Australian banks lost AUD 2.74 billion to fraud in the 2024–25 financial year, according to the Australian Banking Association. That figure has increased every year for the past five years. And yet many of the banks sitting on the wrong side of those numbers had fraud detection software in place when the losses occurred.

The problem is rarely the absence of a system. It is a system that cannot keep pace with how fraud actually moves through modern payment rails — particularly since the New Payments Platform (NPP) made real-time, irrevocable fund transfers the standard for Australian banking.

This guide covers what genuinely separates effective fraud detection software from systems that look adequate until they are tested.

What AUSTRAC Requires — and What That Means in Practice

Before evaluating any vendor, it helps to understand the regulatory floor.

AUSTRAC's AML/CTF Act requires all reporting entities to maintain systems capable of detecting and reporting suspicious activity. For transaction monitoring specifically, Rule 16 of the AML/CTF Rules mandates risk-based monitoring — meaning detection thresholds must reflect each institution's specific customer risk profile, not generic industry defaults.

The enforcement record on this is specific. The Commonwealth Bank of Australia's AUD 700 million settlement with AUSTRAC in 2018 cited failures in transaction monitoring as a direct cause. Westpac's AUD 1.3 billion settlement in 2021 followed similar deficiencies at a larger scale. In both cases, the institution had monitoring systems in place. The systems failed to detect what they were supposed to detect because they were not calibrated to the risk actually present in the customer base.

The practical takeaway: AUSTRAC does not assess whether a system exists. It assesses whether the system works. Vendor selection that does not account for this distinction is selecting for demo performance, not regulatory performance.

The NPP Problem: Why Legacy Systems Struggle

The New Payments Platform changed the risk environment for Australian banks in a specific way. Before NPP, a suspicious transaction could often be caught during a clearing delay — there was a window between initiation and settlement in which a flagged transaction could be stopped or investigated.

With NPP, that window is gone. Funds move in seconds and are irrevocable once settled. A fraud detection system that operates on batch processing — reviewing transactions at the end of day or in periodic sweeps — cannot catch NPP fraud before the money has moved.

This is the single most important technical requirement for Australian fraud detection software today: genuine real-time processing, not near-real-time, not batch with a short lag. The system must evaluate risk at the point of transaction initiation, before settlement.

Most legacy rule-based systems were built for the batch processing era. Many vendors have retrofitted real-time capabilities onto batch architectures. Ask specifically: at what point in the payment lifecycle does your system evaluate the transaction? And what is the latency between transaction initiation and alert generation in a production environment?

7 Criteria for Evaluating Fraud Detection Software

1. Real-time processing before settlement

Already covered above, but worth stating as a discrete criterion. Ask the vendor to demonstrate alert generation against an NPP-format transaction scenario. The alert should fire before confirmation reaches the customer.

2. False positive rate in production

False positives are not just an efficiency problem — they are a customer experience problem and a regulatory attention problem. A system generating 500 alerts per day at a 97% false positive rate means 485 legitimate transactions flagged. At scale, that creates analyst backlog, customer complaints, and a compliance team spending most of its time reviewing non-suspicious activity.

Ask vendors for their false positive rate in a live environment comparable to yours — not a demonstration environment. Well-tuned AI-augmented systems reach 80–85% in production. Legacy rule-based systems typically run at 95–99%.

3. Detection coverage across all channels

Fraud in Australia does not stay within a single payment channel. The most common attack patterns involve coordinated activity across multiple channels: a fraudster may compromise credentials via phishing, initiate a small test transaction via BPAY, and execute the main transfer via NPP once the account is confirmed accessible.

A system that monitors each channel in isolation misses cross-channel patterns. Ask specifically: does the platform aggregate signals across NPP, BPAY, card, and digital wallet channels into a single customer risk view?

4. Explainability for AUSTRAC audit

When AUSTRAC examines a bank's fraud detection programme, they review alert logic: why a specific alert was generated, what the analyst decided, and the written rationale. If the underlying model is a black box — generating alerts it cannot explain in terms a human analyst can document — the audit trail fails.

This matters practically, not just in examination scenarios. An analyst who cannot understand why an alert was raised cannot make a confident disposition decision. Explainable models produce better analyst decisions and better regulatory documentation simultaneously.

