Invited by the Dataconomy editorial team, Alexandra Tsoy shares a practitioner’s perspective on how fraud intelligence must be embedded directly into product and user experiences rather than treated as a back-office control.
Alexandra is a FinTech executive and Head of Product & Services at a global platform, where she leads product strategy at the intersection of payments, risk, and UX. She works closely with engineering, data, and compliance teams to design automated fraud systems that protect revenue while preserving conversion and customer trust.
With more than 14 years of executive leadership experience, Alexandra brings a cross-industry, operator-led perspective to risk and product design, shaped by building and scaling businesses in highly regulated, transaction-intensive environments. Her approach is informed not only by theory but by real-world trade-offs between growth, security, and user friction.
Introduction
Fintech platforms are now locked in a continuous arms race with fraudsters, and the gap closes faster every year. Every time you make a digital payment or do anything with your account, complex internal assessment systems are triggered, leveraging data from around the world. Advanced fraud detection systems now analyse transactions and user behaviour in real time, operating quietly between the user interface and core systems. For example, Stripe’s Radar system analyses thousands of signals for each payment to balance approval rates with fraud levels. Global networks like Visa’s Advanced Authorisation evaluate every transaction (scanning over 500 attributes), preventing $26 billion in fraud annually. Embedding these systems directly into the product and user experience is crucial. This makes fraud checks invisible yet effective, protecting revenue and user trust without slowing growth.
Embedding fraud analytics into the user experience means baking risk checks into every major product flow. In practice this includes adaptive onboarding, step-up authentication in checkouts or transfers, and in-app alerts for suspicious activity. Firms must strike a fine balance: heavy-handed blocks frustrate legitimate users, while lenient rules risk fraud losses. Such approach is ultimately a product decision, not just a risk one. In parctice, the most resilient platforms use a layered “Swiss cheese” defence, integrating digital identity (KYC/KYB), device fingerprinting, behaviour analytics, and business rules into one automated pipeline. For instance, new account opening can trigger instant identity verification and fraud screening alongside a seamless user journey. During payments, risk-based authentication (e.g., biometric or push-based 2FA) steps in only when ML models flag unusual patterns. This approach was famously employed by Adyen: its risk engine dynamically challenges transactions that deviate from a user’s history, yet lets familiar payments pass to boost approval rates. By optimising in this way, Adyen reportedly increased merchant authorisation rates by ~6% while keeping fraud rates stable. Similarly, neobank Revolut built an AI-driven scam detector that automatically intercepts likely APP fraud attempts and routes users into an in-app warning flow, reducing scam losses by 30% without broadly blocking crypto or investment payments. In short, the user experience must be designed for trust: clear messaging and personalised prompts (e.g., “We flagged this event as unusual because…”), along with easy dispute or review paths, keep users informed rather than alienated.
What about automation?
Behind the user interface lie fraud detection systems that evaluate every click. Integrating these systems into business processes allows platforms to act in real time, rather than waiting for time to pass.
The underlying technology is largely automated. Machine learning models process global transaction data, device fingerprints, geolocation, behavioural history, dark web signals, and more to assess risk with sub-second latency. Stripe, for example, continuously retrains its Radar neural models on its extensive network, improving accuracy as the data volume grows. Visa’s risk assessment system processes 65,000 transaction assessments per second, using two years of history. Many platforms provide access to risk assessments via APIs, allowing development teams to create custom rules or automated workflows. It’s crucial that fraud teams have access to the model’s logic: Stripe invests in explicable outputs so merchants understand why a payment was declined. In practice, this means UX/UI elements, pop-ups, tooltips, or dashboards that provide context for flagged transactions, allowing legitimate users to retry or verify the payment rather than abandoning it out of frustration.
Automation also streamlines operations, which is crucial for businesses today. Manual review doesn’t scale with millions of users; instead, AI flags the most risky cases, while trusted transactions are processed automatically. Best practices include continuous feedback loops: fraud analysts analyse flagged cases to identify new patterns and feed this data back into models and rules. Teams can use rule systems or low-code platforms to allow non-engineers to quickly adjust thresholds and policies, which is necessary as fraudsters change tactics. As one fraud consultant put it, modern fraud monitoring is a continuous learning machine, integrating every confirmed fraud or false positive back into the detection logic.
Alignment with business goals is essential. Fraud prevention isn’t just a compliance expense; it must support growth while protecting revenue and brand reputation. This is achieved through cross-functional collaboration. Product managers, engineers, risk analysts, and executives must align key metrics (e.g., false positive targets versus fraud rates) and regularly analyse the results. Executives’ risk appetite often influences the tradeoff between credit card costs and protection; creating dashboards illustrating the impact of a rule on approved sales can help balance security and conversion. The “Neobank 3.0” thesis emphasises the need to overcome silos: “Technical leaders are calling for deeper integration between data science, engineering, and product development teams, removing traditional barriers and enabling continuous learning and rapid iteration.” For example, a data science team might fine-tune a fraud detection model, but the development team must implement corresponding changes to the user interface, and the operations team must process new alerts.
Key product-design principles: in order to embed fraud intelligence, teams should:
- Design each flow with risk in mind: e.g., include hidden checks during login or payment, and step-up MFA only when needed.
- Give users clear signals: explain automated decisions in the UI to maintain trust (e.g. “We paused this payment for security checks”).
