Fraud and financial crime · RiskAtoms Academy

By the end you will be able to

1Tell internal from external fraud, and find each in the bank's loss data and controls.
2Explain APP scams and the UK reimbursement rules, money laundering, and sanctions screening.
3Use Bayes' rule to show why most fraud and AML alerts are false positives, and what a second check does.
4Set a screening threshold by weighing missed fraud against the cost of alerts, and say what the sum leaves out.

Why it matters

RiskAtoms Bank's payment screen catches 82% of scam payments and holds only 0.5% of genuine ones. That sounds sharp. Yet of the 2,015 payments it holds each day, about 16 are scams: 0.8%. The other 1,999 are customers paying a builder or a friend, waiting for an analyst to call. Financial crime controls live with this arithmetic every day.

Core explanation

Crime against the bank, and crime through it

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025: 1,107 records of losses of £10,000 or more and near misses over 2016–2025 (£240.5m of net operational losses), an RCSA of 17 key risks and 29 controls, ten key risk indicators, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.

Fraud and financial crime are two of the bank's own risk categories. Ten years of fraud: 298 losses, £17.5m net. Financial crime: 17 losses, £28.1m, almost all of it one fine.

Fraud is crime against the bank or its customers: someone takes money by deception. Financial crime in the bank's taxonomy is crime that runs through the bank: laundering, sanctions evasion, bribery. The bank loses when its controls fail and a regulator fines it. Both are operational risk (L3.7.01: What operational risk is), and both are fought with the control toolkit of L3.7.04: Controls: design, testing and assurance.

Internal and external fraud

Basel separates fraud by who commits it. Internal fraud involves at least one insider: in the book 13 events for £8.8m net. External fraud is by outsiders: 370 events for £16.8m. External fraud is frequent and small; internal fraud is rare and large, because an insider knows where the controls are thin. A third group sits on the boundary: 41 loans obtained with false documents, £7.3m in all, are recorded but reported as credit losses (L3.7.03: Loss data).

The dormant-account fraud: how did it last about 31 months?

APP scams and who pays

In an authorised push payment scam the customer sends the money themselves, to a criminal posing as someone else. The money lands in a mule account and moves on within minutes. For years victims bore most of the loss. Since 7 October 2024 the UK's Payment Systems Regulator (PSR) has required payment firms to reimburse Faster Payments scam victims, and the Bank of England applies the same to CHAPS:

up to £85,000 a claim (the PSR had first set £415,000);
the sending and receiving firms split the cost 50:50;
the sending firm may deduct an excess of up to £100, but not for vulnerable customers;
most claims are paid within 5 business days (35 if the firm stops the clock to gather information); customers have 13 months to claim;
a customer who is grossly negligent may be refused, and the firm must prove it.

Public dataThe first nine months, PSR, 8 October 2025

From 7 October 2024 to 30 June 2025 firms reimbursed £112m: 88% of the money lost and claimed, against 66% a year earlier. There were about 126,000 claims, and 84% were settled within five business days.

At RiskAtoms Bank, APP fraud against customers is a key risk with an inherent score of 15. It falls to 8 after confirmation of payee, real-time scoring and analyst review. Most scam payments are small: only 57 reimbursements of £10,000 or more appear one by one in the loss data, £1.64m in ten years. The rest sit below the collection threshold.

Money laundering and sanctions

Money laundering turns criminal money into money that looks clean. A bank's defences follow the FATF's 40 Recommendations, the global standard, and in the UK the Money Laundering Regulations 2017:

customer due diligence at onboarding and throughout, with enhanced checks for higher-risk customers;
transaction monitoring for patterns that do not fit the customer;
suspicious activity reports to the National Crime Agency.

Sanctions screening checks every customer and payment against lists of designated people. The bank's Money Laundering Reporting Officer owns this risk: inherent 12, residual 6. Its history shows why. The bank's £26.5m fine for failings in onboarding business customers from 2016 is 94% of its financial crime losses. The failings came to light 4.9 years after they began, and the fine was booked 842 days after that (L3.7.13: Legal, compliance and regulatory risk follows it through). Eleven sanctions screening misses settled with the regulator add £1.05m.

