Payment Fraud

Stop the fraudulent payment, not the honest one.

WICS Payment Fraud checks every payment in real time, in the same flow as sanctions screening. It learns how each customer usually pays from your bank’s own history, scores each payment with its reasons in plain words, and holds only what looks wrong — for a person to decide.

Book a demo See the signals

Outgoing and incoming payments · SWIFT MT and ISO 20022 · REST, SOAP, IBM MQ, Kafka, SFTP

wics.your-bank.internal/payment-fraud/live

WICSPayment Fraud · Live

38AK

Payments checked now

Live

pacs.008IBM MQ14:02:11Sanctions: no hit

From

Cedar Foods SARL

Orchard Packaging GmbH

PT50 •••• 9023New account

164,000.00 EUR

Bank details changed yesterday+20
9× the usual amount+26
New beneficiary account+16
First payment to Portugal+12

Risk score

Hold at 60

Hold for reviewCase ⁨F-3107⁩ openedAnswerHOLD → IBM MQ

Checked today: 52,407
Released: 52,369
Held for review: 38

Illustrative — invented names and figures.

In the payment flow

One check, one answer, before the money moves.

Payments reach WICS the way they already do for sanctions screening. WICS screens and scores each one in the same pass, then sends one answer back to the payment system.

Your payment systems

REST API
SOAP API
IBM MQ
Kafka
SFTP
Watched folder
On screen

WICSMT103

Sanctions screeningNo hit
Fraud check87

Screened and scored in one pass

One answer back

Release
Hold for review
Block

Sent back on the channel it came from

The same channels: REST and SOAP APIs, IBM MQ, Kafka, SFTP, watched folders, or on screen
The same formats: SWIFT MT and ISO 20022
One answer: release, hold for review, or block
WICS never releases or cancels a payment on its own when a deadline passes. A person decides.

MT103
MT202 COV
pacs.008
pacs.009
pain.001
ISO 20022
SWIFT MT
REST
SOAP
IBM MQ
Kafka
SFTP
MT103
MT202 COV
pacs.008
pacs.009
pain.001
ISO 20022
SWIFT MT
REST
SOAP
IBM MQ
Kafka
SFTP

Signals

The signs that a payment is not what it seems.

Each signal is measured against the customer’s own history at your bank. Together, they make the score.

Something new

A new beneficiary, a first payment to a country, a new corridor.

Far above the usual amount

A payment many times larger than this customer usually sends.

Sudden bursts

Many payments from one account in a short time — velocity.

Split under a limit

Several payments just under a limit, to the same place.

Many senders, one account

One beneficiary account paid by many unrelated customers — the mule pattern.

Details changed, then a big payment

The beneficiary’s bank details change just before a large payment — the invoice and business e-mail fraud pattern.

Duplicate payments

The same amount, beneficiary and reference, sent twice.

Unusual time

A payment at an hour or on a day this customer never uses.

High-risk countries

Destinations on the FATF lists and the other WICS country lists.

Behaviour profile

Each customer’s usual, learned from your own history.

WICS builds a profile for every customer and account: usual amounts, currencies, countries, beneficiaries, days and hours. Each new payment is compared with it.

Built only from your bank’s own data
One profile per customer and per account
What is usual, and what this payment did, side by side

wics.your-bank.internal/payment-fraud/profiles/cedar-foods

WICSPayment Fraud · Behaviour profile

Cedar Foods SARL

Customer since 2019 · FR76 •••• 4471

Built from 14 months · 2,318 payments

Compare a payment

Amount
164,000.00 EUR4k32k
9× usual
Currency
EUR94%USD6%
Usual
Country
- DE
- FR
- ES
- IT
- BE
- PT· first time
Unusual
Beneficiary
Orchard Packaging GmbHKnown name, new account — changed yesterday · PT50 •••• 9023
Unusual
Day and hour
MonTueWedThuFriSatSun
Tue 14:02
Usual

3 of 5 unusual·Score 87Hold for review

Try it: pick a payment.Illustrative — invented names and figures.

Explained score

Every score comes with its reasons.

Each payment gets a risk score from 0 to 100. The officer sees why, in plain words: each reason, and how much it added or took away.

Reasons from the profile, the fraud patterns and the model
Your threshold decides what is held
The reasons stay on the case for the reviewer

wics.your-bank.internal/payment-fraud/cases/explain

WICSPayment Fraud · Why this score?

