Fraud monitoring is a check of every customer transaction for signs of fraud before the money is debited. NeuroVision compares a transfer with the customer’s usual behaviour, checks the recipient against the Bank of Russia database, the signals of the “Antifrod” state system and your stop lists, and in a single request returns a risk score and a decision: process, request confirmation, suspend or decline.
Anti-fraud monitoring is the second line of defence. Onboarding answers who the customer is; monitoring answers whether the customer is the one transferring the money now and whether they understand who it is going to.
Every transaction after login: a transfer, a card payment, an FPS transfer, a withdrawal, a change of phone number or bank details. The question is always the same: is the money of the customer or of your company about to be stolen.
The customer — from a transfer made at a fraudster’s dictation and from account takeover. You — from reimbursement: if the operator received information from the Bank of Russia database and still processed a transfer with the signs, it returns the amount to the customer within 30 days (Part 3.13 of Art. 8 of 161-FZ).
KYT looks for money laundering and suspicious transactions under 115-FZ — cash-out, structuring, transit. Fraud monitoring looks for theft: a transfer without the customer’s voluntary consent under 161-FZ. The data is similar, but the questions and response times differ.
Anti-fraud at registration does not let a fraudster in with someone else’s passport. Monitoring is needed when the account is genuine, but the person acting in it is no longer the owner, or the owner is under pressure.
A money transfer operator checks a transaction for the signs before the money is debited — for cards, electronic money and FPS — or when it accepts the order (Part 3.1 of Art. 8 of 161-FZ). Since 1 January 2026 the list from Bank of Russia Order No. OD-2506 has applied: 12 signs for transfers and two for the digital rouble. In monitoring, each sign is a separate rule with its own weight.
The law sets out the response step by step, and what exactly you do depends on the type of transaction. NeuroVision monitoring conducts every step and records the time — so that a month later it is clear the deadlines were met. The procedure does not apply to transfers of salary and income for which the law limits withholding (Part 3.15 of Art. 8 of 161-FZ) — this exception is built into the rules as a separate condition.
The transaction reaches monitoring from processing or remote banking before the money is debited. Rules with the Bank of Russia signs, the customer profile and stop lists give a risk score and a list of triggered signs.
A transfer by account details is suspended for two days. A card payment, an electronic money transfer and an FPS transfer cannot be suspended this way — for these the operator refuses the transaction (Part 3.4 of Art. 8 of 161-FZ).
Immediately, by the method set out in the contract: what happened, how to reduce the risk, how to confirm the order no later than the next day or repeat the transaction. The customer can be asked to state that the transfer is not being made under the influence of deception (Parts 3.6–3.7).
The customer has confirmed — the transfer is executed immediately. If information from the Bank of Russia database arrived after confirmation, acceptance of the order is suspended for another two days, then the transfer is executed. No confirmation — the order is not accepted (Parts 3.8–3.11).
The signs, score, notification time, customer’s reply and employee’s decision are stored with the transaction. This is your argument if the customer demands reimbursement under Part 3.13, and material for a Bank of Russia inspection.
Part 3.5 of Art. 8 of 161-FZ requires detection procedures to be described in the risk management documents. NeuroVision monitoring turns these documents into working rules: each one is visible, and each can be changed without a release. How such a system works inside — see the article on the architecture of an anti-fraud system.
“If — then” rules on amount, recipient, channel, time, device and history. The Bank of Russia signs are already set up as a rule set; the fraud analyst adds their own in the personal account. Each rule has a weight, an action and a validity period.
Most often enabled:
A number from 0 to 100 and a list of reasons: which rules triggered and how much each added. You set the weight of each rule and the action threshold yourself, so the reason for a decision can always be explained to the customer and to an inspector.
Most often enabled:
Usual amounts, times, cities, devices and recipients. The sign in cl. 1.6 — “the transaction does not look like the customer” — cannot be checked without a profile: the profile builds up automatically from the first transaction.
