Payments Academy
Pre-payment fraud controls PAYMENT OPERATIONS STARTED LIVE 01 Pre-payment fraud controls - start before a payment is sent ACTIVE 02 Post-payment transaction monitoring - continues after the payment is sent QUEUED 03 Sanctions screening - related control that must run on every payment QUEUED 04 Incident response - When fraud is confirmed QUEUED 05 Bank must learn - After an incident QUEUED Fraud controls start before a payment is sent, with checks that look for risk in the instruction itself. Step 1 of 5 Pre-payment fraud controls STARTED Pre-payment fraud controls start before a payment is sent ACTIVE Post-payment transaction monitoring continues after the payment is sent QUEUED Sanctions screening related control that must run on every QUEUED Incident response When fraud is confirmed QUEUED Bank must learn After an incident QUEUED Fraud controls start before a payment is sent, with checks that look for risk in the instruction itself.
Post-payment transaction monitoring PAYMENT OPERATIONS IN PROGRESS LIVE 01 Pre-payment fraud controls - start before a payment is sent DONE 02 Post-payment transaction monitoring - continues after the payment is sent ACTIVE 03 Sanctions screening - related control that must run on every payment QUEUED 04 Incident response - When fraud is confirmed QUEUED 05 Bank must learn - After an incident QUEUED Transaction monitoring continues after the payment is sent, by comparing each transaction with the customer profile and with known fraud patterns. Step 2 of 5 Post-payment transaction monitoring IN PROGRESS Pre-payment fraud controls start before a payment is sent DONE Post-payment transaction monitoring continues after the payment is sent ACTIVE Sanctions screening related control that must run on every QUEUED Incident response When fraud is confirmed QUEUED Bank must learn After an incident QUEUED Transaction monitoring continues after the payment is sent, by comparing each transaction with the customer profile and with known fraud patterns.
Sanctions screening PAYMENT OPERATIONS IN PROGRESS LIVE 01 Pre-payment fraud controls - start before a payment is sent DONE 02 Post-payment transaction monitoring - continues after the payment is sent DONE 03 Sanctions screening - related control that must run on every payment ACTIVE 04 Incident response - When fraud is confirmed QUEUED 05 Bank must learn - After an incident QUEUED Sanctions screening is a related control that must run on every payment, without exception. Step 3 of 5 Sanctions screening IN PROGRESS Pre-payment fraud controls start before a payment is sent DONE Post-payment transaction monitoring continues after the payment is sent DONE Sanctions screening related control that must run on every ACTIVE Incident response When fraud is confirmed QUEUED Bank must learn After an incident QUEUED Sanctions screening is a related control that must run on every payment, without exception.
Incident response must start immediately PAYMENT OPERATIONS IN PROGRESS LIVE 01 Pre-payment fraud controls - start before a payment is sent DONE 02 Post-payment transaction monitoring - continues after the payment is sent DONE 03 Sanctions screening - related control that must run on every payment DONE 04 Incident response - When fraud is confirmed ACTIVE 05 Bank must learn - After an incident QUEUED When fraud is confirmed, incident response must start immediately, and the first hour matters most. Step 4 of 5 Incident response must start immediately IN PROGRESS Pre-payment fraud controls start before a payment is sent DONE Post-payment transaction monitoring continues after the payment is sent DONE Sanctions screening related control that must run on every DONE Incident response When fraud is confirmed ACTIVE Bank must learn After an incident QUEUED When fraud is confirmed, incident response must start immediately, and the first hour matters most.
Bank must learn from it PAYMENT OPERATIONS COMPLETE LIVE 01 Pre-payment fraud controls - start before a payment is sent DONE 02 Post-payment transaction monitoring - continues after the payment is sent DONE 03 Sanctions screening - related control that must run on every payment DONE 04 Incident response - When fraud is confirmed DONE 05 Bank must learn - After an incident ACTIVE After an incident, the bank must learn from it and fix the control that failed. Step 5 of 5 Bank must learn from it COMPLETE Pre-payment fraud controls start before a payment is sent DONE Post-payment transaction monitoring continues after the payment is sent DONE Sanctions screening related control that must run on every DONE Incident response When fraud is confirmed DONE Bank must learn After an incident ACTIVE After an incident, the bank must learn from it and fix the control that failed.

