Fraud, Friction & Opportunity: Bypassing Reactive Controls

The UK is at an inflection point on fraud. Regulation is tightening, reimbursement obligations now carry real economic weight, and the UK National Fraud Strategy 2026-29 is pushing for a more coordinated response across sectors.

Yet the reality remains uneven. Fraud continues to scale. Customer trust is under pressure and banks still carry disproportionate responsibility for a problem that originates well beyond their perimeter.

At the centre is a structural tension. Growth depends on removing friction – faster onboarding, real-time payments, embedded journeys that disappear into the background. Fraud exploits those same features.

Measures range from the creation of a new Online Crime Centre for cross-sector data sharing through to a more coordinated national response spanning financial services, technology, telecoms, retail and law enforcement.

But the response runs the risk of leaning too heavily on controls applied too late in the journey to materially change outcomes.

The limits of reactive controls

The reimbursement requirement for authorised push payment fraud has sharpened incentives. Losses now sit more firmly with banks, forcing tighter intervention at the point of payment. The response has been predictable: more warnings, step-up authentication and interruption.

It protects balance sheets in the short-term but does little to address root cause. Customers are left navigating inconsistent journeys and, over time, become conditioned to ignore controls – the ‘moral hazard’ concern that featured strongly in the debate around a mandatory reimbursement regime.

The more fundamental shift is upstream. Fraud is now conceived, tested and scaled on social platforms, messaging services and digital marketplaces. That is where victims are engaged and trust is engineered.

Banks are the final checkpoint, not the first line of defence.

The uncomfortable truth is that these platforms remain optimised for growth and engagement.

Friction is deliberately minimised, which makes social engineering effective and pushes fraud risk downstream while the cost is absorbed elsewhere.

That model is no longer tenable. If fraud is to be reduced meaningfully, social platforms need to introduce friction earlier in the lifecycle with stronger identity controls, faster takedown of malicious content and intervention in suspicious interactions.

This requires a trade-off they have largely avoided, accepting instead some impact on engagement to materially improve user safety. Until that shifts, the system remains structurally imbalanced.

While meaningful cross-sector collaboration – encouraged within the UK National Fraud Strategy – is a step in the right direction, if the financial services sector is anything to go by, regulation will be needed to provide clarity and consistency around expectations.

Fintech’s friction problem

For fintechs, this need is immediate. Many propositions depend on seamless, low-friction experiences. When fraud controls sit almost entirely at the payment layer, those experiences become harder to sustain.

The answer is better precision rather than introducing greater friction.

Customers do not push back on meaningful intervention, rather they push back on noise.

Applied intelligently, friction reinforces trust. Applied indiscriminately, it becomes background irritation that both customers and attackers learn to bypass. This is where much of the industry still struggles.

Despite sustained investment, fraud controls across many banks remain fragmented with rules layered over time, siloed data and a reliance on investigation after the fact.

Machine learning is often present but not industrialised across the full lifecycle. Decisioning remains too slow, inconsistent and dependent on human intervention.

Closing that gap requires a step change. That means an integrated, AI-driven fraud defence operating continuously across the customer journey. Signals from onboarding, device intelligence, transaction behaviour and external ecosystems need to be combined in real time.

In practice, that means earlier identification of risk, intervention before losses crystallise and a significant reduction in manual handling. Autonomous fraud defence is becoming operational, but most institutions have not yet scaled it.

Synthetic identity fraud raises the stakes

Synthetic identity fraud highlights why this matters. These identities are constructed, not stolen, often over extended periods, designed to pass conventional checks. By the time they are used, they appear legitimate. Static controls struggle because there is no single failure point to detect.

Addressing that risk requires a deeper understanding of behaviour and networks and in particular how identities evolve, how they connect and where patterns diverge over time. It also requires more fluid data sharing across institutions and sectors. 

There is also a global comparison. The UK positions itself as a leader, particularly given its stance on reimbursement. But innovation is progressing quickly elsewhere.

Markets such as India and Brazil are building integrated ecosystems with real-time payments, digital identity and fraud controls designed together. Their advantage is coherence, solving at system level rather than layering controls onto legacy environments.

The aim of the UK’s National Payments Vision is to put UK retail payments infrastructure on a similar footing as part of the Government’s growth and investment agenda, but time is not on the UK’s side particularly given the pace of innovation we are seeing globally.

The UK therefore starts from a more complex base. That makes execution harder, but also more urgent.

Tightening controls within banks alone will not change the trajectory. Prevention must move earlier in the value chain and responsibility has to be more evenly distributed.

Fraud is becoming more industrialised, reimbursement is anchoring cost within financial services, and regulation is pushing for broader accountability. The strategy sets direction – delivery now depends on whether the ecosystem responds as a system. First movers will not just reduce losses.

They will define what trusted growth looks like in a market where speed and safety have to coexist.