Most often enabled:
An internal list of recipients under cl. 1.7 — cards, accounts, phones, wallets. A recipient who is an individual can be checked against the Rosfinmonitoring list, wanted lists and bankruptcy — 5 ₽ per check.
Most often enabled:
Medium-risk transactions go into a queue with a card: score, reasons, profile, recipient history. The decision, comment and time go into the log. The “fraud / not fraud” label shows which rules should be reviewed.
Most often enabled:
When a phone number change or an atypical device has triggered, the customer can be asked to go through a KYC session: a photo of the document with anti-fraud checks — from 16 ₽. This way the genuine owner quickly regains access, and a fraudster on someone else’s phone does not.
Most often enabled:
Schemes change every quarter, while the trace in the data changes less often. That is how monitoring recognises a new scheme before anyone writes about it.
The customer transfers themselves, but under deception
“The bank’s security service”, “safe account”, “investigator”. Signals: a long call from a new number before the transfer (cl. 1.9), a new recipient, an amount above usual, all savings in one transfer. A typical trace of a “transfer to a safe account” — a receipt of more than 200 thousand ₽ via FPS from the customer’s own account at another bank and a transfer to a new recipient within a day (cl. 1.12).
The person in the account is not the owner
A login from a new device and a new provider, a change of phone number in remote banking or on Gosuslugi less than 48 hours before a transfer (cl. 1.10), a withdrawal immediately after a change of details.
Someone else’s card as transit
The recipient is in the Bank of Russia database, in the “Antifrod” state system or in your stop list (cl. 1.1, 1.2, 1.7). On the recipient’s side — many incoming transfers from strangers and quick cash withdrawal.
A transfer from an infected phone
Information from a telecom operator or the remote banking app’s own antivirus module about malware on the device (cl. 1.10), remote access, a concealed session.
Money is withdrawn before it is reviewed
For marketplaces, microfinance organisations and services with bonuses: a withdrawal to a new card right after a top-up, payouts to a seller on a third party’s card, one card on many accounts.
5
theft schemes that are visible in transactions
The transaction looks like the customer, the recipient is known, there are no signs. The customer does not see the check, and the score and time remain in the log. The vast majority of transactions in the flow are like this — conversion rests on them.
One weak sign has triggered: a new recipient, an unusual time, an amount above the usual. Additional confirmation in the app, a call or the fraud analyst queue. Confirmation by face — only through the Unified Biometric System; for details, see the liveness check.
The recipient is in the Bank of Russia database or the state system, a phone number change before a transfer, malware. A transfer by account details — suspension for two days, a card and FPS — refusal, then notification of the customer under Art. 8 of 161-FZ.
You set the thresholds, but the action at each level must match what the law permits for this type of transaction. The “signal — action” logic is covered in detail in the article on risk-based anti-fraud.
A rule makes the decision, but a person sees the reasons: every stopped transaction has a list of triggered signs.
The bank receives information from the database of cases and attempts of transfers without consent from the Bank of Russia (Parts 5 and 7 of Art. 27 of 161-FZ), and signals of the “Antifrod” state system through SMEV 4 under 41-FZ. NeuroVision monitoring accepts both streams and checks the recipient and the device against them before debiting: a match means the signs in cl. 1.1, 1.2 and 1.5. If the payer’s bank has notified the recipient’s bank, the latter suspends crediting for up to five business days (Part 11.2 of Art. 9). How to connect to the “Antifrod” state system
A missed fraudster means reimbursement to the customer, a stopped honest customer means a lost customer. Both must be counted, on the same sample. How — in the article “Fraud metrics”.
A new recipient or a large amount happens with honest customers too: buying a car, renovation, moving. Refusing on one weak sign means quarrelling with your best customers every day. The score adds up the signs and keeps strong stop factors separate.
A rule such as “more than 100 thousand ₽ at night” catches both a fraudster and a business owner who always pays suppliers at night. Comparison with the customer’s own habits removes most false alarms.
Each analyst decision — “fraud” or “not” — is saved in the log. It shows which rules fire needlessly: thresholds and weights are reviewed on your data, not on general benchmarks.