5. Calibration flexibility

AUSTRAC requires risk-based monitoring — which means your detection logic should reflect your customer base, not the vendor's default library. A bank with a high proportion of small business customers needs different fraud typologies than a bank focused on high-net-worth retail clients.

Ask: can your team modify alert thresholds and add custom scenarios without vendor involvement? What is the process for calibrating the system to your customer risk assessment? How does the vendor support this without turning every calibration into a professional services engagement?

6. Scam detection capability

Authorised push payment (APP) scams — where the customer is manipulated into authorising a fraudulent transfer — are now the largest single category of fraud losses in Australia. Unlike traditional fraud, APP scams involve authorised transactions. Standard fraud rules built around unauthorised activity miss them entirely.

Ask vendors specifically how their system handles APP scam detection. The answer should go beyond "we have an education campaign" — it should describe specific detection logic: urgency pattern recognition, unusual payee analysis, first-time payee monitoring, and transaction amount pattern matching against known APP scam profiles.

7. AUSTRAC reporting integration

Threshold Transaction Reports (TTRs) and Suspicious Matter Reports (SMRs) must be filed with AUSTRAC within defined timeframes. A fraud detection system that requires manual export of alert data to a separate reporting tool introduces delay and error risk.

Ask whether the system supports direct AUSTRAC reporting integration or produces reports in a format that maps directly to AUSTRAC's Digital Service Provider (DSP) reporting specifications.

Questions to Ask Any Vendor Before You Sign

Beyond the seven criteria, these specific questions separate vendors with genuine Australian capability from those reselling global products with an AUSTRAC overlay:

• What is your alert-to-SMR conversion rate in production? A high SMR conversion rate (relative to total alerts) suggests alert logic is well-calibrated. A low rate suggests either over-alerting or under-reporting.
• Do you have clients currently running live under AUSTRAC supervision? Ask for reference clients, not case studies.
• How do you handle regulatory updates? AUSTRAC updates its rules. The vendor should have a defined content update process that does not require a re-implementation.
• What happened to your AUSTRAC clients during the NPP launch period? How the vendor managed the transition from batch to real-time processing tells you more about operational resilience than any benchmark.

AI and Machine Learning: What Actually Matters

Most fraud detection vendors now describe their systems as "AI-powered." That description covers a wide range — from basic logistic regression models to sophisticated ensemble systems trained on federated data.

Three AI capabilities are worth asking about specifically:

Federated learning: Models trained across multiple institutions detect cross-institution fraud patterns — particularly mule account activity that moves between banks. A system that only trains on your data cannot see attacks coordinated across your institution and three others.

Unsupervised anomaly detection: Supervised models learn from labelled fraud examples. They cannot detect novel fraud patterns they have not seen before. Unsupervised anomaly detection identifies unusual behaviour regardless of whether it matches a known typology — which is how new fraud patterns get caught.

Model retraining frequency: A model trained on 2023 data underperforms against 2026 fraud patterns. Ask how frequently models are retrained and what triggers a retraining event.

Frequently Asked Questions

What is the best fraud detection software for banks in Australia?

There is no single answer — the right system depends on the institution's size, customer mix, and payment channel profile. The evaluation criteria that matter most for Australian banks are real-time NPP processing, AUSTRAC reporting integration, and cross-channel visibility. Any short-list should include a live demonstration against AU-specific fraud scenarios, not just a product overview.

What does AUSTRAC require from bank fraud detection systems?

AUSTRAC's AML/CTF Act requires reporting entities to detect and report suspicious activity. Rule 16 of the AML/CTF Rules mandates risk-based transaction monitoring calibrated to the institution's specific customer risk profile. There is no AUSTRAC-approved vendor list — the obligation is on the institution to ensure its system performs, not simply to have one in place.

How much does fraud detection software cost for a bank?

Licensing costs vary widely — from AUD 200,000 annually for smaller institutions to multi-million-dollar contracts for major banks. The total cost of ownership calculation should include implementation (typically 2–4x first-year licence), integration, ongoing calibration, and the cost of analyst time lost to false positives. The cost of a regulatory enforcement action should also feature in a realistic TCO analysis: Westpac's 2021 AUSTRAC settlement was AUD 1.3 billion.

