Luxembourg Digital Bank · Fraud Detector · 17 October 2026 · almost-final design
Fraudsters can steal a password, but not time.
Every takeover needs something new: a device, a phone, a payee. TrustAge measures how old each link is, and buys time when unsure.
What changed since 10 October
Only LDB + 2 people
was: outside players too
One formula: score = odds
was: expert guesses
Weekly recount, safety limits
was: monthly manual retune
Trust starts at onboarding
was: 2 years of history
5 screens, 1 per user
new
[Team name] · Corporate Risk Assessment and Digital Transformation · University of Luxembourg · LDB is fictional; all figures are examples.
Architecture and operating model · bank level
Ready
Detection logic · how we assign points
F = % of frauds with the signal
G = % of genuine payments with it
+7 points = odds × 2 · 70 points ≈ 1,000×
70% ÷ 8% = 8.75× likelier
7 × log₂(8.75) = 21.9 → +20 points
| Rule | Signal | In fraud | In genuine | Points |
|---|---|---|---|---|
| R1 | Phone / email / LuxTrust changed < 24 h, then new payee | 35% | 0.3% | +50 |
| R2 | New device (< 24 h) | 55% | 6% | +20 |
| R3 | New payee (< 24 h), ≥ €500 | 70% | 8% | +20 |
| R4 | Name check: no match | 25% | 1% | +35 |
| R5 | ≥ 80% of balance to new payees, 72 h | 40% | 1% | +35 |
| R6 | New IBAN paid by ≥ 3 unrelated customers | 10% | 0.2% | +40 |
| R7 | Remote-access tool open | 10% | 0.3% | +35 |
| R8 | Tiny test, then 20× more | 10% | 2% | +15 |
| M1 | Good sign: payee paid before | 5% | 60% | −25 |
A score of 70 ≈ 1 in 20 is fraud (planning rate: 1 fraud in 20,000 transfers). All 27 signals: study guide.
Worked example · detection logic
0points
Ready
Adapts without intervention · cold start
Score, store the reasons
Analyst call · cancel · claim · 60 quiet days
New F and G → new points
Fail → change rejected
v1.3 → v1.4 · Sunday 03:00 · safety test 42/42 passed
R3 fresh payee +20 → +25: 21 of 25 confirmed frauds had one; only 5.5% of genuine payments do.
R2 VPN +15 → +10: VPNs are common among LDB's cross-border customers (5%).
Counting, not machine learning. A human decides every hold.
Report engine · mockups · example numbers, month 4 after launch
Why, in one sentencePhone number changed 2 days ago, then €4,800 (6× her usual) to a payee added 10 minutes ago whose name only partly matches.
Similar payments in the past: about 1 in 13 was fraud.
Call the onboarding phone +352 6•• ••• 118. Do not use the number changed 2 days ago.
Points table v1.4 · decided 10:14:03 · 182 ms · instant refused, held as standard transfer (decide by D+1)
Customer for 92 days · usual payments €150–800 · 4 payees, all in Luxembourg · never used instant before · no earlier alerts.
"For your safety we are checking this payment. We will call you on your registered number within 15 minutes. LDB will never ask you to move money."
Release or stop is saved as a label. If fraud: the payee IBAN goes onto the mule list automatically, and the 30-day look-back starts.
| Prio | Case | Time left | Amount | Score | Top reason (one sentence) | Status |
|---|---|---|---|---|---|---|
| P1 | A-0041 | 6 min | €2,950 | 80 | Same new IBAN as A-0039: 2 unrelated customers waiting to pay it, 6× usual amount | calling |
| P1 | A-0042 | 11 min | €4,800 | 75 | Phone changed 2 days ago, then new payee, name close match | new |
| P2 | A-0040 | 38 min | €1,200 | 75 | Remote-access tool open on a new device while a new payee was added | new |
| P2 | A-0039 | 44 min | €3,100 | 75 | Payee added 4 min ago, 85% of the balance in 72 h, name close match | calling |
| P2 | A-0038 | 52 min | €960 | 70 | New device on a VPN, new payee, confirmed 20 s after login | new |
| P2 | A-0037 | 58 min | €7,500 | 70 | Dormant 3 months, new device, then 70% of the balance to a payee added yesterday | waiting for customer |
Sorted by priority, then time left. P1 = answer within 15 minutes, 24/7. P2 = within 1 hour. No payment is ever released automatically. Every decision becomes a label for the learning loop.
| IBAN | Customers | Total | Status |
|---|---|---|---|
| LT•• 4417 | 3 | €8,950 | mule list |
| DE•• 0932 | 2 | €1,340 | watching |
| BE•• 7720 | 2 | €410 | school trip fund |
LT•• 4417 was added to the mule list automatically at 10:52, after the analyst confirmed fraud in A-0039.
| Signal | Today | Normal |
|---|---|---|
| R4 purpose contradiction | 14 | 4 |
| R7 remote-access tool | 3 | 0.5 |
| R1 phone changed | 9 | 8 |
| R2 new device | 112 | 108 |
9 customers chose the purpose "security transfer" today, 3.5× normal. Pattern of a fake-bank-staff call campaign.
Suggested action: send an in-app warning to all customers. The fraud lead decides in one click.
| Signal | Fired | In frauds | Genuine | Points | Why (written by the system) |
|---|---|---|---|---|---|
| R3 fresh payee | 5,800 | 21 / 25 | 5.5% | 20 → 25 | More common in fraud and rarer in genuine payments than our first estimate (8%). |
| R5 ≥ 80% of balance | 300 | 8 / 25 | 0.4% | 35 → 40 | Evidence says +45; limited to +5 per step. |
| R7 pause on confirm page | 2,100 | 3 / 25 | 2.9% | 10 → 15 | Long pauses are rarer among genuine customers than estimated (8%). |
| R2 VPN network | 3,600 | 2 / 25 | 5.0% | 15 → 10 | Cross-border customers often use a VPN; weak signal at LDB. |
| R1 phone changed < 24 h | 61 | 9 / 25 | 0.25% | 50 | Evidence confirms the estimate. No change. |
| R4 name no match | 640 | 6 / 25 | 0.9% | 35 | No change. |
Drift alarm, 3 Oct: "new device" jumped from 6% to 14% of genuine logins in one day (a browser update reset device IDs). R2 was halved for 7 days and the fraud lead was told. Back to normal on 10 Oct.
New signal promoted: "payee added on one device, payment sent from another within 10 min": 7 of 25 frauds vs 1.2% of genuine. Entered at +15 (the limit for automatic promotion).
Hold line: stays at 70. Holds 2.2 per day vs capacity 30.
Risk appetite 91% used: the fraud lead is asked to review R1 and R5. The missed case is already in the learning loop.
Use the ← and → keys to change slides. Back to the start page