Fraud Won't Be Fought in Silos: Frameworks, Threats and Culture

Fraud has moved from the margins to the forefront of financial crime, and it is changing faster than many organisations can adapt. Ahead of the Fraud Leaders’ Summit in Cannes this November, Mateo Jarrin Cuvi, Global Associate Director at AGRC, sat down with Edith O'Connor, Head of Fraud Risk Management at Bank of Valletta, to talk about building a robust control framework, the typologies keeping fraud teams awake, and why people remain the best control of all.

Meet the experts

Edith O'Connor heads the Fraud Risk Management Unit at Bank of Valletta. She has more than 25 years' experience in the industry, spanning policy and frameworks, risk assessment, governance and strategy, and has led the fraud risk management unit for the past 14 months. Edith will be a panelist at the Fraud Leaders Summit in Cannes.

Mateo Jarrin Cuvi is Global Associate Director at the Association of Governance, Risk & Compliance (AGRC), where he leads strategic partnerships and works with members and industry organisations across the governance, risk and compliance sector. With over 20 years of experience across multiple industries, Mateo has a background in journalism, content creation and financial services.

 

Mateo: What do you see as the key domains of a robust, effective anti-fraud control framework, and what have you learned from embedding one at Bank of Valletta?

A robust framework is the foundation of preventing, detecting and reporting fraud and scams, so I think of it in three pillars: preventive, detective and reporting. Each pillar has its own domains.

Under the preventive pillar, the most important domain is a group-wide risk assessment. It drives controls across the bank and shows us where the inherent risk sits, where the controls are, how effective they are and, ultimately, what residual risk we are prepared to tolerate. Alongside that sit a strong policy and operational procedural framework, so that workflows and desk manuals are consistent and aligned with our regulatory obligations, and horizon scanning. That means watching peer reviews, supervisory thematic reviews and publications from bodies such as FIUs, FATF and European organisations, so you can spot gaps and align your controls to address them.

The preventive pillar should also cover customers with elevated fraud susceptibility. On a risk-based approach these customers are ring-fenced, with a clear strategy for each: ongoing monitoring, or in some cases exit. Finally, and perhaps most importantly, there is training and awareness, both internal and external, reaching employees and the general public. The risk assessment tells you where your vulnerabilities lie, so if a particular cohort is most exposed, your outreach should be designed for that cohort.

The detective pillar starts with transaction monitoring scenarios, whether rule-based, machine learning or AI-driven. I make a distinction here between fraud and AML: fraud scenarios and investigations need to be far more proactive. Other key domains are proactive investigations, technology integration to enhance real-time detection, intervention and reporting, and deep-dive analysis. The numbers lead the way, and statistics should inform our decisions.

The third pillar is reporting. The mechanism should reflect the severity, materiality and complexity of each case. A complex case might go to a dedicated committee first, which can often ring-fence the risk without escalating straight to the board. The board and senior management still need to be kept in the loop on material cases, particularly those with reputational or strategic risk, and suspicious activity must be reported to the supervisory authority.

Mateo: Which fraud typologies are you seeing most prominently right now, and are there emerging trends the industry is underestimating?

Phishing, vishing and smishing remain the most prominent, although purchase fraud is also a significant contributor, at least in our case as a bank. Investment and romance scams are evolving too, and AI is playing a part in that.

The bigger point is that fraud is becoming less about a single typology. We are seeing a blended, multi-stage form of manipulation. Romance and investment fraud increasingly overlap, combining emotional manipulation with an investment proposition that then leads to crypto. Business email compromise also remains a material threat, particularly for business customers and payment processors. The numbers may not yet match romance and investment scams, but it is catching up.

Social engineering keeps evolving, with deepfakes and scammers building a victim's trust before they make the ask for money. It all comes back to emotion and manipulation.

We are no longer dealing with isolated fraudsters. Fraud has become an industry, and we need to respond with the same sophistication and agility the fraudsters are using. Sometimes I question who is making better use of AI: the banks, credit institutions and financial service providers, or the scammers.

Mateo: Technology and controls are only part of the picture. How important are culture and awareness, among both staff and customers?

In my opinion, people remain a critical line of defence. The best control is one that prevents the fraud, and sometimes that control is simply an informed person who stops and questions what is happening. Technology alone is not enough.

Culture matters too. Fraud prevention has to be everyone's responsibility. Too often we place that responsibility on the bank or the fraud team, but it has to come from each and every one of us.

Awareness is twofold. For staff, it means continuous, practical, scenario-based training built on real fraud trends and real cases, rather than a tick-box exercise. For customers, it means consistent education that is not one-size-fits-all. The younger generation has its own vulnerabilities, and the elderly cohort has others, so we need to speak to each differently. Ultimately, the aim is to make awareness a behavioural habit and not an afterthought.

Mateo: Stronger controls often mean more friction. How do you strike the right balance between managing fraud risk and preserving a positive customer experience?

This is the magic of the risk-based approach. It is not about removing friction. It is about applying the right control measures to the right customer at the right time, based on the level of inherent risk that customer presents. Not all customers are bad customers, so the objective is maximum risk reduction with the minimum necessary friction, and controls must be proportionate to the risk.

Transaction monitoring is central here. We need to keep reassessing our controls, looking not only at fraud prevention but also at false positives. Calling a customer about a low-risk transaction that is entirely within their profile upsets them and creates unnecessary operational impact. Applying the same level of due diligence to every transaction inconveniences genuine customers and is not in line with a risk-based approach.

I would also encourage using risk indicators to drive intervention, and combining non-transactional customer behaviours with transactional ones. Together they give you a far better risk-based picture than transactions alone, and they flag the higher-risk situations that warrant a deeper investigation.

Mateo: What is the one key message you hope delegates take away from your session in Cannes?

We cannot fight evolving fraud in silos, and we cannot treat AML and fraud in silos either. We need to think beyond our own organisations and work through better collaboration and better intelligence to strengthen our defences.

Fraud is constantly evolving. Europol recently reported fraud as one of the top five crime areas, with over $440 billion in a year, and that is only what has been reported. We firmly believe there is more to it. Our response cannot remain static, and technology alone is not the answer. Effective prevention needs the right combination of people, technology, controls and awareness.

Watch the full interview here: https://youtu.be/7M68kuQkJqk

Looking ahead

Edith will be joining the panel ‘The New Fraud Playbook: Building Smarter Strategies for an Evolving Threat Landscape’ at the Fraud Leaders’ Summit in Cannes on 3rd – 4th November, sharing practical insight on building frameworks that keep pace with fraud. Join her and fellow fraud leaders from across the industry to continue the conversation: https://www.fraud-leaderssummit.com/fls-eu-attendee-enquiry-form-2026