How Do Authorised Scams Hide Behind Legitimate Bank Transfers?

Can a bank know exactly who its customer is and still miss a scam? Increasingly, the answer is yes.

Social engineering and authorised scams often involve real customers using their own accounts to move money.

A customer may pass authentication and personally approve the transfer even though someone else has manipulated the decision.

According to Singapore Police’s Annual Scam and Cybercrime Brief 2025, 81.8% of scam cases in 2025 involved  customer-authorised transfers, with victims typically manipulated into making the payment themselves rather than losing direct control of their accounts.

Malaysia faces its own costly version of the problem, with Bank Negara Malaysia putting the reported impact of financial fraud at RM2.8 billion in 2025 in its Annual Report 2025.

Such cases are forcing banks to look beyond whether the person behind a payment is genuine.

Fintech News spoke with Vishal Verma, Senior Director for APAC at LexisNexis Risk Solutions, and Keen Yew Kwan, Chief Legal & Compliance Officer at CIMB Group, about how banks assess risk when legitimate customer activity can still be linked to a scam.

Vishal framed the problem around the limits of identity checks.

“When the customer is genuine but may be acting under the influence of a scammer, identity alone is no longer sufficient.”

Authorised scams expose a wider problem once the money leaves the victim’s account.

A genuine customer may make the transfer, but the funds must then pass through several mule accounts as part of a wider laundering network.

Banks therefore need to understand what happens beyond the original payment, rather than assessing the transaction on its own.

Money Mule Accounts No Longer Look Isolated

Mule activity has moved well beyond the image of an individual knowingly lending out a bank account.

Keen Yew noted that recruitment can begin through social media ads or fake job offers, while romance and investment scams can draw people into the network.

Some account holders knowingly participate, while others enter mule networks after scammers deceive or pressure them.

Bank Negara Malaysia (BNM) reported 969 convictions against mule-account holders in Malaysia during 2025 after legal amendments strengthened enforcement, according to its 2025 financial integrity review.

Those convictions come after mule accounts have already been identified.

Banks face a harder task much earlier, when they are trying to recognise suspicious activity that may still resemble ordinary customer behaviour.

“Many transactions can appear genuine when viewed individually,” Keen Yew observed.

Broader patterns may only emerge when banks look beyond a single payment and examine how connected accounts behave.

A transfer that appears routine on its own can carry a different risk profile once those links become visible.

Why Authorised Scams Are Harder for Banks to Detect

Keen Yew cautions against expecting any single technology to solve the problem.

“There is no single technology that solves the problem.”

He pointed to monitoring and screening controls alongside behavioural analytics, with AI and network analysis increasingly being explored across the industry to improve detection and prioritisation.

The aim is to build a fuller view of customer activity so warning signs can be assessed in context.

Vishal approaches the same problem through the behaviour surrounding a transaction.

Identity may confirm who the customer is, yet that alone says little about whether someone else is influencing what they are doing.

Device and transaction context can help show whether an interaction resembles the customer’s usual behaviour. Banks can then look at the beneficiary or what is happening during the session for further signs of risk.

Remote-access software or indications of an active scam call may point to manipulation even after the customer has authenticated successfully.

More context can help banks decide when intervention is warranted without placing unnecessary checks in front of every customer.

Vishal described the objective as making “better trust decisions”, allowing legitimate customers to face less friction while higher-risk interactions receive closer scrutiny.

Keen Yew also pointed to customer education and targeted awareness as part of the broader response to scams.

Keen Yew noted that authorised scams remain difficult because the customer may have approved the transfer even though a fraudster shaped the decision.

AML and Scam Risks Are Becoming Harder to Separate

Historically, anti-money laundering and fraud teams have focused on different parts of financial crime.

Fraud teams typically handle victim protection and transaction risk, while AML teams concentrate on illicit fund flows and regulatory reporting.

Criminal networks are increasingly blurring that division.

Keen Yew pointed to scam and mule activity feeding into money laundering by the same groups, making a rigid separation between the two functions harder to maintain.

“It is becoming less effective to view these risks in isolation,” he observed.

Operationally, information uncovered during a fraud investigation may also matter to AML teams, and the reverse can be true.

Network analysis can help banks uncover relationships they might miss when reviewing an account or payment on its own.

Keen Yew sees value in bringing fraud and AML intelligence closer together, with behavioural and network analysis helping teams identify connections across cases.

Closer integration still requires clear governance, as he also expects operating models to continue evolving without weakening accountability or regulatory oversight.

One Bank Can Only See So Much

Even with a clearer view inside its own systems, a bank may still miss signals that appear elsewhere. Vishal sees network intelligence as one way to close that gap.

“The value of network intelligence is that fraudsters rarely target only one institution,” he noted.

LexisNexis Risk Solutions says its Digital Identity Network analysed more than 116 billion transactions in 2025.

Vishal explained that a wider network can show whether a device or digital identity has been linked to suspicious activity outside one institution.

Such connections can give banks context that would be difficult to build from their own data alone, including patterns associated with mule activity or coordinated fraud campaigns.

The same cross-border challenge appears in INTERPOL’s 2026 Global Financial Fraud Threat Assessment, which found that fraud networks are increasingly working with specialised money-laundering groups and sharing expertise across borders.

The scale of that activity became clearer during Operation First Light 2026.

Coordinated across 97 countries and territories, the operation led to 5,811 arrests and the interception of US$293 million in illicit assets linked to social engineering scams and associated money laundering.

A bank may therefore have a detailed view of what happens within its own systems while seeing only a fraction of the network moving the money.

Banking Fraud Prevention Is Becoming a Collective Effort

Keen Yew expects industry-wide information sharing to remain high on the agenda heading into 2027 as banks contend with synthetic identities and organised financial-crime groups operating across jurisdictions.

He also sees advanced analytics and network intelligence playing a larger role in identifying connected activity earlier.

Shared intelligence matters because authorised scams can span several institutions, leaving each bank with only part of the picture.

Keen Yew sees the next phase of financial crime prevention depending on how well banks can connect fragments of activity spread across institutions.

“It is about combining technology, network intelligence and ecosystem-wide collaboration to develop a more complete picture of criminal activity.”

The harder task is recognising when an apparently ordinary transaction is only one piece of a much larger criminal operation.

Featured image: Edited by Fintech News Singapore based on an image by atlascompany via Magnific.