Key points of this lesson, in order.

0:00 / 3:02 Step 1 of 5

Fraud Controls, Monitoring and Incident Response

Payment Security, Lesson 6 of 8, Narration 3:02, D12 Risk, compliance and regulation

Sanctions screeningExceptionpacs.008

What you will learn

Your objective. By the end of this lesson, you will be able to explain fraud controls, monitoring and incident response. Fraud controls start before a payment is sent, with checks that look for risk in the instruction itself.

Why it matters. A monitoring system might flag a customer who receives a large credit and then sends the full amount onward within an hour, a pattern known as money mule activity.

Chapter objective: Learner explains payment security controls, including encryption, authentication, fraud monitoring, and PCI scope, and assesses the security of a payment flow. Learner applies this skill in realistic banking scenarios, with clear examples and correct terminology throughout.

Key learning points

  • Pre-payment fraud controls
  • Post-payment transaction monitoring
  • Sanctions screening
  • Incident response must start immediately
  • Bank must learn from it

Key terms

Sanctions screening: Checking payment parties, countries and references against sanctions lists published by governments and international bodies.

Exception: A payment that cannot be processed normally and needs manual handling, investigation or repair. Exceptions arise from missing data, failed screening, account errors or system faults.

pacs.008: An ISO 20022 message for a financial institution to financial institution customer credit transfer. It replaces MT103 in cross border payments and carries structured debtor, creditor, charges and...

Regulatory comparison showing Fraud Controls, Monitoring and Incident Response.

Insights and practice scenarios

Worked insights and practice scenarios for this lesson. Each one is a reusable PaymentForge case, so the same case may appear in more than one lesson.

Practise this lesson

Exercise

Decide what the screening or monitoring outcome should be for the scenario in this lesson.

Use the lists, rules and thresholds in this lesson.

  1. What to do. State whether the payment is stopped, held, frozen or released, and what must be recorded for audit.

Correct result. A true match against a sanctions list stops the payment. A false positive is cleared with a reason recorded. An alert that is escalated becomes a case, and a case that meets the threshold becomes a suspicious activity report.

Why. Screening is a control, not a suggestion. A missed true match is a regulatory breach, and an unexplained clearance is an audit finding.

Check your understanding

Practice question

Which of the following best describes fraud controls, monitoring and incident response?

Takeaway and next step

What to remember

A bank that treats fraud as a one off event, and changes nothing, will face the same fraud again, often from the same attacker.

Run the exception from this lesson and follow the investigation to its resolution.

Open the Exception Investigation Simulator →

Builds on "SWIFT Customer Security Programme and Network Security".

