Fraud verification has limits in APP fraud, Banfico’s Cardwell says

Fraud verification remains a useful control for payments firms, but it has clear limits in authorised push payment fraud, Jonathan Cardwell, business development lead at Banfico, told FinextraTV at EBAday 2026. Cardwell said verification can help link fraud prevention with fraud detection, while cautioning that it should not be treated as a complete answer to financial crime risk.

The comments came in a FinextraTV discussion produced by Finextra’s editorial team with input from subject matter experts at the funding sponsor. The session focused on how verification tools can be applied effectively without creating unnecessary disruption for customers making legitimate payments.

Cardwell said verification performs well in some fraud-control settings, but faces a structural weakness in authorised push payment fraud. In that type of case, the payment may be approved by the genuine customer, meaning the person authorising the transaction can also be the verified person.

Why doesn't verification stop authorised push payment fraud?

Verification checks can confirm that a customer or payment instruction meets expected identity or account conditions, but Cardwell said APP fraud is difficult because the authorisation itself may come from a legitimate, verified user. That means a successful verification result does not necessarily show that the payment is safe or that the customer has not been manipulated.

APP fraud sits in a difficult area for banks and payment providers because the instruction can appear valid from an authentication perspective. The fraud risk may lie outside the basic identity check, in the circumstances that led the customer to approve the transfer.

Cardwell described verification as a “critical bridge” between fraud prevention and fraud detection, according to FinextraTV. In practice, that places verification in a wider control framework rather than as a standalone barrier. It can help firms assess whether a transaction fits expected patterns, but further action may be needed when the risk profile changes.

He also pointed to the need for risk-based friction. That means adding extra checks or delays when indicators suggest a higher probability of fraud, rather than applying the same level of interruption to every customer journey.

The balance is operationally sensitive. Too little friction may leave firms exposed when a verified customer is being deceived. Too much friction can slow ordinary payments and damage the customer experience. Cardwell’s argument was that firms should calibrate intervention according to risk, rather than relying on verification as a universal control.

The discussion adds to a broader payments-sector debate over how firms should respond to fraud that can pass conventional identity and authorisation checks. Cardwell’s remarks, as reported by FinextraTV, place verification as one layer in that response: useful, necessary in many contexts and insufficient on its own.

This story draws on original reporting from Finextra Research.