Fraud Detection in BFSI, Insurance & Fintech: How It Differs by Segment

Banks, NBFCs, and Housing Finance Companies operate under the RBI’s revised Master Directions on Fraud Risk Management, issued 15 July 2024 as two separate but aligned directions: one for commercial banks and All India Financial Institutions, one for NBFCs (including Housing Finance Companies) and Urban Cooperative Banks. These require a board-approved fraud risk management policy built around Early Warning Signals and Red Flagging of Accounts, ongoing monitoring of credit facilities to catch fraud in loan accounts, and a formal show-cause process before an account gets classified as fraud. Anyone classified as a fraudster under this framework faces a five-year debarment from further financing from regulated entities, counted from full repayment or settlement.

Insurers work under a separate instrument entirely: the IRDAI Insurance Fraud Monitoring Framework Guidelines, 2025 (reference IRDAI/IID/GDL/MISC/112/10/2025, dated 9 October 2025), which applies to all insurers and distribution channels from 1 April 2026. It requires a Board-approved Anti-Fraud Policy reviewed at least annually, a Fraud Monitoring Committee headed by Key Management Personnel, and a Fraud Monitoring Unit that sits organizationally independent from internal audit, reporting quarterly to the Risk Management Committee. It also requires insurers to maintain a cybersecurity framework for cyber-fraud preventionand participate in the Insurance Information Bureau’s Fraud Monitoring Technology Framework for cross-insurer data sharing.

Fintechs are the odd case. Under RBI’s 2022 Digital Lending Guidelines, a fintech lending through a partnership model functions as a Loan Service Provider, while the partnering NBFC or bank remains the actual loan originator, responsible for compliance, for disbursement going directly into the borrower’s account, and for issuing the Key Fact Statement. Many fintechs never hold an NBFC or banking license themselves; they operate under RBI oversight indirectly, through their partner.

Banks and NBFCs: high-volume digital fraud, high-value loan fraud

RBI’s FY2023-24 Annual Report data shows digital-payment fraud (cards and internet) jumped from 6,699 cases in FY2022-23 to 29,082 cases in FY2023-24, an increase of over 400%, with the fraud amount reaching ₹14.57 billion, more than five times the prior year, and card/internet fraud’s share of total reported bank-fraud value rising from 1.1% to 10.4% year over year.

But the same data set shows frauds occur predominantly in digital payments by case count, while they’re reported primarily in the loan portfolio by value, meaning a bank is really managing two separate fraud problems under one budget line: high-volume, low-value digital fraud, and low-volume, high-value loan fraud. There’s also a detection-lag problem specific to the loan side: roughly 94% of frauds reported by banks in FY2023-24 had actually occurred in a prior fiscal year, with some cases taking more than two years between occurrence and detection. That’s a gap real-time transaction monitoring, built for the digital side, doesn’t touch.

Fintechs: UPI volume and account takeover concentrated in digital-native players

UPI fraud in FY2025 involved 12.64 lakh reported incidents and ₹981 crore, set against UPI processing 228 billion transactions worth ₹300 trillion over the year. Per JISA Softech’s reporting of an RBI June 2025 bulletin, account takeover fraud rose 310% year over year, with neobanks and digital wallets named as the most-targeted institution types. That attribution runs through a secondary source rather than the RBI bulletin directly, so treat the 310% figure as reported, not independently verified against the primary document.

Insurance: a two-stage fraud problem split across the policy lifecycle

Insurance fraud splits into two distinct problems that happen at different points in a policy’s life. Application or underwriting fraud (misrepresenting risk to get a lower premium or qualify for coverage at all) happens at the point of purchase and calls for document and data verification during underwriting. Claims fraud happens after a policy is already in force, ranging from inflating a legitimate claim to fabricating a loss entirely, and calls for claims-pattern and provider/repair-network analysis instead. IRDAI’s 2025 Framework formalizes this further, classifying insurance fraud into five categories: internal fraud by employees or senior management, distribution-channel fraud by intermediaries, policyholder/claims fraud, external fraud involving vendors or service providers, and affinity/complex fraud involving collusion across two or more of the other four.

The scale is significant on the health side specifically: a joint BCG–Medi Assist report published 24 November 2025 found India’s health insurance ecosystem loses roughly ₹10,000 crore annually to fraud, waste, and abuse, with the report’s own claims breakdown putting about 90% of claims as genuine, 2% as fraudulent, and 8% as inefficient or suspicious. On the detection side, published research on India-focused claims fraud has reported XGBoost-based models reaching around 89% accuracy and an 87% F1-score on motor and health claims, while a separate Markov-model-with-gradient-boosting approach reported around 97.10% accuracy and a 0.8546 F1-score on health insurance claims specifically. These are published study results, not guarantees of what any given deployment will achieve.

Segment Comparison

Two methodology choices sit underneath all three segments, and they matter independent of which industry you’re in.

Rules-based systems apply static, predefined logic: transaction-amount thresholds, velocity checks, geography flags. Industry literature notes these produce materially higher false-positive rates than machine-learning approaches, since a fixed rule set can’t adapt to a new fraud pattern without a manual update. ML systems instead score risk across many data signals at once and adapt as patterns shift, generally producing fewer false positives once trained on enough data. One illustrative case study from Fraud.net(a European Buy Now, Pay Later provider moving from rules-based to ML-driven detection) reported its fraud rate falling from 0.89% to 0.24%, manual review dropping to about 5% of transactions, account takeovers down 90%, and fraud losses down 73%. That’s one company’s reported outcome, not an independently audited industry benchmark, and shouldn’t be read as a number every institution will replicate.

