How Banks Can Strengthen Fraud Prevention Across Connected Payment Ecosystems

As integrations multiply and more payment workflows get automated, financial institutions need broader intelligence, continuous monitoring, and a more disciplined approach to AI.

The rapid expansion of connectivity in commercial banking and business payments is exposing a limitation in payment fraud prevention: financial institutions are being asked to assess activity originating beyond their own systems within a vast, interoperable network.

ERP integrations, open APIs, embedded banking, and fintech specialization have brought payment initiation closer to the applications businesses use daily. For corporate treasury teams, the advantages are considerable. But a bank's visibility into the identities, business processes, and automated decisions behind a payment may be incomplete.

Meanwhile, fraud remains widespread. According to the Association for Financial Professionals' 2026 Payments Fraud and Control Survey, 76% of U.S. organizations experienced attempted or actual payment fraud in 2025. Business email compromise (BEC) affected 74%, underscoring the continuing vulnerability of commercial payment processes to impersonation and manipulation.

"The industry has spent years working to connect everything, and now the challenge is securing everything that we've connected," says Eric Choltus, CFRM Product Director at Bottomline.

Choltus believes the next stage of payments security requires institutions to rethink where fraud originates, how suspicious activity is evaluated, and what they can learn from the broader financial community.

Where Payment Fraud Is Finding New Opportunities

"Security used to be focused on protecting the perimeter, but there's no clear perimeter anymore," Choltus says, illustrating how interconnected platforms, third parties, APIs, and automated workflows have redrawn the fraud map. AI adds another dimension by enabling both institutions and attackers to operate at greater speed and scale.

The fastest-expanding vulnerabilities, he says, are being found in the connections surrounding core payment infrastructure. He identifies five areas of concern: digital identities, third-party relationships, APIs, business processes, and AI-enabled automation.

Credential theft and session hijacking can compromise legitimate users. Fintech partnerships and service providers introduce additional dependencies, while APIs require increasingly sophisticated access controls. It’s all part of a geometrically expanding attack surface, Choltus says.

Business process manipulation is particularly consequential. Fraudulent beneficiary changes, invoice manipulation, and compromised supplier relationships can result in unauthorized payments without requiring criminals to breach the bank's core systems.

Automation introduces its own unique concerns. As banks incorporate AI into operational workflows, Choltus expects attackers to target "AI-generated recommendations, orchestrations, data inputs, automated approvals."

Like other CFRM experts, Choltus notes that fraudsters are using AI to distribute smaller amounts across multiple accounts or transactions rather than attempting a single large, conspicuous transfer. AI and automation make these coordinated patterns easier to execute at scale. This kind of activity illustrates why a modern security posture for B2B payments must evaluate patterns across the entire connected environment, rather than assessing each payment in isolation.

Continuous Monitoring Requires Faster Institutional Responses

To that end, Choltus says strong fraud prevention now begins with always-on verification: "Trust has to be continuously verified. It can't just be at one point in time," he says.

He’s a proponent of banks examining device characteristics, authentication and session activity, user behavior, beneficiary or profile changes, and other administrative events that may signal account takeover or process manipulation. Payment instructions require similar scrutiny throughout their lifecycle, from initiation and approval through interdiction or execution.

This approach has implications for organizational structure. Fraud prevention, AML, identity management, cyber and case management have traditionally operated as separate functions. Yet information identified by one may become far more useful when viewed alongside other signals.

The next requirement is adaptability. "That cycle can’t take months anymore," Choltus says, meaning the time between identifying a new fraud type and updating detection models, policies, and procedures. "That’s got to take weeks, if not days, now," he adds.

Bottomline developed Payments Fraud Defense (PFD) as the next generation of its commercial payment fraud capabilities, extending beyond Secure Payments with broader intelligence, more granular controls, and a foundation for emerging fraud requirements.

He says PFD brings together transaction and behavioral monitoring, AI-supported detection, investigation capabilities, and granular interdiction controls. The goal is to identify suspicious activity earlier while reducing disruption to legitimate payments.

For banks, that last consideration is commercially important. Excessive false positives consume investigation resources and frustrate customers, Choltus notes. Stronger security must improve the quality of decisions, not simply increase the number of alerts.

Why Network-Level Intelligence Is Essential

A bank can examine its own transaction history in considerable detail and still lack useful information about a beneficiary's activity elsewhere. Choltus illustrates the limitation through a familiar fraud detection question: Has this customer paid the beneficiary before?

If the answer is no, the transaction may warrant additional scrutiny. But an unfamiliar recipient is not necessarily fraudulent. An institution can improve its assessment by reviewing whether other customers at the same bank have paid that beneficiary. Extending the analysis across participating banks adds another dimension of visibility.

A beneficiary with no history at one institution may have an established record of legitimate payments elsewhere in the network. That history can’t guarantee the safety of a particular transaction, but it gives investigators additional evidence about the beneficiary’s prior activity and helps them determine whether the payment warrants further review.

The industry is beginning to recognize the value of this wider perspective. In April 2026, Federal Reserve Financial Services (FRFS) introduced a network intelligence API for the FedNow Service. The API provides receiver account-level information observed over the service to help participating institutions assess potential payment risk before execution.

The development reinforces a broader industry direction: network-level information can complement the transaction intelligence institutions already maintain.

Bottomline's Fraud Intelligence Exchange pursues a related objective through a consortium model. Launched as a pilot with a small group of commercial banking customers in June 2026, the initiative is evaluating how securely shared, anonymized fraud signals can improve detection and reduce false positives.

Making that model work requires more than aggregating data. Participating institutions need defined rules for contribution and access, privacy-preserving treatment of payment information, strong security controls, and governance over how consortium signals are interpreted. Shared intelligence should enrich an institution’s decisioning rather than replace its own controls, investigation, or accountability.

The opportunity is to give investigators relevant context from beyond their customer base, without compromising the safeguards governing sensitive financial information.

How Far Should Banks Go With AI?

Artificial intelligence offers banks powerful capabilities for anomaly detection, behavioral analysis, and faster fraud investigations. Yet adoption remains relatively limited.

The AFP's 2026 survey found that only 17% of responding organizations were using AI to combat payment fraud, despite reported improvements among adopters in detection and operational efficiency.

Choltus advocates a "crawl, walk, run" approach to the technology, allowing institutions to adopt capabilities according to their risk appetite and operational readiness.

Banks might begin with expert models, dynamic profiles, adaptive analytics, and intelligence augmentation. That foundation can be extended with human-in-the-loop AI assistants designed to help investigators and analysts interpret alerts, analyze fraud patterns, support model tuning, and produce documentation. More advanced capabilities include unsupervised machine learning designed to identify patterns conventional models may overlook.

But Choltus distinguishes between analytical assistance and autonomous authority. "AI should support decision making, but banks need to be cautious about fully autonomous decisions around payment blocking, customer impact, or regulatory obligations," he says.

Human oversight is essential when automated actions can interrupt legitimate commerce. Explainability and auditability are equally important: investigators need to understand why a model reached its conclusion and whether that conclusion was justified.

With fraudsters developing increasingly sophisticated AI capabilities themselves, institutions must improve detection without surrendering accountability. Choltus describes the industry's larger objective as "turning connected systems into connected intelligence."

For banking executives, that ambition presents a practical test of modernization investments. Can their institutions evaluate payment activity across organizational boundaries, incorporate intelligence from outside their own systems, and revise detection strategies quickly enough to address emerging threats?