How do fraud detection systems reduce false positives?

Effective false positive reduction combines three elements: AI models trained on data representative of the specific institution's transaction patterns, ongoing feedback loops that update alert logic based on analyst dispositions, and calibrated thresholds that reflect customer risk tiers. Blanket reduction of thresholds lowers false positives but increases missed fraud — the goal is more precise targeting, not lower sensitivity.

What is the difference between fraud detection and transaction monitoring?

Transaction monitoring is the broader compliance function covering both fraud and anti-money laundering (AML) obligations. Fraud detection focuses specifically on losses to the institution or its customers. Many modern platforms cover both — but the detection logic, alert typologies, and regulatory reporting requirements differ.

How Tookitaki Approaches This

Tookitaki's FinCense platform handles fraud detection and AML transaction monitoring within a single system — covering over 50 fraud and AML scenarios including APP scams, mule account detection, account takeover, and NPP-specific fraud patterns.

The platform's federated learning architecture means detection models are trained on typology patterns from across the Tookitaki client network, without sharing raw transaction data between institutions. This allows FinCense to detect cross-institution attack patterns that single-institution training data cannot surface.

For Australian institutions specifically, FinCense includes pre-built AUSTRAC-aligned detection scenarios and produces alert documentation in the format AUSTRAC examiners review — reducing the gap between detection and regulatory defensibility.

Book a discussion with our team to see FinCense running against Australian fraud scenarios. Or read our [Transaction Monitoring - The Complete Guide] for the broader evaluation framework that covers both fraud detection and AML.

When authority is fabricated and trust is engineered, even the most implausible promises can start to feel real.

The Scam That Made Headlines

In a recent crackdown, the Philippine National Police arrested 15 individuals linked to an alleged investment scam that had been quietly unfolding across parts of the country.

At the centre of it all was a man posing as a “King” — a self-styled figure of authority who convinced victims that he had access to exclusive investment opportunities capable of delivering extraordinary returns.

Victims were drawn in through a mix of persuasion, perceived legitimacy, and carefully orchestrated narratives. Money was collected, trust was exploited, and by the time doubts surfaced, the damage had already been done.

While the arrests mark a significant step forward, the mechanics behind this scam reveal something far more concerning, a pattern that financial institutions are increasingly struggling to detect in real time.

Inside the Illusion: How the “King” Investment Scam Worked

At first glance, the premise sounds almost unbelievable. But scams like these rarely rely on logic, they rely on psychology.

The operation appears to have followed a familiar but evolving playbook:

1. Authority Creation

The central figure positioned himself as a “King” — not in a literal sense, but as someone with influence, access, and insider privilege. This created an immediate power dynamic. People tend to trust authority, especially when it is presented confidently and consistently.

2. Exclusive Opportunity Framing

Victims were offered access to “limited” investment opportunities. The framing was deliberate — not everyone could participate. This sense of exclusivity reduced skepticism and increased urgency.

3. Social Proof and Reinforcement

Scams of this nature often rely on group dynamics. Early participants, whether real or planted, reinforce credibility. Testimonials, referrals, and word-of-mouth create a false sense of validation.

4. Controlled Payment Channels

Funds were collected through a combination of cash handling and potentially structured transfers. This reduces traceability and delays detection.

5. Delayed Realisation

By the time inconsistencies surfaced, victims had already committed funds. The illusion held just long enough for the operators to extract value and move on.

This wasn’t just deception. It was structured manipulation, designed to bypass rational thinking and exploit human behaviour.

Why This Scam Is More Dangerous Than It Looks

It’s easy to dismiss this as an isolated case of fraud. But that would be a mistake.

What makes this incident particularly concerning is not the narrative — it’s the adaptability of the model.

Unlike traditional fraud schemes that rely heavily on digital infrastructure, this scam blended offline trust-building with flexible payment collection methods. That makes it significantly harder to detect using conventional monitoring systems.

More importantly, it highlights a shift: Fraud is no longer just about exploiting system vulnerabilities. It’s about exploiting human behaviour and using financial systems as the final execution layer.

For banks and fintechs, this creates a blind spot.

