Fraud Detection and Transaction Monitoring

Two jobs that get bought as one

Institutions buy this once and expect two things that are not the same job. The first is stopping fraud: money is being taken from a customer or from you, now, and success is how much you stop and how fast. The second is meeting anti-money-laundering and counter-terrorist-financing obligations, where the money may be entirely genuine and the customer content, and the question is whether you can see what you are obliged to see and report what you are obliged to report.

They differ on nearly every axis. Fraud work is counted in minutes and answers to operations and risk. Compliance work is counted in files and judged years later on whether you can show what you did and why. When the first goes wrong you have an angry customer. When the second goes wrong you have a finding.

What each is worth differs by institution. A bank carries card, interbank and corporate payment exposure alongside the heaviest supervisory expectation, being supervised by the Bank of Tanzania. A SACCO or a microfinance institution loses smaller sums, has fewer people to spare, and finds much of its loss comes from inside. Telcos and fintechs run on small values at volume, where a method that works is repeated thousands of times before anyone adds it up.

How the money is actually taken here

Most fraud in this market is not exotic, and much of it turns on the phone number. The number is the key to a wallet, to a banking channel and to the message confirming a payment, so somebody who obtains a replacement SIM for it is most of the way into the customer's money. The customer finds out later, when the handset goes quiet. By then the funds have moved through several accounts and out again.

Then there is the person at the counter. Wherever cash changes hands at an agent or a shop, part of the loss comes from the person taking it: a deposit recorded short, a withdrawal put through twice, a PIN watched and used that evening, an account opened on somebody else's identity to receive what is stolen elsewhere. Agent networks widen the number of people with an opportunity.

Then there is the customer's own hand, now a large share of the total. A caller using your name, an offer, a family emergency, a job that needs a fee paid first. The customer authorises the payment themselves, so it is genuine in every respect except intent, which makes it painful to prevent and worse to explain afterwards. Behind all of it sit the accounts that carry the proceeds, opened by people paid a little to do so, and card payments made by somebody who never held the card.

An alert is only worth generating if someone works it

What institutions underestimate is what happens after something is flagged. An alert is not an outcome. Somebody has to open it, understand what they are looking at, decide, and defend that decision later. If that person does not exist, or is not working at ten on a Saturday night when the payment goes out, the alert records a loss rather than prevents one.

So the investigation queue and the case are as much the product as the detection. The journeys here belong to your own staff: working a queue in priority order, opening a case and reviewing the customer's history alongside the transaction, contacting the customer, holding or releasing a payment, freezing an account and lifting the freeze, escalating, recording the decision and the reason for it, and finding that record again months later. Around it sits what a supervisor needs: who is working what, and what is ageing.

The false positive is the cost left out of most business cases. Every genuine customer stopped is a supplier paid late, a trader stranded on market day, a salary that did not arrive, and sometimes a customer who quietly moves anything that matters to somebody else's account. Stop too little and you carry the loss. Stop too much and you pay in customers, and that bill never arrives itemised. That balance is a risk appetite decision, and it belongs to your risk committee rather than to a supplier.

Where it sits in your institution

Monitoring sits behind everything that moves money for you: the app, the USSD menu, agents, cards, internet banking, the branch counter and whatever your corporate customers use. Fraud goes to whichever of those is watched least, so a control bought channel by channel leaves its gaps exactly where the losses collect. Where each supplier watches only its own channel, nobody is answerable for the customer.

That makes this easier to scope across the estate than to attach to one channel at a time. It can be added to what you already run or built alongside a new channel.

What has to be settled before anything can be stopped

Almost everything that decides whether this works is yours rather than ours, and little of it is technical. Risk appetite comes first. How much loss you will carry, and how many genuine customers you will inconvenience to avoid it, is a decision for your board and your risk committee. Programmes that begin without it argue in circles for months.

Then the team and its hours. Named investigators, the hours they cover, and what happens on the evenings and weekends when fraud is at its most convenient. Then authority: who may hold a payment, who may freeze an account, who may release one, up to what value, and who can be reached when the decision will not wait until Monday. In most institutions these powers exist as practice rather than policy, and writing them down takes longer than people expect.

Then reporting. Banking is supervised by the Bank of Tanzania, and Tanzania's anti-money-laundering law places monitoring and reporting obligations on the institutions it covers. What you must report, in what form and to whom, is set by law and by your supervisor, and your compliance function owns that answer. We build to the obligations they give us. Software does not discharge them on your behalf.

Then the customer. Somebody has to settle what a customer is told when a payment is stopped, in which language, how quickly, and how they get the decision looked at again. You also need a position on losses you did not prevent: when a customer is defrauded, what you make good and what you do not. Both tend to be left until after launch, and both are what customers judge you on. Monitoring also means examining customer behaviour closely, which brings Tanzania's Personal Data Protection Act into scope.

Working with us

We start with discovery: the losses you are actually taking, what your investigations team does today, the obligations your compliance function works to, and the channels money moves over. The scope and plan that come out of it are yours whether or not we build it.

Through delivery you see working software in an environment you control rather than status reports, and the source code and documentation are yours from the first commit. We will usually argue for a period running alongside your existing process before anything is allowed to stop a customer's payment, because the cost of getting it wrong falls on people who did nothing wrong. Afterwards we support it and train your people. There is no lock-in, by design and by contract.