Cedar Foods SARLOrchard Packaging GmbH164,000.00 EUR

Held because the supplier’s bank details changed yesterday and the amount is 9× the usual.

Starting point for this customer13
Supplier’s bank details changed yesterday+20
Amount is 9× the usual+26
Beneficiary account never paid before+16
First payment to Portugal+12
Close to payments you confirmed as fraud+8
Customer for 7 years, no fraud−5
Sent during the usual hours−3
Score87

ProfilePatternAI modelHold at 60Hold for review

Try it: switch payments.Illustrative — invented names and figures.

Learns from your decisions

A model trained on your own decisions.

Each case closed as confirmed fraud or genuine teaches WICS. An AI model trained on your bank’s decisions sharpens the score over time.

Trained only on your bank’s decisions: confirmed fraud or genuine
Its part in the score is shown, like every other reason
Your rules and thresholds stay in charge

wics.your-bank.internal/payment-fraud/model

WICSPayment Fraud · Model

Confirmed fraud

202

Genuine

3,750

Latest closed cases

Your bank’s data only

F-3119Confirmed fraud· after callbackA. Karim · S. Haddad
F-3118Genuine· after reviewA. Karim · S. Haddad
F-3117Genuine· customer confirmedA. Karim · S. Haddad

How the model scores past payments

Version 4 · trained on 3,952 decisions

600100

GenuineFraudHold at 60

Illustrative — invented names and figures.

Rules in plain words

Write the rule the way you would say it.

Type “Hold payments above 50,000 USD to a new beneficiary”. WICS reads the sentence and fills in the rule. Try it on past payments; a second person approves it before it goes live.

Ready-made fraud rule templates

wics.your-bank.internal/payment-fraud/rules/new

WICSRules · Payment Fraud

Templates

Describe the rule in words

Hold payments above 50,000 USD to a new beneficiary

Read it

What should this rule do?
Hold for review
Which payments?
- Amountabove50,000 USD
- andBeneficiaryisnew — never paid before
Name, check, save
Large payment to a new beneficiary
When a payment is above 50,000 USD and goes to a beneficiary never paid before, hold it for review.

Try on history

Last 90 days · 52,410 payments

37of 52,410

would have been held

By week

Draft saved
Tried on history37
Approved by S. Haddad
Switched on

Try it: pick a template.Illustrative — invented names and figures.

Draft

Write the sentence, or start from a template.

Try on history

See which past payments it would have held.

Second approval

Another person checks the rule and approves it.

Switch on

The rule runs on every new payment.

Case desk

Held, called back, decided by two people.

A held payment opens a case on the same desk as screening. The countdown shows the deadline the payment system sent. The callback to the customer is recorded on the case, and every release of a high-risk payment needs a second person.

A countdown to the payment system’s deadline
The callback to the customer, recorded on the case
Four eyes on every release of a high-risk payment
The full history: who did what, and when

Confirmed fraud? Stop and recall.

A confirmed fraud can start a stop-and-recall request in WICS Payment Tracking.

Payment Tracking

wics.your-bank.internal/cases/payment-fraud

WICSCases · Payment Fraud

3AK

F-3107Payment Fraud87

Cedar Foods SARLOrchard Packaging GmbH164,000.00 EUR

Fraud confirmed — blocked

Why it was held

Bank details changed yesterday
9× the usual amount
New beneficiary account

Callback to the customer14:11

Finance director, on the number the bank holds · +33 1 •• •• 47 12

“Did not order this payment. The supplier’s e-mail was fake.”

ReleaseBlockEscalateComment

Proposed by A. Karim·Approved by S. Haddad

Answer sentBLOCK → IBM MQStop and recall requested · Payment Tracking

28:10

Decided

Deadline 14:45

Sent by the payment system

14:02Case opened · payment held
14:05Taken by A. Karim
14:11Callback recorded
14:14Block proposed
14:16Approved by S. Haddad
14:16Answer sent
14:17Recall requested

At the deadline, WICS alerts the supervisor. It never releases or cancels on its own.

Illustrative — invented names and figures.

Reports & alerts

What was held, what was fraud, which rules work.

Ready reports in the report centre: payments held, fraud confirmed, amounts protected, and the false-alarm rate of each rule. Run them on screen, or have them sent on a schedule.