How to Use Behavioral Science to Reduce Fraud Risk in Consumer Fintech

Last updated October 14, 2026

Americans reported losing $15.9 billion to fraud in 2025, up from just over $12 billion the year before, according to US Federal Trade Commission testimony on 2025 fraud reports, and investment scams made up about half of that total. In a Gallup and Stop Scams Alliance survey of 5,173 US adults, victims said about 1 in 8 of the scams that took their money in 2025 involved AI or deepfakes.

At The Decision Lab, we are an applied behavioral science consultancy that runs experiments on investor and consumer susceptibility to fraud. We help financial services firms and the regulators who oversee them test fraud-prevention interventions at the moments where customers are most vulnerable, so that scam losses fall without adding needless friction for legitimate customers. Behavioral science reduces fraud risk in consumer fintech by redesigning the few moments where scams succeed, such as adding a new payee or acting on an investment pitch, so that customers switch from fast, automatic judgment to deliberate checking at those points.

Our fraud work includes a controlled experiment that made a fraudulent investment pitch less appealing to adults over 60 and evidence-based design for the Ontario Securities Commission's investor protection resources, alongside behavioral research and product design for fintech and banking clients such as Moka and Capital One. This guide sets out the framework we use, the AI trust problems that make it more urgent, what safe AI assistance looks like, how to test fraud interventions and how regulators are changing the incentives around them.

1. Targeted friction. Slow customers down only where risk signals appear, such as a first payment to a new payee or a sudden large transfer to a crypto exchange.
2. Big-picture prompts. Before a high-stakes decision, ask customers to step back to their goals and risk tolerance, which counters the narrow, urgent focus scammers try to create.
3. Inoculation. Show customers weakened examples of real scam tactics before they meet the real thing, so they recognize the pattern under pressure.
4. Specific, graded warnings. Tie each warning to the scam pattern detected and to one clear action, in place of a generic alert customers learn to dismiss.
5. Verification outside the scammer's channel. Give customers a fast way to confirm a payee, adviser or platform through a route the scammer does not control.

Scams succeed by getting someone to act quickly on a narrow slice of information, and most consumer fintech products are built to make acting quickly easy. A faster payment flow serves honest customers and scammers alike.

The research we reviewed for our older-investor fraud experiment points to two mechanisms behind much of the risk. People rely more on fast, automatic judgment as decisions get harder and as they age, and they fix on the concrete details in front of them while losing the bigger picture. Psychologists call that detail focus low-level construal. A message demanding a $200 deposit within 24 hours to claim lottery winnings works because it keeps attention on the deadline and the payoff, away from whether the sender is real.

Scammers then add social and emotional pressure, posing as a relative or a trusted institution. In the FTC's 2025 fraud data, scams that started on social media accounted for more than $2 billion in reported losses, and bank payments, followed by cryptocurrency, were the payment methods behind the largest losses. Both sit inside or right next to consumer fintech products.

How protective information is presented matters as much as whether it exists. In our work on the Ontario Securities Commission's investor education site, we found that a large, cluttered library of sound advice can produce information overload and choice paralysis, so people stall before they reach the guidance meant to protect them. Our recommendation was to restructure the existing content into guided courses and to time reminders to the moments just before key financial decisions.

1. Targeted friction

Friction applied everywhere annoys honest customers and teaches them to click through every prompt, including the one that matters. We design friction around the risk signals a fraud team already has, such as a first payment to a new payee or a transfer far larger than the customer's usual pattern. Behavioral science decides what happens inside the pause: what the customer is asked and how easy it is to stop.

2. Big-picture prompts

In our randomized experiment on investor susceptibility to fraud, 102 adults in North America, split equally between an 18 to 25 group and a 60-plus group, viewed an investment email carrying common red flags of fraud. Half were randomly assigned to complete a short personal financial risk assessment first. Among adults over 60, those who skipped the assessment were more drawn to the pitch than those who completed it, from how trustworthy it seemed to how willing they were to invest. The assessment made no difference for the younger group, which suggests it worked on the narrow, detail-focused thinking that becomes more common with age.

Our research with Capital One on financial stress pointed the same way: the negative effects of financial stress held even after accounting for household income and credit score, and simple prompts to zoom out before a financial choice helped people decide from their goals. In a fintech product, the equivalent is a brief goals and risk check placed before a first investment in an unfamiliar asset or a large outbound transfer.

3. Inoculation

Inoculation means exposing people to a weakened version of a manipulation tactic, with an explanation, so they recognize it later. In a 2024 Ontario Securities Commission experiment, participants in a simulated investing task put 22% more money into AI-enhanced scams than into conventional ones. Both countermeasures the study tested, inoculation and a simulated browser plug-in that flagged high-risk offers, reduced how much participants invested in the scams. Fintech products can build the same idea into onboarding, for example by showing a short example of a deepfake celebrity endorsement before a customer first funds an investing account.