Transcript and full text

Show transcript

Fraud controls start before a payment is sent, with checks that look for risk in the instruction itself. A payment of 300,000 pounds to a newly added beneficiary, a payment to a high risk country, or a payment that breaks the normal pattern for that customer should trigger additional scrutiny. The system may hold the payment for review, ask for step up authentication, or require dual approval from a second user. A corporate customer that normally pays suppliers in the UK and suddenly sends 200,000 euros to an account in a different country should expect a challenge, because that change in behaviour is a classic sign of business email compromise. Transaction monitoring continues after the payment is sent, by comparing each transaction with the customer profile and with known fraud patterns. A monitoring system might flag a customer who receives a large credit and then sends the full amount onward within an hour, a pattern known as money mule activity. It might flag a series of payments just below a reporting threshold, or a payment to an account that has been linked to previous fraud. When a rule fires, an alert goes to a fraud analyst, who reviews the account history, the beneficiary, and the payment message before deciding whether to block, release or investigate further. Sanctions screening is a related control that must run on every payment, without exception. Before a pacs.008 leaves the bank, the beneficiary name, the remitter name and the payment details are checked against sanctions lists. A payment to a sanctioned person or entity must be blocked, and a payment with a possible match must be held for manual review. A bank that allows a payment to bypass screening, because of a system error or a manual override, risks a regulatory fine and reputational damage. Screening must also be tested regularly, with test names that should match and test names that should not match, to prove that the system still works. When fraud is confirmed, incident response must start immediately, and the first hour matters most. The bank should stop further payments from the affected account, freeze the beneficiary account if possible, and start a recall for any payment that has already left, such as a 150,000 dollar payment sent to a fraudulent account. The bank must notify the customer, the receiving bank, and where required, the regulator and law enforcement. It must preserve logs, message copies and access records as evidence, and it must not delete or overwrite data that an investigation will need. After an incident, the bank must learn from it and fix the control that failed. If the fraud succeeded because a password was stolen and MFA was not required, MFA must be enforced. If it succeeded because a beneficiary change was not verified, a cooling off period or a callback check must be added. A post incident review should record what happened, what worked, what failed, and what will change, with an owner and a date for each action. A bank that treats fraud as a one off event, and changes nothing, will face the same fraud again, often from the same attacker.

Fraud controls start before a payment is sent, with checks that look for risk in the instruction itself. A payment of 300,000 pounds to a newly added beneficiary, a payment to a high risk country, or a payment that breaks the normal pattern for that customer should trigger additional scrutiny. The system may hold the payment for review, ask for step up authentication, or require dual approval from a second user. A corporate customer that normally pays suppliers in the UK and suddenly sends 200,000 euros to an account in a different country should expect a challenge, because that change in behaviour is a classic sign of business email compromise.

Transaction monitoring continues after the payment is sent, by comparing each transaction with the customer profile and with known fraud patterns. A monitoring system might flag a customer who receives a large credit and then sends the full amount onward within an hour, a pattern known as money mule activity. It might flag a series of payments just below a reporting threshold, or a payment to an account that has been linked to previous fraud. When a rule fires, an alert goes to a fraud analyst, who reviews the account history, the beneficiary, and the payment message before deciding whether to block, release or investigate further.

Sanctions screening is a related control that must run on every payment, without exception. Before a pacs.008 leaves the bank, the beneficiary name, the remitter name and the payment details are checked against sanctions lists. A payment to a sanctioned person or entity must be blocked, and a payment with a possible match must be held for manual review. A bank that allows a payment to bypass screening, because of a system error or a manual override, risks a regulatory fine and reputational damage. Screening must also be tested regularly, with test names that should match and test names that should not match, to prove that the system still works.

When fraud is confirmed, incident response must start immediately, and the first hour matters most. The bank should stop further payments from the affected account, freeze the beneficiary account if possible, and start a recall for any payment that has already left, such as a 150,000 dollar payment sent to a fraudulent account. The bank must notify the customer, the receiving bank, and where required, the regulator and law enforcement. It must preserve logs, message copies and access records as evidence, and it must not delete or overwrite data that an investigation will need.

After an incident, the bank must learn from it and fix the control that failed. If the fraud succeeded because a password was stolen and MFA was not required, MFA must be enforced. If it succeeded because a beneficiary change was not verified, a cooling off period or a callback check must be added. A post incident review should record what happened, what worked, what failed, and what will change, with an owner and a date for each action. A bank that treats fraud as a one off event, and changes nothing, will face the same fraud again, often from the same attacker.

Full lesson text (all scenes)

Completing a lesson updates your progress dashboard on the homepage.

Scene timestamps are estimated by allocating the narration text proportionally across the real audio length. The audio playback position is the source of truth: pause freezes the visual, seeking restores the correct scene, replay restarts the scene animation.