Fraud Red Flags:
Reading the Patterns, Not Just the Rules

A customer logs in from their usual device. IP and location match every prior session. Six minutes later, the account password is changed. Four minutes after that, a £2,400 checkout attempt for digital gift vouchers comes from an Android device on a residential proxy IP geolocating to Lagos, Nigeria, with a device fingerprint that no longer matches the account's history.

A customer's account shows a large outbound transfer request. The session, device, and biometrics all match the customer's usual pattern with no sign of compromise. A £45,000 transfer is requested to a domestic business account that was opened 41 hours ago. Around the same time, a support call has the customer sounding panicked, referencing an urgent "crypto bond opportunity" someone told them about.

A small merchant account, registered as a handmade candle retailer, has processed a steady, low volume of £15 to £40 transactions during normal daytime hours for months. Overnight on a Saturday, processing volume surges roughly 1,200% above baseline. Transaction values shift to round figures, £500, £1,000, £2,500, nothing resembling candle retail. International card authorisation failure rate for this merchant hits 65% during the same window.

A personal current account, dormant for 14 months, receives a £2,400 cash deposit at a branch ATM. Roughly five hours later, a second deposit of £2,350 lands at a different ATM in the same area. The next morning, two more deposits, £2,480 and £2,290, land within the same window at two further locations. That afternoon, a fifth deposit of £2,410 completes the pattern, five deposits totalling £11,930 across five locations inside roughly 36 hours.

Unlike the US, where a fixed $10,000 threshold triggers automatic currency transaction reporting, the UK has no equivalent fixed pound threshold, suspicion is based on the pattern of behaviour, not a specific figure.