Real-time detection scores each transaction individually as it happens, typically within a latency window commonly cited at under 100 milliseconds so a decision returns before the transaction authorizes. Batch detection instead collects transactions over a period and analyzes them together at scheduled intervals, unsuitable for stopping an in-progress fraudulent transaction, but still appropriate for lower-velocity review like periodic loan-portfolio checks, where the goal is detection and investigation rather than blocking in the moment. Which one a segment leans on tracks directly to what’s shown in the comparison table above: fintech and card/UPI fraud call for real-time scoring, loan-portfolio fraud calls for batch review.

Behavioral biometrics (keystroke dynamics, mouse or touch movement, session interaction patterns) add a passive layer that runs continuously through a session rather than at a single checkpoint, distinguishing it from one-time device fingerprinting or document checks. It’s used by financial institutions and, increasingly, insurers. RBI’s 2021 Digital Payment Security Controls directions require multi-factor authentication with at least one dynamic or non-replicable factor for electronic payments, a requirement industry commentary from Callsign frames as supporting the case for behavioral biometrics alongside or instead of static SMS OTPs.

In August 2025, the RBI released the report of its FREE-AI Committee, the Framework for Responsible and Ethical Enablement of AI in the financial sector, chaired by Professor Pushpak Bhattacharya of IIT Bombay. It applies to scheduled commercial banks, cooperative banks, NBFCs, payment system operators, and fintechs, and it sets an expectation that AI used for functions including fraud detection be explainable, auditable, and accountable, structured around seven guiding principles: Trust, People First, Innovation over Restraint, Fairness, Accountability, Understandability by Design, and Safety.

This is a functional requirement. An analyst or compliance reviewer needs to understand why a specific transaction or claim was flagged (which merchant category, velocity pattern, device anomaly, or behavioral deviation triggered the alert) to act on it, document the decision, and satisfy an audit. Read against that requirement, a model that scores well but can’t produce a reason code looks unready for a regulated fraud queue in India, whatever segment it’s deployed in.

Buyer guidance for the adjacent KYC/onboarding software category, per iDenfy, points to criteria that carry over directly to fraud detection evaluation:

• •Coverage and accuracy of the underlying checks: document-type coverage and certified liveness/face-match detection that can defend against presentation attacks and deepfake or face-morphing spoofing.
• •Screening depth: integrated AML and watchlist screening, not a bolt-on.
• •Data-security and compliance posture: how the vendor itself handles data, given it’s sitting inside a regulated pipeline.
• •Integration effort: how much developer work it takes to stand the system up.
• •Continuous monitoring, not a one-time check: the industry is moving toward “perpetual KYC,” where risk profiles and transaction behavior get monitored continuously after onboarding rather than verified once and left alone.

Add three fraud-detection-specific questions on top of that list. First, ask what the vendor’s real false-positive rate looks like in production, given how much that cost can dwarf the fraud itself. Second, ask whether flagged decisions come with an explanation an analyst can act on and document. That’s not optional under RBI’s FREE-AI expectations. Third, confirm whether the tool is built for real-time authorization, batch review, or both, and match that to your actual use case rather than the vendor’s default pitch.

Pricing also varies enough that it’s worth confirming the model before comparing quotes. Fraud detection software commonly comes priced as: per-transaction or per-prediction fees, roughly $0.00125 to $0.07 per transaction depending on volume tier; flat monthly subscription tiers, entry plans commonly $69–$250+/month and mid-tier plans starting around $1,000/month for unlimited checks and custom rules; or enterprise per-user or bundled licensing, roughly $15,000–$30,000/year per user up to $100,000–$300,000+/year once transaction-monitoring modules are included. Confirm which model actually fits your institution’s real transaction or case volume before comparing vendor numbers against each other.

Read together, the bank data (high case-volume digital fraud vs. high-value loan fraud) and the insurance data (application-stage fraud vs. claims fraud) point to the same underlying lesson from two different industries: within a single institution, “fraud” is usually at least two separate problems that get evaluated as if they were one. A bank buying a single fraud detection tool tuned for real-time digital-payment scoring is solving the high-volume half of its problem and leaving the high-value, slower-moving loan-fraud half (the one with a roughly 94% detection-lag rate) largely untouched. An insurer buying claims-fraud analytics alone is doing the same thing from the other direction, leaving underwriting fraud unaddressed. The practical implication is that “what does this tool detect” is a more useful evaluation question than “does this tool work,” since a vendor can be genuinely effective at one half of a segment’s fraud problem while doing nothing for the other half.

The false-positive economics and the explainability requirement point in the same direction when read together. If false positives can cost more than the fraud a system is meant to stop, and RBI’s FREE-AI framework treats explainability as a functional expectation rather than a preference, then a fraud detection evaluation that only asks “how accurate is this” and skips “how does it explain a flag, and what’s its real false-positive rate in production” is measuring the wrong thing. For a fintech operating as a Loan Service Provider specifically, there’s an added layer worth resolving before any vendor conversation starts: given that fraud-risk-management accountability in an LSP arrangement can sit with either the fintech or its partner bank/NBFC, it’s worth confirming which entity is actually on the hook before evaluating whose fraud detection stack (the fintech’s or the partner’s) is the one that needs to satisfy the regulator.