11/14/2026

How Banks Can Spot Scams That Pass Authentication

PYMNTS

A bank can authenticate the person making a payment and still send money exactly where a criminal wants it to go.

“It doesn’t matter how sophisticated your authentication protocol is, if it’s actually me [the legitimate customer] who’s trying to initiate the payment,” Stephen Bowe, chief product officer at Paymentology, told PYMNTS.

The exposure has grown as criminals adapt to protections designed to stop unauthorized transactions. Biometrics, chip and PIN cards and additional authentication have made stolen credentials harder to exploit. Fraudsters have responded by persuading legitimate customers to approve payments and by constructing identities that financial institutions accept as genuine.

In the first case, the customer supplies the authorization. In the second, the deception begins before the institution establishes who its customer is.

Artificial intelligence assists both approaches. Bowe described false digital identities assembled from information drawn from multiple sources, with some remaining undetected for extended periods before criminals put them to use. Remote onboarding adds to the difficulty of assessing the person behind the application.

“It makes it easier to impersonate genuine customers,” he said.