Study guide · Luxembourg Digital Bank fraud detector
Fraudsters can steal a password, but not time.
This page explains our fraud detector in plain words. Read it from top to bottom (about 20 minutes). Press the buttons: the diagrams move step by step. At the end there is a quiz to test yourself before the presentation.
Part 1
Account takeover (ATO) means a criminal gets into a customer's online bank account, or tricks the customer, and sends the money away. The money usually goes to a mule account: an account that receives stolen money and passes it on quickly.
The customer finds a copy of the bank's site through a search ad and types in their LuxTrust details. The criminal uses them at once on the real site. This happened with a fake BILnet site in 2025.
The criminal moves the customer's phone number to their own SIM card, resets the password and sets up LuxTrust on a new phone.
Someone pretending to be the bank, LuxTrust or the police says the account is in danger and tells the customer to move money to a "safe account". The customer does it on their own laptop.
Malware on the computer steals the open online-banking session. The criminal does not even need to log in.
In Europe, transfer fraud reached €2.2 billion in 2024, and more than half of it came from customers being tricked into paying (EBA and ECB report, December 2025). A good detector must handle the tricked customer too, not only the stolen password.
Part 2
Think of every payment as a path to the money: the device used, the phone and LuxTrust that confirm it, the payee, and how other customers know that payee. An honest customer mostly uses things they have had for months. A criminal always needs something new on that path. They can fake many things, but they cannot make a new thing old. That is why we called it TrustAge.
Check how old each link is. New things add points.
Not sure? Do not decide in a split second. Hold the payment for 1 hour; the customer can cancel it.
During that hour, other customers' payments, the real owner and an analyst can expose the fraud.
Part 3
The detector lives inside the bank, between online banking and the payment hub (the part that actually sends money). It answers in under 0.3 seconds, before any money leaves. The brief asks for three parts: the Transaction loader (collects data), the Fraud engine (scores) and the Report engine (shows results to people). Press Play and follow the orange dot.
Ready
Remember: the customer and LuxTrust are outside the bank. The receiving bank and the CSSF (the supervisor) are outside too. Everything else, including the four staff roles, is inside LDB.
Part 4
This is the TOM (target operating model): how people work with the detector. The risk officer never writes code. The detector handles easy cases alone. People handle the hard ones. Every decision teaches the system, because it is saved as a label.
Ready
Part 5
LDB already has all the essential data, plus some nice-to-have extras. Each group answers one simple question.
Amount, time, instant or not, who receives it.
Is a lot of money leaving?
When it was added, or its IBAN changed, and from which device.
Is the payee new?
Does the name match the account? What did the customer do next?
Was a warning ignored?
When the device was first seen, the type of network, a session that suddenly jumps.
Is this a new device?
New phone, email, password, LuxTrust device, alerts switched off, higher limits.
Did someone take control?
Balance, income stated at opening, how many customers pay this IBAN.
Is it being emptied? Is it a mule?
No history yet? For a new customer we use what they told us when opening the account. After 20 payments and 90 days we use their own habits.
New payment system? On day one every payee would look new. So we load 2 years of older transfers first and start gently for 30 days.
Fair by design. We never score sex, ethnicity or age. A foreign IBAN alone is never a warning sign, because half of Luxembourg's workers live abroad.
Part 6
Each rule is one thing criminals find hard to avoid. Tap a rule to open it. The risk officer can change every number, and a second person must approve the change.
In plain wordsSomeone changed the phone, email, password or LuxTrust, then sends money to a new payee.
WhyA criminal locks the owner out first. Honest people rarely change their phone and pay a stranger on the same day.
ExampleNew phone 2 hours ago, then €4,800 to a payee added 10 minutes ago.
In plain wordsA device or network never seen before, or an open session that suddenly jumps to another computer.
WhyA criminal using stolen details works from their own computer.
ExampleLogin from a laptop first seen today, on a data-centre network.
In plain wordsA payee added recently, or an old payee whose IBAN was changed, and a real amount (from €500).
WhyEvery fraud ends at an account the criminal controls. Changing an old payee's IBAN counts as new, so that trick does not work.
ExamplePayee added 5 minutes ago, €3,000.
In plain wordsThe name check says "no match", but the customer goes on anyway. Or the reason they give does not fit.
WhyScammers tell victims to ignore the warning.
Example"No match" shown, the customer clicks "pay anyway".
In plain wordsA big part of the balance leaves to new payees within 72 hours, even in small pieces.
WhyCriminals want to empty the account. Adding up 72 hours stops the "many small payments" trick.
