AI in Banking: How Banks Check Fraud and Lend

How banks spot fraud before money moves

A bank sees millions of payments a day, and no team of people could read them all. Fraud detection models do the first pass. They learn what normal looks like for each account — the usual places, amounts, times of day and devices — and give each new payment a risk score. A payment that fits the pattern goes through. One that breaks it, such as a large transfer from a new device at 3 a.m., can be held or blocked while the bank contacts the customer.

The Bank of England and FCA survey found fraud detection was the third most common AI use among firms, named by 33% of respondents.

UK Finance, the banking industry body, reported that criminals stole £1.28 billion through payment fraud in 2025, a 4% rise on the year before. But unauthorised fraud, where a criminal makes a payment without the account holder's consent, fell 5% to £703.4 million. Banks stopped a further £1.68 billion in unauthorised fraud before it reached a victim, about 70p in every £1 attempted.

The harder problem is authorised push payment fraud, known as APP fraud. Here the customer is manipulated into sending the money themselves, so the payment looks normal to the bank. APP fraud losses rose 19% to £576.4 million in 2025,, and investment fraud was the largest single type, up 40% to £221.5 million. Two-thirds of APP cases started online. UK Finance says the answer is to watch for signs of manipulation, not just signs of a stolen card. Banks are adding checks on the payment's context and on the receiving account.

How AI helps decide who gets a loan

Lending is the highest-stakes use of AI in a bank, because a wrong decision can leave a person without a home loan or a small business without working capital. The Bank of England told Parliament's Treasury Committee that 16% of firms in its survey were already using AI for credit risk assessment, with a further 19% planning to do so within three years.

A credit model works from the facts a bank is allowed to use: income, past borrowing, repayment history and how an account has been run. It weighs those facts and produces a score or a recommendation, which a member of staff then uses to make the decision. The survey found that 55% of all AI use cases involve some degree of automated decision-making, but only 2% are fully autonomous.

A score on its own is not an explanation, and a refused applicant deserves to know why. The survey found that 81% of firms using AI employ some kind of explainability method. The most common is feature importance, used by 72% of firms, which ranks the inputs that mattered most.

The risk that worries regulators most is bias. If the data a model learns from reflects past decisions that were unfair, the model can repeat them at speed and at scale. Data bias and representativeness were among the top five perceived risks in the survey. In the European Union, the Consumer Credit Directive gives a person the right to an explanation of a creditworthiness assessment and to ask for a human to review it, and the bank must say when a loan is refused and that automated processing was used.

Chatbots and the everyday jobs AI now does

For most customers, the most visible AI in banking is the chat window. The survey found that an additional 36% of firms expect to use AI for customer support, including chatbots, over the next three years — the largest expected increase of any business area.

Chatbots handle the routine questions that used to wait in a phone queue: checking a balance, finding a transaction, reporting a card lost, or asking what a charge is. They answer at any hour, and pass a conversation to a person when the question turns complicated. Staff use AI tools too, to draft replies and summarise documents.

The newer models behind these tools are often not built by the bank. Foundation models, including large language models, make up 17% of all AI use cases in the survey, and a third of all use cases are supplied by third parties, up from 17% in 2022. That concentration is efficient, but a problem at one supplier can reach many banks at once.

What can go wrong: bias, black boxes and shared models

Four problems come up again and again in the regulators' work.

The first is bias. A model trained on past lending data can learn the patterns in that data, including any that disadvantaged some groups of applicants. Because the model applies the same rule to every application, an unfair pattern can spread further and faster than one person's judgment.

The second is the black box. Nearly half of firms, 46%, told the survey they had only a partial understanding of the AI they use, against 34% who said they had a complete understanding. A bank that cannot explain a decision will struggle to defend it.

The third is shared weakness. When many banks buy models or data from the same few providers, a flaw in one model can show up in many banks at once. The Bank of England's Financial Policy Committee warned in a paper published on 9 April 2025 that common weaknesses in widely used models could lead many firms to misjudge the same risks and misprice credit at the same time.

The fourth is crime using the same tools. The Bank of England notes that deepfakes and text written by generative AI can make phishing attacks more convincing, and UK Finance reports that criminals use AI-enabled social engineering to build trust with victims over days or weeks before asking for a payment. The same technology that helps a bank spot a fake transaction helps a criminal write a believable message.

