Luxembourg Digital Bank · Fraud Detector · 10 October 2026
Fraudsters can steal a password, but not time.
Our detector checks every online transfer before the money leaves. It asks one simple question: what on the path to the money is new?
How old is the device, the phone number, the payee? New things add points.
Not sure? Hold the payment for 1 hour. The customer can cancel it.
During that hour, other payments, the owner and an analyst can expose the fraud.
Account takeover (ATO): a criminal gets into a customer's online bank account, or tricks the customer, and sends the money away.
[Team name] · Corporate Risk Assessment and Digital Transformation · University of Luxembourg
Architecture
Ready
Target operating model (TOM)
Ready
Data
Amount, time, instant or not, who receives it
Is a lot of money leaving?
When the payee was added, or its IBAN changed, and from which device
Is the payee new?
Does the name match the account? What did the customer do next?
Was a warning ignored?
When the device was first seen, type of network, a session that jumps
Is this a new device?
New phone, email, password, LuxTrust device, alerts off, higher limits
Did someone take control?
Balance, income stated at opening, how many customers pay this IBAN
Is it being emptied? Is it a mule?
No history yet? We use what the customer told us when opening the account, then their own habits after 20 payments and 90 days.
New payment system? We load 2 years of older transfers first, and start gently for 30 days.
Fair by design: we never score sex, ethnicity or age. A foreign IBAN alone is never a warning sign.
Detection rules
| Rule | Name | In plain words | Example | Points |
|---|---|---|---|---|
| R1 | Control change, then money out | Phone, email, password or LuxTrust changed, then money goes to a new payee | New phone 2 h ago, then €4,800 out | +25 to +55 |
| R2 | Unfamiliar access | A device or network never seen before, or a session that suddenly jumps | Laptop first seen today | +15 to +50 |
| R3 | Fresh payee with value at risk | A payee added recently, or an old payee whose IBAN was changed | Payee added 5 min ago, €3,000 | +10 to +40 |
| R4 | Name or purpose contradiction | The name check says "no match", but the customer goes on anyway | "No match" warning ignored | +5 to +45 |
| R5 | Drain and split | A big part of the balance leaves within 72 hours, even in small pieces | 80% of savings to new payees | +15 to +35 |
| R6 | Risky destination | The payee looks like a mule: several customers suddenly pay the same new IBAN | 3 customers, same new IBAN | +10 to +35, or block |
| R7 | Scripted or coached session | Too fast for a human, a remote-control app, or a long pause for instructions | 4-minute pause before confirming | +10 to +35 |
| R8 | Probe, wake or set-and-forget | A tiny test payment first, a sleeping account wakes up, a new standing order | €1 test, then €2,000 | +15 to +20 |
How detection works
0points
Ready
Worked example
Ready
Fair warning: this is the best case. It needs two victims of the same account within the hour.
Assumptions and business reasoning
first-year cost: building it plus 2 analysts
fraud stopped per year in our base case
Pays for itself in the first year.
€2.2 billionlost to transfer fraud in Europe in 2024 (EBA and ECB)
≈ €550,000lost by clients of one Luxembourg bank to a fake BILnet site in 2025
New EU rulesbanks will repay victims of fake-bank-staff scams (PSR, agreed 2025)
Use the ← and → keys to change slides.