Sort itFraud, laundering or sanctions?

Sort each case by the risk it belongs to.

A branch manager approves loans to a company owned by their partner, which never repays.
A caller posing as the bank's fraud team persuades a customer to move savings to a 'safe account'.
A car wash pays in far more cash than a business its size takes, then wires it to a property company.
A payment to a shipping firm is released although its owner was added to the UK list last week.
A student lets a stranger use their account for a fee; £40,000 of scam proceeds pass through it.

Alert funnels and false positives

Every screen works the same way: a rule or a model scores each customer or payment, and anything above a threshold becomes an alert for a person to review. Because real cases are rare, most alerts are false positives. The bank's monthly AML funnel on its business accounts:

Extra for this lessonThe AML monitoring funnel, one month (illustrative)

Stage	Count
Transactions monitored Every payment in and out of 60,000 business accounts	2,000,000
Alerts A scenario rule fires: cash just under a reporting level, rapid in-and-out, a new high-risk country	8,000
Cases An analyst cannot close the alert from the customer's profile and opens a case	800
Suspicious activity reports The investigator suspects laundering and reports to the National Crime Agency	240

97% of alerts end without a report. That is not waste in itself: the threshold is set low on purpose, because a missed launderer costs far more than an analyst's hour. But the volume is a cost, and a team that clears thousands of false alerts can miss the real one.

The formal version

Write $\pi$ for the base rate (the share of payments that are scams), $h$ for the hit rate $P(\text{alert}\mid\text{scam})$ and $f$ for the false-alarm rate $P(\text{alert}\mid\text{genuine})$ . Bayes' rule (M-C12: Conditional probability and Bayes' rule) gives the precision of an alert, and the odds form shows what a second, independent check adds:

\begin{aligned} P(\text{scam}\mid\text{alert}) &= \frac{h\,\pi}{h\,\pi + f\,(1-\pi)} \\[4pt] \underbrace{\frac{P(\text{scam}\mid\text{alerts})}{P(\text{genuine}\mid\text{alerts})}}_{\text{posterior odds}} &= \underbrace{\frac{\pi}{1-\pi}}_{\text{prior odds}} \times \underbrace{\frac{h_1}{f_1}}_{LR_1} \times \underbrace{\frac{h_2}{f_2}}_{LR_2} \end{aligned}

The screen gives each payment a score. Genuine scores follow a standard normal; scam scores a normal with mean $d$ . A threshold $t$ sets both rates, so lowering it raises $h$ and $f$ together. With $N$ payments a day, an average scam $\bar s$ , a cost $c$ per alert and the bank's share $\alpha$ of reimbursements:

\begin{aligned} h(t) &= 1 - \Phi(t - d), \qquad f(t) = 1 - \Phi(t) \\ \text{Alerts}(t) &= N\big[h(t)\,\pi + f(t)\,(1-\pi)\big] \\ \text{Cost}(t) &= 365\Big[c \cdot \text{Alerts}(t) + \alpha\,\bar s\, N\pi\,\big(1 - h(t)\big)\Big] \end{aligned}

At the bank, $\pi = 1/20{,}000$ , $d = 3.5$ and $t = 2.576$ :

\begin{aligned} h &= 1 - \Phi(-0.924) = 0.8223, \qquad f = 1 - \Phi(2.576) = 0.0050 \\ P(\text{scam}\mid\text{alert}) &= \frac{0.8223 \times 0.00005}{0.8223 \times 0.00005 + 0.0050 \times 0.99995} = 0.82\% \\ \text{odds after a call-back} &= 0.000050 \times 164.5 \times 18 = 0.1481 \;\Rightarrow\; P = 12.9\% \end{aligned}

Try it

Move the threshold on the bank's payment screen, and change how rare scams are. Watch the share of held payments that are really scams, the analysts it takes, and the yearly cost.