Following the Money: The Likely Financial Footprint

From a compliance and AML perspective, scams like this leave behind patterns — but rarely in a clean, linear form.

Based on the nature of the operation, the financial footprint may include:

• Multiple small-value deposits or transfers from different individuals, often appearing unrelated
• Use of intermediary accounts to collect and consolidate funds
• Rapid movement of funds across accounts to break transaction trails
• Cash-heavy collection points, reducing digital visibility
• Inconsistent transaction behaviour compared to customer profiles

Individually, these signals may not trigger alerts. But together, they form a pattern — one that requires contextual intelligence to detect.

Red Flags Financial Institutions Should Watch

For compliance teams, the challenge lies in identifying these patterns early — before the damage escalates.

Transaction-Level Indicators

• Sudden inflow of funds from multiple unrelated individuals into a single account
• Frequent small-value transfers followed by rapid aggregation
• Outbound transfers shortly after deposits, often to new or unverified beneficiaries
• Structuring behaviour that avoids typical threshold-based alerts
• Unusual spikes in account activity inconsistent with historical patterns

Behavioural Indicators

• Customers participating in transactions tied to “investment opportunities” without clear documentation
• Increased urgency in fund transfers, often under external pressure
• Reluctance or inability to explain transaction purpose clearly
• Repeated interactions with a specific set of counterparties

Channel & Activity Indicators

• Use of informal or non-digital communication channels to coordinate transactions
• Sudden activation of dormant accounts
• Multiple accounts linked indirectly through shared beneficiaries or devices
• Patterns suggesting third-party control or influence

These are not standalone signals. They need to be connected, contextualised, and interpreted in real time.

The Real Challenge: Why These Scams Slip Through

This is where things get complicated.

Scams like the “King” investment scheme are difficult to detect because they often appear legitimate — at least on the surface.

• Transactions are customer-initiated, not system-triggered
• Payment amounts are often below risk thresholds
• There is no immediate fraud signal at the point of transaction
• The story behind the payment exists outside the financial system

Traditional rule-based systems struggle in such scenarios. They are designed to detect known patterns, not evolving behaviours.

And by the time a pattern becomes obvious, the funds have usually moved.

Where Technology Makes the Difference

Addressing these risks requires a shift in how financial institutions approach detection.

Instead of looking at transactions in isolation, institutions need to focus on behavioural patterns, contextual signals, and scenario-based intelligence.

This is where modern platforms like Tookitaki’s FinCense play a critical role.

By leveraging:

• Scenario-driven detection models informed by real-world cases
• Cross-entity behavioural analysis to identify hidden connections
• Real-time monitoring capabilities for faster intervention
• Collaborative intelligence from ecosystems like the AFC Ecosystem

…institutions can move from reactive detection to proactive prevention.

The goal is not just to catch fraud after it happens, but to interrupt it while it is still unfolding.

From Headlines to Prevention

The arrest of those involved in the “King” investment scam is a reminder that enforcement is catching up. But it also highlights a deeper truth: Scams are evolving faster than traditional detection systems.

What starts as an unbelievable story can quickly become a widespread financial risk — especially when trust is weaponised and financial systems are used as conduits.

For banks and fintechs, the takeaway is clear.

Prevention cannot rely on static rules or delayed signals. It requires continuous adaptation, shared intelligence, and a deeper understanding of how modern scams operate.

Because the next “King” may not call himself one.

But the playbook will look very familiar.

In August 2023, Singapore Police Force executed the largest money laundering operation in the country's history. S$3 billion in assets were seized from ten foreign nationals who had moved funds through Singapore's financial system for years — through banks, through licensed payment institutions, through corporate accounts holding everything from luxury cars to commercial property.

For compliance teams at Singapore-licensed financial institutions, the question that followed was not abstract. It was: would our transaction monitoring have caught this?

MAS has been examining that question across the industry since, through an intensified supervisory programme that has put transaction monitoring under closer scrutiny than at any point in the past decade. This guide covers what Singapore law requires, what MAS examiners actually check, and what a genuinely effective transaction monitoring programme looks like in a Singapore context.

Singapore's Transaction Monitoring Regulatory Framework

Transaction monitoring obligations in Singapore flow from three regulatory instruments. Understanding the differences between them matters — particularly for payment service providers, whose obligations are sometimes confused with bank requirements.