Example80% of savings sent to new payees.
In plain wordsThe payee looks like a mule: several unrelated LDB customers suddenly pay the same new IBAN. Or it is on the mule list.
WhyOne mule collects money from many victims. LDB sees this across all its customers.
Example3 customers pay the same 1-day-old IBAN.
In plain wordsToo fast for a human, a remote-control app running, or a long pause while someone gives instructions.
WhyRobots are faster than people; tricked customers wait for the caller.
Example4-minute pause on the confirm page.
In plain wordsA tiny test payment first, an account that wakes up after months, a new standing order to a new payee, or many tries after being stopped.
WhyPatient criminals test first and try to stay under the radar.
Example€1 test, then €2,000 to the same new payee.
At most −40 in total.
Part 7
Points add up to a score from 0 to 100. The score picks one of five actions. Most payments score under 30 and nobody notices anything.
1-hour release: the payment waits 60 minutes as a normal (not instant) transfer. The owner can cancel it in the LuxTrust app. Or the customer can call LDB to send it now. EU law gives a normal transfer until the end of the next business day, so one hour is allowed.
Safe channel rule: a LuxTrust check or a phone call never goes to a phone, email or LuxTrust device that changed in the last 30 days. After a SIM swap, that phone belongs to the criminal.
Part 8
Pick an example and press Play. First the payment arrives. Then each link gets an age (red means new, green means trusted). Then rules add points, good signs take points away, and the score lands on an action.
0points
Ready
Part 9
Tick what is true about a payment and see the score change. This is a simplified version of the real rules, made for learning. Start with one of the ready-made stories, then change things.
0points
Some signs only count with a new payee, as in the real rules: a security change or a big share of the balance going to a payee you have paid for years is not suspicious.
Part 10
This is the most original part of TrustAge. Three LDB customers are phished by the same gang and told to pay the same new account. Watch how one hour of waiting saves all the money.
Ready
This is the best case: it needs two victims of the same account within the hour.
Part 11
Examiners trust a design more when it admits its limits. These are ours.
If the customer uses her own laptop, the name matches, she approves every check and has not locked her savings, money can still leave. The hour and the warnings reduce this a lot, but not to zero.
If only one customer pays a mule, the crowd check sees nothing. Getting money back later is hard, because a recall needs the mule's consent.
Spotting remote-control apps works better in a mobile app than in a web browser.
At the start, maybe 5 to 10 of every 100 held payments are real fraud. That improves as analysts label cases and the rules are tuned.
Machine learning needs many examples of real fraud to learn from. LDB has none yet. So we start with clear rules, save every analyst decision as a label, and add machine learning only after about 200 to 300 confirmed cases and 12 months, as one extra signal with limited points.
Part 12
| Law | What it says, simply | What it means for us |
|---|---|---|
| PSD2 (EU payment law) | Banks must monitor payments for fraud. A bank may refuse a payment only if its terms allow it, and must tell the customer why. A normal transfer must arrive by the end of the next business day. | We need a fraud-check clause in LDB's terms. The 1-hour release is allowed. Holds must be decided by the next business day. |
| Instant Payments Regulation | Instant payments arrive in 10 seconds. Banks must show the name check (VoP) since 9 October 2025. Only the customer can set their instant limit. | Our check takes 0.3 seconds. We use the name-check result (R4). We never impose an instant limit. |
| PSR / PSD3 (agreed November 2025) | Banks repay victims of fake-bank-staff scams. Banks must share fraud data. | These scams become LDB's cost, so stopping them saves real money. |
| GDPR | Fraud prevention is allowed, but a person must review decisions with big effects. A privacy check (DPIA) is needed. | A human reviews every hold and block. Age is never scored. Device IDs are scrambled. |
| DORA | Banks' IT systems must keep working, or fail safely. | If the detector is down, a simple backup rule is used and IT is alerted. |
| Anti-money laundering | Banks report suspicious money flows to the CRF. | Mule accounts found by the detector are passed to the AML team. |
Part 13
These are example numbers (LDB is a fictional bank), but the logic is real.
€0.66M
Building it (€340,000) plus 2 analysts, data and running costs.
€1.2M
80% of an estimated €1.5 million of attempted fraud.
It pays for itself in the first year. And monitoring is required by law anyway, so the real choice is between building this or buying an expensive product. We start with TrustAge and can add a vendor's machine learning later.
Part 14
Pick an answer. You see at once if it is right and why.
0 of 10 answered · 0 correct
Part 15