Try itSet the threshold on the payment fraud screen

Hold payments scoring above2.58 sd

Scam payments

Payments a day

400,000

Of which scams

20.0

Held for review

2,015

Held and a scam

16.4

Bar lengths on a log scale: each step is ten times smaller.

P(scam | held)0.82%

Scams stopped82.2%

Genuine payments held0.500%

Payments held a day2,015

Analysts needed34

Scams missed a day3.6

Cost of reviews, a year£2.94m

Bank's half of reimbursements£0.97m

Total, a year£3.92m

Customers' scam losses reimbursed£1.95m

Lower the threshold and you stop more scams, but the held payments grow tenfold and nearly all of them are genuine customers waiting. Make scams rarer and the same screen's alerts become even less likely to be scams: that is the base rate at work. Illustrative figures: 400,000 payments a day, an average scam of £1,500, £4 to review an alert and 60 alerts per analyst a day.

Worked example

Where to set the payment screen

Extra for this lessonThe real-time payment screen (illustrative)

400,000 outbound personal Faster Payments a day, one in 20,000 a scam, an average scam of £1,500. Reviewing an alert costs £4 in analyst time and customer friction; an analyst clears 60 a day.

The fraud committee's paper

Step 1 of 5

1
A day's payments
400,000 payments, of which 20 are scams on an average day. At a threshold of 2.576, the screen holds 2,015: 16.4 scams and 1,999 genuine payments.

Payments

400,000

Scams

20.0

Held

2,015

Held scams

16.4

Bar lengths on a log scale: each step is ten times smaller.

What the risk team notes

A screen's hit rate and false-alarm rate say little on their own. Precision depends on the base rate, and the threshold is a business decision with customers on both sides of it: the scam victim and the genuine customer whose payment waits.

Regulatory lens

APP fraud. The PSR's reimbursement requirement (policy statement PS24/7 set the £85,000 limit) applies from 7 October 2024; the PSR publishes performance data, and an independent review of the policy was published in July 2026.
Money laundering. The FATF Recommendations set the global standard; the UK applies them in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, with customer due diligence in Part 3.
Sanctions. OFSI can impose civil penalties on a strict liability basis since 15 June 2022, up to the greater of £1m and half the value of the breach.
Fraud by the firm's people. Since 1 September 2025 a large organisation commits an offence if an employee or agent commits fraud to benefit it, unless it had reasonable procedures to prevent it (Economic Crime and Corporate Transparency Act 2023).

Fraud and AML fines count as operational risk losses, so they feed the loss component of the capital charge in M4.4: Counterparty, operational and large exposures.

Spark Atoms

Spark AtomThe first criminal case under the regulations

On 13 December 2021 NatWest was fined £264.8m at Southwark Crown Court for failing to comply with the Money Laundering Regulations 2007, the FCA's first criminal prosecution under them. A single business customer had deposited about £365m, about £264m of it in cash. A guilty plea cut the fine by a third, from £397.2m.

Spark AtomScreening against part of the list

The FCA fined Starling Bank £28,959,426 in October 2024. Since 2017 its automated sanctions screening had checked customers against only a fraction of the full list, while customers grew from about 43,000 to 3.6 million. It also opened more than 54,000 accounts for 49,000 high-risk customers despite an agreed restriction. L3.7.13: Legal, compliance and regulatory risk takes the fine apart step by step.

Key takeaways

Internal fraud is rare and large because insiders know the gaps (the dormant-account fraud ran about 31 months); external fraud is frequent and small.
UK APP scam victims are reimbursed up to £85,000 since 7 October 2024, the cost split 50:50 between the sending and receiving firms.
Laundering and sanctions controls rest on customer due diligence, monitoring, reporting and screening; failures are fined, and sanctions breaches are strict liability.
Rare cases make most alerts false: the bank's screen holds 2,015 payments a day and 0.8% of them are scams. A second, independent check multiplies the odds.
The threshold trades missed fraud against alert volume; the cheapest setting is not automatically the right one when customers bear harm the sum leaves out.