MAS Notice 626 (Banks)

MAS Notice 626, issued under the Banking Act, is the primary AML/CFT requirement for Singapore-licensed banks. Paragraphs 19–27 set out monitoring requirements: banks must implement systems to detect unusual or suspicious transactions, investigate alerts within defined timeframes, and document monitoring outcomes in a form that MAS can review.

The full obligations under Notice 626 are covered in detail in our [MAS Notice 626 Transaction Monitoring Requirements guide](/compliance-hub/mas-notice-626-transaction-monitoring). What matters for this discussion is that Notice 626 sets a floor, not a ceiling. MAS expectations in examination have consistently run ahead of the minimum text.

MAS Notices PSN01 and PSN02 (Payment Service Providers)

Since the Payment Services Act (PSA) came into force in 2020, licensed payment institutions — standard payment institutions and major payment institutions — have had AML/CFT obligations that mirror the core requirements of Notice 626, adapted for the payment services context.

A cross-border remittance operator has the same obligation to monitor for unusual activity as a bank. The typologies look different — faster transaction cycling, higher cross-border transfer volumes, shorter customer history — but the regulatory requirement is equivalent.

This matters because some licensed payment institutions still treat their monitoring obligations as lighter than bank-grade. MAS examination findings published in the 2024 supervisory expectations document specifically noted that AML controls at payment institutions were "less mature" than at banks — which means this is now an examination priority.

MAS AML/CFT Supervisory Expectations (2024)

The 2024 MAS supervisory expectations document is the most direct signal of what MAS is looking for. It followed the 2023 enforcement action and a broader review of AML/CFT controls across supervised institutions.

Transaction monitoring appears in three of the five priority areas in that document:

• Alert logic that is not calibrated to the institution's specific risk profile
• Insufficient monitoring intensity for high-risk customers
• Weak documentation of alert investigation outcomes

None of these are technical failures. They are process and governance failures — which is what makes them significant. An institution can have sophisticated monitoring software and still fail on all three.

What MAS Examiners Actually Check

Notice 626 describes what is required. MAS examinations test whether requirements are met in practice. Based on examination findings and regulatory guidance, MAS reviewers focus on four areas in transaction monitoring assessments.

Alert calibration against actual risk

MAS does not expect every institution to use the same alert thresholds. It expects every institution to use thresholds that reflect its own customer risk profile.

An institution whose customers are predominantly high-net-worth individuals with complex cross-border financial structures should have monitoring rules calibrated for that population — not rules designed for retail banking that happen to flag some of the same transactions.

In practice, examiners ask: how were these thresholds set? When were they last reviewed? What changed in your customer book since the last calibration, and how did the monitoring reflect that? Institutions that cannot answer these questions specifically — with dates, documented rationale, and sign-off from a named senior officer — are likely to receive findings.

Alert investigation documentation

This is where most examination failures occur, and it is not because institutions failed to review alerts.

MAS expects a written record for each alert: what the analyst found, why the transaction was or was not considered suspicious, and what action was or was not taken. A disposition of "reviewed — no SAR required" without supporting rationale does not satisfy this requirement. The expectation is closer to: "reviewed the customer's transaction history, the stated purpose of the account, and the counterparty profile. The transaction pattern is consistent with the customer's documented business activities and does not meet the threshold for filing."

Institutions that have good detection logic but poor investigation documentation often present worse in examination than institutions with simpler detection that document everything carefully.

Coverage of high-risk customers

FATF Recommendation 10 and Notice 626 both require enhanced monitoring for high-risk customers. MAS examiners check whether the monitoring programme reflects this operationally — not just in policy.

A specific check: do high-risk customers generate more alerts per capita than standard-risk customers? If not, one of two things is happening: either the monitoring programme is not applying enhanced measures to high-risk accounts, or it is applying enhanced measures but they are not generating additional alerts — which means the enhanced measures are not actually detecting more.

Either way, the institution needs to be able to explain the distribution clearly.

The audit trail

When MAS examines a monitoring programme, examiners review a sample of alerts from the past 12 months. For each sampled alert, they should be able to see: which rule or model triggered it, when it was assigned for investigation, who reviewed it, what the disposition decision was, the written rationale, and whether an STR was filed.