4. Specific, graded warnings

A generic alert that appears on every transfer becomes background noise. We have seen what changes when risk messages are graded: for Mila's COVI contact tracing app, we helped replace a binary exposed or not-exposed alert with graded risk guidance, and Apple and Google later moved their exposure notification system to multi-level risk alerts. Fraud warnings benefit from the same logic. A warning that names the pattern detected, for example an investment offer that began on social media, and gives one clear action is easier to act on than a blanket caution, and its timing should sit just before the decision it is meant to change.

5. Verification outside the scammer's channel

Most scams depend on the victim checking the scammer's claims through channels the scammer controls, such as a link or a phone number. Products can break that loop by making independent checks fast and on by default, for example confirming the name on a receiving account before money moves, or checking whether the person offering an investment is registered. The Ontario Securities Commission already urges investors to check the registration of anyone offering an investment. Building that check into the payment or investing flow turns advice customers rarely follow into a step they take without extra effort.

AI changes fraud risk in two directions at once: it makes scams more convincing, and it puts AI advisers inside the products customers already trust. The Gallup and Stop Scams Alliance researchers expect their 1 in 8 figure for AI-involved scams to be an undercount, because victims often cannot tell when AI was used against them. The Ontario Securities Commission's AI and retail investing research adds a second finding: in an earlier experiment, retail investors followed investment suggestions from an AI adviser about as closely as suggestions from a human one.

That level of reliance cuts both ways. In a study of AI-driven manipulation by Sahand Sabour, Tim Althoff and colleagues, people discussed a financial or an emotional decision with AI assistants, some of which had a hidden goal of steering them toward a worse option. In the financial scenarios, nearly 9 in 10 participants still rated one of the manipulative assistants as helpful, against almost all participants who used the neutral assistant. A fintech that launches an AI assistant is therefore also launching a new channel that impostors will copy, and customers will extend it trust before they have reason to.

AI trust becomes manageable when it is treated as a design and governance capability, decided in advance for the moments fraud targets. These are the six principles we apply when we review AI features in financial products.

1. Say clearly when customers are dealing with AI. The label belongs inside the conversation, not only in the terms of service, so customers can tell the product's own assistant apart from a scammer imitating it.
2. Keep AI outputs within what the product is authorized to do. An assistant should not present general information as personalized financial advice unless the product is designed and authorized to give that advice.
3. Put a human one step away at high-stakes moments. When a customer is about to send a large payment or act on an investment tip, a route to a person should be immediate. In our AI strategy work with BDC, Canada's bank for entrepreneurs, every AI capability we specified kept human judgment as the point of trust.
4. Keep verification independent of the assistant. Confirming a payee or an adviser should run through a channel that is separate from the AI assistant and from anyone who contacted the customer, including the person being paid.
5. Test how design choices change reliance. AI labels, confidence wording, source citations and escalation prompts can each raise or lower how closely customers follow an assistant, and the direction is hard to predict in advance, so we test them against a control before launch.
6. Monitor who bears the harm. Track fraud outcomes by age, digital literacy, language and financial vulnerability, because protections and risks both differ by group.

The test that matters is whether customers lose less money, measured against a comparable group who did not get the intervention. Published results are a starting point only. When Stefano DellaVigna and Elizabeth Linos pooled 126 randomized trials run at scale by two US government nudge units, the average rise in take-up of the target behavior over control groups was 1.4 percentage points, about a sixth of the 8.7 points across 74 nudges published in academic journals. We test in the client's own product and customer base for that reason.

We start with a behavioral diagnostic of the journey where losses happen, mapping each step where a customer could stop and the barriers that keep them from stopping. COM-B, a widely used model of the conditions a behavior needs, helps structure that map, and we used it when we rebuilt financial planner training for FP Canada. From the diagnostic, we pick the method that fits the decision the client has to make.

Controlled experiments give the strongest evidence, but they are not always necessary or appropriate. For Money Guided, a 400-participant controlled experiment of four product framings against a control shaped the product before launch, and we were clear that it validated the design while in-product behavior remained the next test. In fraud work, the ethical rule we follow is to randomize the protection and never the exposure: no customer should face more risk because of the group they were assigned to.

Whatever the method, we track two numbers together, fraud losses and friction costs for honest customers, because an intervention that stops scams by stopping most legitimate payments has only moved the problem.

Regulators are moving responsibility for scam losses toward the firms whose products scams pass through, and that change makes behavioral evidence a compliance asset as well as a design tool.