The rule runs in observation mode: it counts whom it would have stopped, but does not intervene. The results show how many fraudsters it will catch and how many honest customers it will affect.
The requirements of Art. 8 of 161-FZ are addressed to money transfer operators. Everyone else needs monitoring for a different reason: stolen money is withdrawn through their wallets, payouts and bonuses.
No subscription fee for database checks: you pay for those performed. Transaction monitoring is priced by flow volume and modules.
on request
depends on the number of transactions per month, channels (cards, FPS, transfers) and hosting terms
Recipient and customer checks
5 ₽ per database check.
5 ₽ per database check: the Rosfinmonitoring list, wanted lists, bankruptcy — under the price matrix. A repeat KYC session with a document — from 16 ₽.
take only what you need
We start the pilot in observation mode on a copy of your flow: the rules count but do not intervene. NeuroVision engineers support the integration.
Discuss a pilot API documentation Try the demoTerms of the law and of anti-fraud that appear in the rules and the log.
The architecture of an anti-fraud system, the risk-based approach and fraud metrics — in our blog.
It is a check of customer transactions for signs of fraud before the money is debited: a transfer is compared with the customer’s habits, the recipient is checked against databases and stop lists, and a decision is made whether to process the transaction, request confirmation or stop it. A general account of fraud monitoring in a bank — in the article “Anti-fraud: what it is”.
Yes. A money transfer operator checks for signs of a transfer without the customer’s voluntary consent before debiting — for cards, electronic money and FPS — or when it accepts the order (Part 3.1 of Art. 8 of 161-FZ). The signs are set by the Bank of Russia, and detection procedures are described in the risk management documents (Parts 3.3, 3.5).
KYT solves the AML/CFT task: it looks for laundering, cash-out and suspicious transactions under 115-FZ. Fraud monitoring protects the customer’s money from theft under 161-FZ: transfers at a fraudster’s dictation, account takeover, money mule recipients. The data sources overlap, so both loops can be run on one platform.
Since 1 January 2026 the list from Order No. OD-2506 has applied: 12 signs for transfers and two for the digital rouble. They include a recipient in the Bank of Russia database or in the “Antifrod” state system, a transaction unlike the customer’s usual transactions, a phone number change less than 48 hours before a transfer, and malware on the device. The full list is above.
For two days — for transfers made on the customer’s order. A card payment, an electronic money transfer and an FPS transfer are not suspended but refused (Part 3.4 of Art. 8 of 161-FZ). The customer may confirm the order no later than the next day or repeat the transaction; if information from the Bank of Russia database arrives after confirmation — another two days.
If the bank received information from the Bank of Russia database on transfers without consent and still executed a transfer of an individual customer with the signs, breaching the procedure of Art. 8, it reimburses the amount within 30 days of the customer’s application (Part 3.13). From 1 March 2027, Law No. 210-FZ supplements the reimbursement rules.
Compare a transaction with the customer’s own profile, not with general thresholds; separate strong signs from weak ones; for medium risk, ask for confirmation rather than refuse; run new rules in observation mode first. And count both errors — missed fraudsters and stopped honest customers.
Yes. Marketplaces, microfinance organisations and services with wallets and bonuses use the same rules for withdrawals, payouts and changes of details. The obligations of Art. 8 of 161-FZ do not apply to them, but losses from taken-over accounts and payouts to money mules do.
Confirming a transaction by face is biometric authentication, and for organisations it goes through the Unified Biometric System (Part 1 of Art. 15 of 572-FZ). For repeat customer verification without biometrics, NeuroVision monitoring offers a KYC session with a document and anti-fraud checks.
Transaction monitoring is priced by flow volume, channels and installation option — submit a request and we will send a quote. Recipient and customer database checks — 5 ₽ per check under the price matrix, a repeat KYC session with a document — from 16 ₽.
Tell us which channels and volumes need monitoring — we will propose a pilot in observation mode and send a quote.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a callThe company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