If any of these elements cannot be produced — because the system does not log them, or because records were not retained — the examination finding is straightforward.

Post-2023: What Changed

The 2023 enforcement action changed the operational context for transaction monitoring in Singapore in three specific ways.

Typology libraries need to reflect the patterns that were missed. The S$3 billion case involved specific patterns: shell companies receiving large transfers followed by property purchases, multiple entities with overlapping beneficial ownership, cash-intensive businesses used to layer funds into the formal banking system. These are not novel typologies — FATF and MAS had documented them before 2023. The question is whether monitoring rules were actually in place to detect them.

MAS has increased examination intensity. Following the 2023 case, MAS publicly committed to strengthening AML/CFT supervision, including more frequent and more intrusive examinations of systemically important institutions. Compliance teams that previously experienced relatively light-touch monitoring reviews should expect more detailed examination engagement going forward.

The reputational context for non-compliance has shifted. Before 2023, AML failures in Singapore were largely a technical compliance matter. After an enforcement action that received global coverage and led to diplomatic implications, the reputational consequences of a significant AML failure for a Singapore-licensed institution are much more visible.

Transaction Monitoring for PSA-Licensed Payment Institutions

For firms licensed under the PSA, there are specific practical considerations that bank-focused guidance does not address.

Shorter customer history. Payment service firms typically have shorter customer relationships than banks — sometimes months rather than years. ML-based anomaly detection models need historical data to establish baseline behaviour. When that history is limited, rules-based detection of known typologies needs to carry more weight in the alert logic.

Cross-border transaction volumes. PSA licensees handling international remittances have inherently higher cross-border exposure. Monitoring typologies must specifically address: structuring across multiple corridors, unusual shifts in destination country distribution, and dormant accounts that suddenly receive high-volume cross-border inflows.

Account lifecycle monitoring. New accounts that begin transacting immediately at high volume, or accounts that show no activity for an extended period before suddenly becoming active, are specific patterns that PSA-specific monitoring rules should address.

MAS has stated directly that it expects payment institutions to "uplift" their AML/CFT controls to a level closer to bank-grade. For transaction monitoring specifically, that means investment in calibration, documentation, and governance — not simply deploying a vendor system and assuming requirements are met.

What Effective Transaction Monitoring Looks Like in Singapore

Across MAS guidance, examination findings, and the post-2023 supervisory environment, an effective Singapore TM programme has six characteristics:

1. Documented calibration rationale. Alert thresholds are set with reference to the institution's customer risk assessment and reviewed when the customer book changes. Every threshold has a documented basis.

2. Coverage of Singapore-specific typologies. Beyond generic AML typologies, the monitoring library includes patterns documented in Singapore enforcement actions: shell company structuring, property-linked layering, cross-border transfer cycling across high-risk jurisdictions.

3. Alert investigation documentation that can survive examination. Every alert has a written disposition, not a checkbox. High-risk customer alerts have enhanced documentation. STR filings link back to specific alerts.

4. Defined escalation process. When an analyst is uncertain, there is a clear path to the Money Laundering Reporting Officer. Escalation decisions are recorded.

5. Regular calibration review. The monitoring programme is tested — whether through independent review, internal audit, or structured self-assessment — at least annually. Results and follow-up actions are documented.

6. Model governance for ML components. Where ML-based detection is used, model performance is tracked, validation is documented, and retraining triggers are defined. The validation record sits with the institution.

Taking the Next Step

If your institution is preparing for a MAS examination, reviewing its monitoring programme post-2023, or evaluating new transaction monitoring software, the starting point is a clear-eyed assessment of where your current programme sits against MAS expectations.

Tookitaki's FinCense platform is used by financial institutions across Singapore, Malaysia, Australia, and the Philippines. It is pre-configured with APAC-specific typologies — including patterns documented in Singapore enforcement actions and produces alert documentation in the format MAS examiners review.

Book a discussion with Tookitaki's team to see FinCense in a live environment calibrated for your institution type and region.

For a broader introduction to transaction monitoring requirements across all five APAC markets — Singapore, Australia, Malaysia, Philippines, and New Zealand — see our [complete transaction monitoring guide].