The rules banks must follow

Banking is already one of the most regulated industries, and regulators in Britain have chosen to apply existing rules to AI rather than write a separate AI rulebook. The Bank of England describes this as a technology-agnostic approach: it does not regulate technologies, it regulates what firms do with them. A bank using AI still has to meet the standing rules on data management, model risk, governance and operational resilience.

The Financial Conduct Authority's Consumer Duty also applies: firms must act to deliver good outcomes for retail customers. In practice, a bank has to show that its AI treats customers fairly and that a person is accountable — 84% of firms said they had a named person accountable for their AI framework.

In the European Union, the AI Act adds a layer of its own. AI systems used to judge the creditworthiness of a person or to set their credit score are classed as high-risk under Annex III, point 5(b), of Regulation (EU) 2024/1689. The European Banking Authority confirmed this in a letter to the European Commission on 21 November 2025, after a year-long mapping exercise. High-risk systems carry duties on risk management, data governance, record-keeping, human oversight and security. The EBA's letter makes one point plainly: the AI Act gives banks no exemption from the duties on human oversight, data governance and cybersecurity. Those duties apply from 2 December 2027, after the Digital Omnibus moved the date from 2 August 2026, while the transparency rule already requires a chatbot to say it is a machine.

Frequently asked questions

Does AI decide whether I get a loan?

Not on its own, in most cases. A model produces a score or a recommendation, and a member of staff usually makes the decision: only 2% of AI use cases in the Bank of England and FCA survey involve fully autonomous decision-making. In the EU, you can ask for an explanation and for a human to review the decision.

Can AI stop fraud on my account?

It helps most with unauthorised fraud, where a criminal uses your card or account without your consent. UK banks stopped £1.68 billion of attempted unauthorised fraud in 2025. It helps less with authorised push payment fraud, where you are tricked into sending the money yourself: those losses rose 19% to £576.4 million in 2025, and 66% of cases started online.

Will I know when I am talking to a chatbot?

In the EU, yes: the AI Act's transparency rule already requires customer-facing chatbots to make clear that they are machines. Chatbots are best for routine questions such as balances and lost cards.

AI in banking is not one system. It is a set of tools that check payments against past behaviour, weigh the facts behind a loan application, and answer routine questions at any hour. The evidence so far is mixed: the tools are cutting unauthorised fraud and speeding up everyday service, while authorised scams keep growing and lending decisions still need a human check and a clear explanation.

If you run a small business, turn on payment alerts, check statements against your own records, and agree with staff to pause and verify any urgent transfer request through a number you already have. If you want help using data and AI to run your business better, see our AI automation services, or get in touch through our contact page.

What to watch next

Watch the next Bank of England and FCA survey for whether the share of firms using AI for credit decisions keeps climbing from 16%. Watch whether authorised push payment fraud keeps rising despite the new reimbursement rules, and whether banks, technology firms and telecoms providers start sharing scam intelligence in real time. And watch 2 December 2027, when the EU AI Act's high-risk duties for credit scoring come into force.

Sources

1. Bank of England and Financial Conduct Authority — Artificial intelligence in UK financial services 2024 — date checked: 2026-11-07 — https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
2. Bank of England — AI in financial services: written evidence to the Treasury Committee — date checked: 2026-11-07 — https://committees.parliament.uk/writtenevidence/140106/html/
3. UK Finance — UK Finance Fraud Report: adapting to the next phase of fraud and scams — date checked: 2026-11-07 — https://www.ukfinance.org.uk/news-and-insight/blog/uk-finance-fraud-report-adapting-next-phase-fraud-and-scams
4. Credit Connect — Fraud remains a national security threat as criminals steal almost £1.3bn — date checked: 2026-11-07 — https://www.credit-connect.co.uk/news/fraud-remains-a-national-security-threat-as-criminals-steal-almost-1-3bn/
5. European Banking Authority — Outcome of EBA's AI Act mapping exercise (Chair letter, 21 November 2025) — date checked: 2026-11-07 — https://www.eba.europa.eu/sites/default/files/2025-11/2019d1b5-59f8-4149-ad3b-23cfcd4388a1/EBA%20Chair%20letter%20to%20Mr%20Berrigan%20and%20Mr%20Viola%20on%20outcome%20of%20EBA%E2%80%99s%20AI%20Act%20mapping%20exercise.pdf
6. EU AI Act Checklist — EU AI Act for Financial Services: Credit Scoring, DORA and… — date checked: 2026-11-07 — https://www.euaiactchecklist.com/eu-ai-act-finserv.html