Reaction

Check what stuck

Question 1 · objective 3

One transaction in 10,000 is fraud. A screen flags 90% of frauds and 1% of genuine transactions. What is the probability that a flagged transaction is fraud, in %?

%

Question 2 · objective 1

The dormant-account fraud cost £7.6m gross. Insurance paid £3.0m and £0.9m was recovered from the fraudster's accounts. What is the net loss, in £m?

£m

Question 3 · objective 2

Under the UK rules, RiskAtoms Bank reimburses a customer £6,000 lost to an APP scam paid into a mule account at another bank. How much does the receiving bank pay towards it, in £?

£

Question 4 · objective 2

A criminal pays cash from drug sales into a shop's account, then wires it through three companies abroad. Which stage of laundering is the wiring?

APlacementBLayeringCIntegrationDStructuring

Question 5 · objective 2

A firm makes a £600,000 payment to a designated person by mistake. What is the most OFSI could fine it, in £?

£

Glossary

APP scam: Authorised push payment (APP) scam: the customer is tricked into sending a payment themselves, for example to someone posing as their bank, a builder or a romantic partner. The payment is authorised, so it is not card fraud.
Money mule: Money mule: an account holder who lets criminals move stolen money through their account, knowingly or not.
Money laundering: Money laundering: making the proceeds of crime look legitimate, usually in three stages: placement into the financial system, layering through transfers that hide the trail, and integration back into the legal economy.
Customer due diligence: Customer due diligence (CDD): checking who a customer is, who owns or controls them and what the account is for, before and during the relationship. Enhanced due diligence (EDD) applies to higher-risk customers, such as politically exposed persons.
Suspicious activity report: Suspicious activity report (SAR): a report to the National Crime Agency when a firm knows or suspects money laundering. The firm must not tip the customer off.
Financial sanctions: Financial sanctions: legal restrictions on dealing with named people, firms or countries, such as freezing their funds. In the UK, HM Treasury's Office of Financial Sanctions Implementation (OFSI) enforces them.
False positive: False positive: an alert on something genuine. In fraud and AML screening most alerts are false positives, because the real cases are so rare.
Precision: Precision: the share of alerts that turn out to be real cases, P(fraud | alert). Bayes' rule gives it from the hit rate, the false-alarm rate and the base rate.
Segregation of duties: Segregation of duties: splitting a task so that no one person can both make and approve a change, for example to a dormant account.

Deep Dives & Origins

Deep Dives

Payment Systems Regulator, One year on: impact of APP reimbursement on victims, 8 October 2025. Introductory.
Financial Action Task Force, The FATF Recommendations, 2012, as amended. Advanced.
Financial Conduct Authority, Final Notice: Starling Bank Limited, 2024. Intermediate.

Origins

Payment Systems Regulator, One year on: impact of APP reimbursement on victims, news release, 8 October 2025.
Payment Systems Regulator, policy statement PS24/7 on the maximum level of reimbursement, 3 October 2024, as summarised by Regulation Tomorrow (Norton Rose Fulbright); Osborne Clarke, Mandatory reimbursement for UK authorised push payment fraud: the countdown is on, 6 September 2024; Plenitude Consulting, New APP fraud reimbursement rules in force from 7th October, 4 October 2024.
Regulation Tomorrow (Norton Rose Fulbright), Payment fraud falls by £73m following PSR reimbursement scheme, 1 July 2026, on the PSR's independent review.
Financial Action Task Force, The FATF Recommendations, adopted 2012, as amended.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, SI 2017/692, legislation.gov.uk.
UK Finance, Strict liability fines for inadvertent sanctions breaches, 6 June 2022.
Financial Conduct Authority, NatWest fined £264.8 million for anti-money laundering failures, 13 December 2021.
Financial Conduct Authority, FCA fines Starling Bank £29m for failings in their financial crime systems and controls, 2 October 2024, and the Final Notice.
Crown Prosecution Service, Organisations must prepare now for new fraud prevention law, 18 August 2025.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.