In the UK, payment firms have had to reimburse most consumer victims of authorised push payment scams, where a customer is tricked into sending money themselves, since 7 October 2024, up to £85,000 per claim. In the 18 months to 31 March 2026, firms returned 88% of the money lost to reimbursable scams of this kind, about £316 million, against a 61% rate UK Finance reported for 2024 on a broader definition, according to the Payment Systems Regulator's APP scams reimbursement dashboard. An independent evaluation of the UK reimbursement rules by Frontier Economics found that losses to these scams over Faster Payments, the UK's main instant payment system, fell by about a fifth in the policy's first year, roughly £73 million a year, as firms tightened fraud controls on both sending and receiving payments.

The common objection to the rules was moral hazard, the worry that guaranteed refunds would make customers careless. The regulator has reported no sign of customers becoming significantly less cautious, with about 3 in 100 claims rejected because the customer had not taken enough care.

Australia's Scams Prevention Framework Act 2025 goes further upstream. It covers banks alongside the telecommunications and digital platform companies that carry scam messages, and requires them to prevent, detect, disrupt, respond to and report scams. According to the Australian Competition and Consumer Commission's Scams Prevention Framework page, most obligations apply from 31 March 2027, and the detailed codes were still being developed by government at the time of writing.

In the US, the Financial Crimes Enforcement Network issued a November 2024 alert on fraud schemes involving deepfake media after seeing more suspicious activity reports that described suspected deepfakes, many of them used to get past identity checks when opening accounts. The alert asks financial institutions to flag these cases in their reports, so deepfake fraud is now something US regulators expect firms to detect and record.

Securities regulators are also using behavioral experiments to set policy. The Ontario Securities Commission describes its AI scam research as evidence for behavioral science as a policy tool for regulators. For fintech teams, the practical consequence is that a regulator or a dispute body may ask what a firm did at the moment of payment, and whether it worked.

We design and run behavioral experiments on investment fraud and fraud susceptibility for two kinds of teams that need the same evidence. Product and trust and safety teams at fintechs and banks want interventions that cut losses without driving away honest customers. Research and investor protection teams at regulators want to know how people actually respond to scams and to AI advice.

A typical engagement moves from a behavioral diagnostic of the journey where losses happen, to a shortlist of interventions matched to specific customer groups, to controlled tests run in a simulation or in the product, and then to support while the winning version is built. We draw on our published research on older investors and financial fraud, our investor protection design work with the Ontario Securities Commission, our research on financial stress with Capital One and our behavioral product design for fintechs such as Moka, where we designed time-cued nudges and a plan to test their effect after rollout.

The questions we are asked most often now involve AI: how susceptible investors are to AI-made scams, and whether customers treat AI-generated advice differently once it is labeled.

What is behavioral fraud prevention in fintech?

Behavioral fraud prevention designs the moments where customers decide to send or invest money so that scams are easier to spot and stop. It complements detection models. Detection decides when a transaction looks risky, and behavioral design decides what the customer sees and does next. Many scams that detection flags still go ahead at that step.

Do scam warnings actually work?

Some do, under specific conditions. Warnings work better when they name the scam pattern detected and offer one clear action just before the decision, while generic warnings shown on every payment tend to be ignored. Effects also vary by customer group: in our older-investor study, a short risk assessment changed how adults over 60 judged a fraudulent pitch and had no effect on adults aged 18 to 25.

Does adding friction to payments hurt conversion?

Blanket friction does, and it also trains customers to click through warnings. Friction targeted at risk signals, such as a first payment to a new payee, affects a small share of transactions. Teams should track abandoned legitimate payments alongside fraud losses in every test, so that a gain on one measure is not hiding a loss on the other.

How can fintechs protect customers from AI-generated scams?

AI removes many cues customers used to rely on, such as poor spelling or an unfamiliar voice. Protection shifts toward verification that a deepfake cannot fake, such as confirming payee names or calling back on a known number. Inoculation, showing customers realistic examples in advance, also reduced scam investments in a regulator-run experiment.

Which consultancies run experiments on investor susceptibility to fraud?

Academic researchers and a small number of behavioral science consultancies run these experiments, often in partnership with securities regulators. At The Decision Lab, we design and run randomized experiments on investor and consumer susceptibility to fraud, from simulated investment pitches to tests inside live products, and we publish findings such as our study of fraud susceptibility in adults over 60.

How do you test a fraud intervention without exposing customers to real scams?

Most testing starts with simulated scams, where participants respond to realistic mock pitches and researchers measure what they choose. In live products, the safe approach is to randomize the added protection, not the risk, so every group keeps at least the protection it already had. Losses and abandoned payments are then compared across groups.