- Customise per user: use each user’s profile and history to personalise alerts and thresholds, for instance, biometry prompts only on atypical transactions.
- Make policies adaptable: use rule engines and ML feedback so teams can tweak detection rules quickly in response to new fraud trends.
The regulatory context also influences the operation of fraud protection systems. In the EU, the Payment Services Directive (PSD2) mandates the use of strong customer authentication (SCA) for most online payments (requiring two independent factors), specifically to reduce fraud. Compliant companies must implement 3D Secure 2.0 or similar flows that directly interact with the user interface (e.g., requiring additional consent or fingerprint verification). The EU Anti-Money Laundering Directives (4/5AMLD) similarly require risk-based monitoring, KYC/KYB checks, and suspicious activity reporting throughout the customer lifecycle. GDPR also limits the processing of behavioural data, requiring explicit user consent and secure storage of fraud-related data. In the United States, there is no uniform law requiring enhanced customer authentication. Instead, financial institutions follow a risk-based approach, consistent with laws such as the Bank Secrecy Act (BSA) and the USA PATRIOT Act. FinCEN regulations require robust anti-money laundering programmes, which include collecting customer identification data, monitoring transactions, and filing suspicious activity reports related to financial crimes. US regulators (e.g., the CFPB) also protect consumers from liability for fraud (e.g., Regulation E regarding not authorised charges), indirectly pressuring companies to prevent fraud to avoid chargebacks. Financial institutions must stay abreast of evolving regulations (e.g., state-level cybersecurity standards) and often collaborate with law enforcement agencies or industry groups to share information on fraud trends.
In the Asia-Pacific region, regulatory regimes vary by country. For example, Singapore’s Payment Services Act (2019) includes obligations to combat money laundering and terrorist financing, requires the licensing of digital payment providers, and contains MAS fraud risk management guidelines.
The Hong Kong Monetary Authority similarly enforces the Anti-Money Laundering Act and publishes cyber fraud guidance. Australia’s AUSTRAC (Anti-Money Laundering and Counter-Terrorist Financing Act) imposes strict identity verification and transaction monitoring requirements. As noted in one industry guide, MAS and HKMA are very active in engaging with fintech companies and may even require access to real-time transaction data. Thereby, global platforms need to create fraud protection systems that follow different regional rules, like using multi-factor authentication to meet strict ID checks in the EU and Singapore and having strong KYC processes to follow anti-money laundering laws in the US and Asia-Pacific.
Real-world implementations
Stripe Radar (Payments). Stripe’s built-in fraud engine is a canonical case of product-integrated fraud intelligence. Radar automatically analyses every card payment against a machine-learning model trained on Stripe’s entire merchant network. It inspects 1,000+ features (e.g. card brand, billing-country consistency, IP-to-physical-location) in milliseconds. Legitimate payments pass silently; risky ones can be automatically blocked or held for review. Crucially, Radar reports a risk score back to the merchant console and API, allowing developers to set custom rules or webhooks based on that score. Stripe cites a false-positive rate of only ~0.1% while still blocking most fraud attempts. The product includes tools for merchants to understand declines (“Explainable Radar”), so teams can adjust policies if needed. For example, a merchant might whitelist a trusted country if Radar is erroneously declining those sales. Stripe’s approach exemplifies automation with transparency: the model does heavy lifting, but the user-facing system remains understandable to operations teams.
Visa Advanced Authorisation (Card Networks). At the network/issuer level, Visa’s Advanced Authorisation (VAA) provides a real-time risk score on every Visa transaction. VAA leverages VisaNet’s vast data: it reviews 500+ fraud signals (including account history and device data) and taps Visa’s global intelligence. According to Visa, advanced authorisation blocks an estimated $26 billion in annual fraud across 160 billion transactions. Banks implement VAA to augment their fraud control: low-risk transactions flow normally, while high-risk ones can be declined with authorisation or routed through 3DS. One EU bank case study noted that adopting VAA “immediately realised increased fraud detection” (especially on low-value transactions) without raising false positives. The implementation of VAA also led to a reduction in chargebacks, as it prevented more fraud in real time. For product teams, the results translates to fewer retroactive investigations and more confidence to approve legitimate payments. Visa’s system underscores how shared network intelligence benefits individual platforms: any insights from VisaNet accrue to all issuers.
Conclusion
Integrating fraud analytics into products and user experience (UX) is a strategic imperative today. The most forward-thinking fintechs and e-commerce platforms are creating automated risk decision-making layers beneath the UX, combining AI models with real-time user interactions. This approach brings numerous benefits: reduced fraud losses, increased customer trust (through transparent and intelligent checks), and reduced operational costs as manual checks are reduced. Achieving this requires close coordination: engineering and data analytics teams must be aligned with product managers and compliance, and fraud strategies must be directly linked to business goals (e.g., revenue, growth, or compliance metrics). Finally, global platforms must design systems that are flexible enough to comply with regional regulations—from mandatory two-factor authentication (2FA) in Europe under PSD2 to the diverse anti-money laundering laws in Asia and the US. In practice, companies use solutions like Stripe Radar or Visa VAA as building blocks and complement them with their own analytics (as Revolut has done). As one expert notes, “Fraud prevention is not only about blocking unscrupulous market participants but also about ensuring legitimate customers can conduct transactions without hindrance.” When implemented correctly, an anti-fraud system becomes a competitive advantage: it protects the business and ensures unimpeded growth.
