No bank can solve this alone - so why are we still grading them like they can?

A bank can build the best fraud model in the world and still lose to a scam that began on a platform it does not own, travelled through a telecommunications network it does not control, and involved an identity it may never have seen until the money was already moving.

So here is the question that sits underneath much of the current debate about fraud liability: if the scam journey crosses multiple industries, why does responsibility still fall so heavily on the institution at the point where the payment happens?

This is the third and final instalment of our exploration of how financial institutions are approaching fraud. In the first article, we questioned whether the industry's favourite scorecards tell us which banks are preventing fraud effectively, or merely which ones are reimbursing its consequences. In the second, we followed the customer through the fraud journey and looked more closely at the signals, technology, and human intervention that can help interrupt a scam before the payment is completed.

This final part widens the frame again. Because once you map the journey far enough upstream, one thing becomes difficult to ignore: the bank is often only one actor in a much larger chain. Fraud can originate on social media, through telecommunications networks, via compromised identities or digital platforms, and only eventually reach the financial system.

Naming who profits from doing nothing

John Erik Setsaas puts the problem particularly bluntly. Social media platforms, he argues, can make money from the very information and content through which scams are propagated, while having comparatively little direct incentive to prevent that activity. ‘The SoMe are actually making money on spreading information about fraud, so they don't have any incentives to stop doing this.’

It is an uncomfortable argument, precisely because it moves the conversation away from whether banks could have stopped the payment and towards a more fundamental question: who had an opportunity to stop the scam before the bank ever saw it?

A fraudulent payment may be the final observable event, but it is rarely the beginning of the fraud. A victim may have encountered a fake investment opportunity through an advertisement, been contacted through a social platform, received a convincing message through a telecom network, or been manipulated over weeks or months before eventually being instructed to transfer money. By the time the transaction reaches a bank's systems, several other intervention opportunities may already have passed.

That creates a problem with the way liability is currently designed. The institution closest to the money is often the institution with the clearest regulatory obligation to act, even when it is not the institution that created - or was best placed to disrupt - the conditions in which the scam began. That brings us to one of the most interesting differences between markets.

Different countries are experimenting with who should carry the risk

The international picture is far from uniform. In fact, conversations with fraud experts for this series repeatedly returned to the same handful of markets - not because any of them has solved scams, but because they are experimenting with different ways of allocating responsibility across the fraud ecosystem.

The UK has made genuine progress, particularly in reimbursement and consumer protection. But its model remains heavily weighted towards the banking sector. That creates a powerful incentive for banks to strengthen detection and intervention, but a weaker direct incentive for platforms and telecommunications providers to prevent scams from reaching consumers in the first place. The unintended consequence is worth considering: banks can end up becoming the financial backstop for criminal activity that originates outside the financial system. The approach may improve the bank's behaviour, but it does not necessarily change the behaviour of every other actor through which the scam travels.

Australia is taking a different direction, with a broader ‘polluter pays’ philosophy that can extend responsibility beyond financial institutions to other participants in the scam ecosystem, including technology and telecommunications companies. The important point is not that Australia has discovered a perfect model - it has not - but that its regulatory architecture recognises something the traditional bank-centric model struggles with: where the risk is created and where the loss is ultimately absorbed do not always have to be the same place.

Singapore offers another interesting lesson. Its approach has been heavily shaped by public-private cooperation between government, regulators, and industry. Its relatively small and concentrated market makes coordination easier than it would be in a fragmented global ecosystem, but that does not make the lesson irrelevant. If anything, it demonstrates how much can happen when the actors involved in a scam are given a mechanism to exchange intelligence and act together rather than sequentially.

The US illustrates the opposite challenge. The problem there is not simply technology or willingness to act, but fragmentation: different regulators, laws, industries, and jurisdictions make it much harder to establish a single framework for responsibility.

Other smaller markets, including New Zealand and Canada, face a somewhat different set of conditions and can potentially benefit from the same advantage as Singapore - coordination is simply easier when there are fewer actors around the table.

There is no single model emerging yet. But the direction of travel is revealing: the more seriously a market takes the scam as an ecosystem problem, the harder it becomes to justify treating the bank as the only meaningful point of responsibility.

What collaboration looks like when it works

Regulation is only one way of changing that equation. Sometimes the most interesting developments are happening before legislation catches up - through practical experiments in which banks, telecom operators, technology companies, and other organisations begin sharing the information that each of them can see but none of them can see alone.

The UK's Stop Scams initiatives provide some of the clearest examples. Its Blocked SIMs programme brought together mobile operators, banks and global technology platforms, including Meta and TikTok. Around 2.5 million records were shared, contributing to action against approximately 5,000 accounts. Another initiative, Mules to Tech, takes the same principle upstream in the fraud journey: rather than waiting for a mule account to become a financial loss, information about suspected mule activity can be shared with technology platforms, where criminals may be using those accounts as part of their wider operations. The programme has involved the sharing of around 26,000 mule-account signals with technology companies.

Then there is FIRE, the collaboration between Meta, NatWest, and Metro Bank. During a six-month pilot focused on concert-ticket scams, intelligence shared between the organisations contributed to the removal of roughly 20,000 scammer-controlled accounts associated with 185 URLs.

