When Fraud Arrives as Friendship or Romance, How Will Risk Thinking and Fraud Prevention Hold Up?

Guest Editorial by Kristina Nikipolska, Associate Chief Risk Officer at xpate

The rise of relationship-based scams like friendship fraud exposes a blind spot in how payment systems detect risk. These are not sudden, high-risk anomalies that glaringly stand out, but quite the opposite. They unfold through months of small, legitimate-looking transactions that grow into long-running financial relationships based on trust.

While fraudsters often invent highly sophisticated technical methods, what makes this type of scam particularly ingenious is its ability to evade detection because it is engineered around the victim’s interactions and context, not the payment itself.

 Kristina Nikipolska, Associate Chief Risk Officer at xpate.

“Operationally legitimate” doesn’t cut it anymore

When fraud develops gradually through trust, emotional pressure, or addictive behavior patterns over time, it often bypasses traditional fraud monitoring capabilities that were built to identify clear anomalies. These systems are designed to flag suspicious transactions in isolation, whereas relationship-based scams rarely present as obvious fraud at the transaction level. It’s stolen credentials, impossible geolocation patterns, sudden spikes in spending, or compromised accounts versus transactions voluntarily initiated by customers and authenticated successfully using known devices.  In many cases, the risk only becomes apparent when behavioral patterns are viewed over a longer period of time. Data shows that the average amount lost by a victim of friendship fraud is £3,100.

This paradox also extends into certain patterns of consumer behavior involving high-risk or habit-forming activities such as speculative crypto trading, online gaming ecosystems, loot-box mechanics, or impulsive digital purchases, which are later disputed as unauthorized transactions. Operationally, the transactions often appear legitimate because, at the time of payment, the customer actively chose to participate in the activity.

Simple rules hardly address these cases. In comparison to blocking obvious fraudulent activity, it is much harder to distinguish between genuine customer behavior and patterns linked to manipulation, addiction, or emotional exploitation without creating excessive false positives and disrupting legitimate customer activity.

The strongest indicators are often behavioral rather than purely transactional

A single low-value payment usually means nothing. It’s when patterns start forming over time that the picture becomes more concerning.

From an acquiring or portfolio perspective, it is often more important to look at patterns across customer activity than isolated payments. Gradual increases in spend, repeated late-night transactions, signs of emotional or impulsive behavior, unusual movement of funds between platforms, or growing reliance on a particular merchant category or payment flow may, in some cases, indicate heightened vulnerability or harmful behavior. Equally, however, these same patterns may reflect entirely legitimate customer activity.

There are also broader contextual indicators. Self-exclusion records, vulnerable customer markers, age-related vulnerabilities, or unusual changes in historic spending behavior can all contribute to the overall risk picture. This is especially true for seniors, who face heightened vulnerability in friendship fraud scenarios, where exploitation is often built around long-term communication rather than technical compromise. Victims are often manipulated over weeks or months into providing financial support, gifts, or loans to someone they believe is a genuine friend.

The challenge is that no single signal is sufficient to establish fraud. However, collectively viewed, they can indicate that a customer may be entering a harmful or exploitative financial pattern.

Risk teams are starting to think less in binary terms

Fraudsters are steadily exploiting situations where individual payments are technically valid, yet the overall customer outcome may still be harmful. That creates a difficult question for the industry: where should the line be drawn between customer autonomy and customer protection?

Consequently, risk teams are starting to move away from the “fraud” versus “not fraud” state of thinking towards a broader assessment of customer risk and behavioral context. This calls for a more nuanced approach to monitoring. Not every harmful pattern is illegal, not every vulnerable customer is a fraud victim, and not every unusual transaction should be blocked. The challenge lies in identifying when otherwise normal customer behavior gradually shifts into something exploitative or financially damaging.

This is also where fraud, AML, and broader regulatory compliance considerations start overlapping more significantly. You need a more complete view of customer behavior, counterparties, recurring patterns, and broader context across the portfolio. For acquirers specifically, having this visibility can provide valuable insights that may not be visible from a single issuer or single transaction perspective.

Breaking the momentum of manipulation

Reactive in nature, traditional post-event analysis or reimbursement does little to prevent harm before it happens. By the time a scam is identified and reimbursement is considered, the damage has often already been done, and recovering funds can be difficult. The earlier suspicious behavioral patterns are identified, the greater the chance of intervening before significant harm occurs.

Especially in card acquiring and fast-moving digital payment environments, real-time monitoring becomes crucial. Combined with behavioral analytics, device intelligence, merchant-level monitoring, and cross-platform pattern recognition, it is possible to build a more complete picture of risk. In some cases, even relatively small interventions through additional friction, targeted warnings, and temporary review flows can sometimes interrupt the cycle of manipulation.

It’s also important to acknowledge that the objective of zero risk is simply not viable in payments, considering the sheer scale and speed of transactions. Rather, the goal is to become better at identifying elevated-risk behavioral patterns without introducing unnecessary friction for the majority of legitimate customers.

Doing so requires moving beyond static rules and embracing more adaptive risk monitoring models built on behavioral baselines, longitudinal analysis, customer vulnerability indicators, relationship mapping, and real-time contextual signals. At the same time, interventions need to remain proportionate. Excessive friction can be just as problematic, creating poor customer experiences while increasing operational complexity.

The most effective frameworks are likely to combine technology, behavioral analytics, operational judgement, and human oversight rather than relying entirely on automated decision-making.

Fraud prevention is becoming much more multidisciplinary

By now, it’s clear that risk teams need a more holistic understanding of customer behavior. Functions such as fraud monitoring, AML, compliance, disputes, and customer support have traditionally operated in silos, yet long-running exploitation schemes rarely fit neatly into any one category.

At the same time, fraud continues to evolve. Urgency-based pressure from scammers was cited by 21% of victims as influencing their decision-making. With modern scams leaning heavily on psychology rather than technical exploits, customer awareness becomes crucial for merchants and end users alike. Helping people recognize manipulation tactics, emotional pressure, false urgency, and financially exploitative relationships is becoming just as important as traditional fraud education focused on phishing, stolen credentials, or account takeover.

The shrinking time-to-fraud

Fraud is becoming cheaper to run, faster to scale, and harder for the average customer to distinguish from genuine human interaction, as AI improves the quality of fraudulent interactions while dramatically reducing the resources involved. This is creating new risks around synthetic identities, convincing deepfakes, automated social engineering, and realistic long-form interactions designed to build trust and emotional engagement over extended periods of time.

The same technological advances that help financial institutions improve fraud detection are also enabling what’s described as the industrialization of fraud. This reinforces the need to approach fraud prevention as a continuous race rather than a problem that gets permanently solved.

---

Kristina Nikipolska is the Associate Chief Risk Officer at xpate, where she leads the development of practical, business-focused risk frameworks that support sustainable fintech growth. With nearly a decade of experience in compliance, AML, and risk management across crypto and traditional online payments, she brings deep operational expertise to complex regulatory environments. She focuses on building strong risk cultures that balance innovation with disciplined oversight, ensuring xpate scales securely across global markets.