPI and wallet payments to reduce exposure
- AI-driven fraud detection systems that flag unusual activity
- Customer awareness campaigns, such as urging consumers not to share their one-time passwords
The RBI’s Digital Payments Security Controls framework is also pushing banks to strengthen their IT systems.
The Way Forward
Building resilience takes effort on several fronts. Banks will have to keep investing in advanced fraud detection tools. Regulators will have to enforce stricter compliance. Consumers will have to learn basic safety practices. Payment fraud is unlikely to vanish, but closer collaboration among banks, regulators, law enforcement and customers can reduce it. As India’s digital payments revolution continues, balancing innovation with security will remain the central challenge.
Australia Bolsters Defenses with the Scams Prevention Framework (SPF)
For years, Australian banks have invested heavily in fighting unauthorized fraud: cases where criminals steal card details, compromise online banking credentials or make transactions without the customer’s knowledge or consent. Fraud detection, transaction monitoring and card controls have worked well against these traditional risks.
The fastest-growing threat is now authorized push payment (APP) fraud, usually in the form of scams and money mule activity. In this case, customers themselves authorize the payment, believing they are paying a legitimate recipient. Controls that look for stolen credentials or unauthorized transactions often miss these attacks.
Impersonation scams are a common example. A criminal will pretend to be a representative of a bank, law enforcement or government agency and convince a customer that their money is at risk. The frightened victim then transfers funds to a “safe account” controlled by the scammer.
Behind many scams lies a network of money mule accounts: bank accounts used to move illicit funds, often opened with stolen identities or by recruited students and people lured by easy-money schemes. Scams need a destination account, so detecting and disrupting mule networks is critical.
Australia's New Measures
Australia introduced the SPF through legislation passed in 2025. It takes a whole-of-ecosystem approach, involving banks, telecommunications providers and digital platforms, rather than leaving responsibility to consumers. Regulated entities must take reasonable steps to prevent, detect, disrupt, respond to and report scams.
Regulated entities were required to join the Australian Financial Complaints Authority (AFCA) by September 1, 2026, and most SPF obligations take effect on March 31, 2027. Banks are now expected to show they can prevent scams and handle scam complaints.
The impact on banks will be substantial. They can no longer rely on controls designed for unauthorized activity. They must now identify scam indicators across the customer journey by monitoring behavioral anomalies, detecting mule accounts, analyzing device and network intelligence, identifying high-risk payees and intervening before suspicious payments are completed.
Penalties add urgency. Banks that fall short of SPF requirements face fines, and customers who lose money to scams can take their complaints to AFCA. That gives sending banks a reason to improve their controls and receiving banks a reason to go after money mules.
To prepare, banks should focus on five areas:
- Strengthen real-time scam detection across payments and digital channels
- Expand mule account detection using network analytics and behavioral monitoring
- Improve risk-based customer interventions, alerts and payment warnings
- Enhance cross-industry intelligence sharing with banks, telcos and digital platforms
- Establish governance, reporting and audit frameworks aligned to SPF requirements
The SPF marks a fundamental change in Australia’s approach to financial crime. Preventing scams and disrupting mule networks is now a strategic and regulatory priority for banks. Those that act early will improve compliance readiness, strengthen customer trust and reduce the growing financial and reputational cost of scams.
What India and Australia Have in Common
The two countries differ in method, but share a common conclusion: fraud is an ecosystem problem, and no single bank, channel or consumer can solve it alone. For banks, that points to the same three capabilities in any market: speed, a connected view of the customer and a single decision engine behind both.
Real-Time Intelligence Is Critical
Real-time payments have shortened the time to detect and stop fraud. By the time a batch process flags suspicious activity, the money may already have left the banking system. Banks need a platform that takes in events continuously from every channel and evaluates risk instantly, so that every customer action, from an ATM withdrawal to adding a beneficiary, feeds one enterprise-wide risk assessment. The result is earlier detection, consistent responses across channels and losses stopped before they happen.
A Single Customer Risk View
Many banks hold several risk profiles for the same customer. A customer may seem low risk in the card system and high risk in the payments platform, and because the systems rarely talk to each other in real time, warning signals get missed. A single profile pulls together account activity, card transactions, payment behavior, digital banking sessions, device intelligence, beneficiary relationships, merchant interactions and call center contacts. Every transaction then benefits from a broader context. A card authorization, for example, can weigh unusual login behavior, a suspicious new payee or a device change alongside recent card activity. Detection improves, and legitimate customers face less friction.
Why a Single Fraud Engine Matters
Banks are organized around products; fraudsters are not. Consider a common attack. A fraudster opens a mule account during onboarding with stolen identity information. The account stays dormant, then receives funds from a scam victim. The money moves through real-time payment rails, is withdrawn at ATMs or is spent on linked cards. If each stage is monitored separately, the bank may never see the whole chain. Individual events appear low risk; together they reveal a clear pattern.
A single engine lets banks correlate those signals across onboarding, digital banking, payments, cards, merchants and investigations. It also applies risk policies consistently, reveals fraud rings hidden inside individual systems, cuts the rate of false positives and lets investigators work from one queue and one case management platform.
Connected Systems and Shared Responsibility
The future of fraud mitigation lies in enterprise-wide intelligence, not channel-specific defenses. Australia now requires will now require banks to take reasonable steps against scams. India is building collaboration among government, banks and consumers. Banks that connect their own systems first will be best placed to join those wider efforts and to protect customers at every interaction.