The significance of these experiments is not really the individual numbers. It is where in the fraud journey the intervention happens. Instead of asking a bank to identify a suspicious payment after the victim has already been manipulated, the participants are trying to move the intervention point upstream - towards the account, advertisement, phone number, URL, or digital identity that is helping the scam operate.

Telecommunications provides another important example. Scam Signal, developed through the GSMA ecosystem, is designed to allow mobile operators and banks to exchange fraud signals. It reportedly now reaches a large proportion of UK mobile users, while Telefónica has reported substantial reductions in real-time fraud and financial losses among banks involved in early implementations.

Perhaps the most striking example comes from Finland, where banks and telecommunications companies have developed mechanisms for rapidly disrupting phishing activity. The objective is not to recover the money after the customer has transferred it. It is to cut off the communication channel while the scam is still in progress. In 2025, Finnish banks reportedly intercepted more than half of the EUR 148 million criminals attempted to steal, with particularly strong results against phishing scams.

Europe is beginning to turn collaboration into infrastructure

The EU is now moving this principle from voluntary cooperation towards regulatory architecture. The forthcoming European payments framework is expected to strengthen fraud-information sharing between payment service providers, expand Verification of Payee requirements and reinforce fraud monitoring across both sending and receiving sides of payments. In other words, information exchange is increasingly being treated not as a nice-to-have capability, but as part of the infrastructure required to operate a modern payment system safely.

At the same time, initiatives such as the European Payments Council's FRIDA - Fraud Risk Information Data Sharing - and EBA Clearing's FPAD, focused on fraud-pattern and anomaly detection, are helping build the mechanisms through which institutions can share and interpret fraud intelligence at scale.

That matters because collaboration has one fundamental advantage over even the most sophisticated individual fraud model: it changes the information available at the moment a decision is made.

But collaboration is not the same as saying we collaborate

There is an important caveat here, and I don't want this series to end with an overly neat success story. As John Erik pointed out in our conversations, everyone talks about collaboration; considerably fewer organisations have managed to turn that ambition into consistent, operational information sharing. There are questions around data quality, privacy, governance, liability, interoperability, commercial incentives, and - perhaps most importantly - what happens once a signal has been shared.

Because information is only useful if somebody can act on it. This is where Mike Nathan's leaky-bucket metaphor from earlier in the series comes back. You can keep plugging holes in one part of the system, but if the water continues entering somewhere else, the problem does not disappear. The same is true of fraud. Improve transaction monitoring, and criminals move upstream. Strengthen authentication, and social engineering becomes more sophisticated. Disrupt one mule network, and another appears. Close one platform account, and the scam migrates elsewhere.

The problem is not that banks are failing to build better walls. It is that the fraud landscape keeps moving around them.

The question we should be asking instead

That brings us back to the question with which this series began. We started by asking whether the industry's fraud scorecards tell us which institutions are good at prevention. We then followed the customer's journey and found that the decisive moment may happen long before a transaction is flagged - sometimes inside a login session, sometimes on a compromised device, sometimes during a conversation with a scammer, sometimes in the customer's own understanding of what they are being asked to do. And now, by following that journey further upstream, we arrive at a third uncomfortable conclusion: perhaps the bank is not even the right unit of analysis.

If a scam can begin on social media, travel through telecommunications infrastructure, exploit a digital identity, manipulate a customer, and eventually reach a payment system, then judging only the final financial institution tells us only part of the story.

Likewise, asking which bank has the lowest fraud losses or reimburses customers most effectively may tell us something important about that institution. But it cannot tell us whether the ecosystem surrounding that bank is becoming better at preventing scams.

The more useful question may therefore be: Which ecosystems are learning fastest - and which are still expecting one institution to carry the weight of a problem that no institution created alone?

There is no neat answer yet. And perhaps that is the most honest conclusion this series can offer. Fraud prevention is becoming more proactive, more data-driven, and increasingly collaborative. Regulation is pushing institutions towards earlier intervention, information sharing, and greater accountability. Banks are investing in AI, behavioural analytics, customer intervention, and new ways of understanding the fraud journey. But the fraud journey itself does not respect organisational boundaries.

Neither should the defence.

If you have missed them, you can read [Part 1] and [Part 2] of the series, and I would genuinely love to hear what you think. Have you seen a bank, regulator, technology company, or cross-industry initiative approaching fraud differently? What are we still missing when we talk about prevention? The conversation is very much still open.

About author

Mirela Ciobanu is Lead Editor, Banking and Fintech at The Paypers, focusing on the latest trends and developments in fraud, cybersecurity, and technology (generative AI, blockchain analytics, data, etc.). Mirela is particularly passionate about the importance of having interoperable digital identity solutions that help not only to secure payments but also transactions in other areas of life (travel, health, education). She is a strong advocate for online data privacy and protection.

As a skilled writer, she strives to deliver accurate and informative insights to her readers, always in pursuit of the most compelling version of the truth. To share more ideas and get inspired, connect with Mirela on LinkedIn or reach out via email at mirelac@thepaypers.com.