Since 9 October 2025, payment providers in the euro area have had to verify the payee of a credit transfer before the payer can authorize it, under Regulation (EU) 2024/886. In the US, Nacha's fraud monitoring rule took effect in two phases, on 20 March and 19 June 2026, and asks ACH participants for risk based processes to identify entries initiated due to fraud.
So the EU put a fraud check inside the payment, and Nacha made fraud monitoring a written rule for ACH banks and business senders. This page compares ten fraud detection tools by where each one decides.
What does fraud detection software decide, and where?
Where fraud detection software decides, what it reads and which rule touches each point (rules as of November 2026)
| Decision point | What the tool reads | Decision it returns | Who acts | Tool type | Rule that touches it |
|---|---|---|---|---|---|
| Account opening (application fraud) | Application details, device, IP address, email, phone | Approve, decline or send to review | Onboarding analyst on referred cases | Device, identity and behavioral intelligence | The firm's own onboarding policy |
| Login and session (account takeover) | Device, location, typing and navigation behavior | Allow, step up verification or block | The customer on a step up; a fraud analyst on a block | Behavioral biometrics, device intelligence | The firm's own authentication policy |
| Payment | Amount, payee, rail, the customer's history, the session's risk | Approve, hold, decline or warn the payer | The payment flow; an analyst on held payments | Transaction scoring and rules | EU payee verification; Nacha ACH fraud monitoring; UK APP reimbursement split 50:50 |
| After the fact (money mule accounts) | Confirmed fraud, chargebacks, incoming credits, linked accounts | Restrict, close or report the account; label the case | Fraud and AML investigators | Case management, network analysis | Nacha monitoring of incoming ACH credits; AML monitoring |
Each row is a moment where a tool can say yes or no. At account opening it judges whether the applicant is real, and during a session whether the person logged in is the owner. Inside the payment it judges whether the transfer should leave. After the fact, it works on confirmed cases and on the accounts that received the money.
Start the shortlist where the firm loses money today. A bank whose losses come from coached payments needs a session or payment tool first. A fintech flooded with fake sign ups needs the account opening row.
Which tools fit real time payment decisions?
Instant rails leave little time to recall a payment, so the decision has to come back inside the payment request. The EU rule has the payer's provider verify the payee "immediately after the payer provides relevant information about the payee", before the payer can authorize (art. 5c(1)). Receiving banks get more room: Nacha's rule does not require credit entries to be monitored before they post. ComplyAdvantage, FICO and Sardine name instant rails on their own pages, and Feedzai and Hawk name real time decisions. Measure each one's decision time in your own sandbox.
What are the best fraud detection software tools in 2026?
The ten tools here are complead, formerly Sanction Scanner, then BioCatch, ComplyAdvantage, Featurespace, Feedzai, FICO Falcon Fraud Manager, Hawk, LexisNexis ThreatMetrix, Sardine and SEON. Between them they cover all four decision points.
How we chose and compared these ten tools
complead publishes this page and is one of the ten; our row and entry say so. Each tool passed five tests:
- A named decision point. Its own page says where it decides, which is where your loss happens.
- Its own signals. The page names what the tool reads; two tools at one point can see different things.
- An explained decision. The page says whether a score carries its reason, which an analyst needs to defend a decline.
- A link to AML. The page says whether fraud and AML share a platform, since one customer often sits in both queues.
- Pages read on 9 November 2026. Every cell comes from the vendor's own pages or annual report; "not on the pages read" means what it says.
There are no scores or stars, and after complead the list runs A to Z. Signifyd and Forter lead with ecommerce checkout and chargebacks, the merchant side of fraud that this bank and fintech list leaves out. Kount (now part of Equifax), Sift, Oscilar, Quantexa, Unit21, Verafin and NICE Actimize were left out to hold the list at ten. The list also leaves out AML suites that catch fraud too and identity and KYC vendors.
The second column answers the shortlist question. It shows, row by row, who decides at the point where you lose money.
| Vendor | Decision points its pages name | Signals its pages name | Explains each decision | Fraud and AML on one platform | Published price (9 November 2026) | Best for | Own page read |
|---|---|---|---|---|---|---|---|
| complead (ours) | Onboarding, screening, monitoring, fraud and investigation on one engine | First party device fingerprinting, emulator and tampering detection, network signals, behavioral biometrics | Yes: approve, decline, review or step up, each with a reason | Yes, one risk score per customer | Not published | Fraud and AML teams that want one score per customer and rules tested on their own history | complead.ai fraud prevention and rules engine pages |
| BioCatch | Account opening, login and session, scams in payments, mule accounts | Telemetry and behavioral analysis | Not on the pages read | Mule accounts and money laundering networks; AML monitoring and screening not on the pages read | Not published | Digital banks losing money to coached payments, takeovers and mule accounts | biocatch.com home and mule account detection pages |
| ComplyAdvantage | Before the transaction (logins, profile changes) and payments on ACH, FedWire, Swift MT, SEPA, FedNow, Faster Payments | Behavioral analytics, identity clustering, graph network analysis | Yes: "explains the reason why each alert was created" | Yes: "unified fraud and AML management platform" | Tiers from $99/month list no fraud product | Firms already screening with ComplyAdvantage that want fraud alerts on the same customer | complyadvantage.com Mesh fraud detection and pricing pages |
| Featurespace (Visa) | Payment, card, merchant acquiring, check and application fraud | Behavioral analytics (Visa's filing) | Not on the pages read | Yes, AML among its solutions | Not published | Issuers and acquirers that want card and payment fraud from a supplier inside a card network | featurespace.com (browser); Visa annual report |
| Feedzai | Transactions in real time across channels; new accounts | Behavioral, monetary and other data; network intelligence | Says each decision is "explainable" | Yes, AML monitoring and screening in its menu | Not published | Banks and fintechs that need a working model before their own fraud labels build up | feedzai.com home and transaction fraud pages |
| FICO Falcon Fraud Manager | Credit, debit, prepaid and commercial cards; digital and real time P2P; account to account; wire | Consortium data from more than 10,000 financial institutions | Not on the pages read | Not on the pages read | Not published | Card issuers that want models trained on a consortium far larger than their own book | fico.com Falcon page (browser); FICO annual report |
| Hawk | Payments on ACH, BACS, card, check, P2P, SEPA, wire: block, hold, release | Anomaly detection, check images, rules with AI | AI explanations in the case manager | Yes, one case manager for AML, fraud and screening | Not published | Banks and payment firms that want fraud, AML and screening alerts in one queue | hawk.ai fraud, transaction fraud and case manager pages (browser) |
| LexisNexis ThreatMetrix | New account opening, logins, account management, payments | Device, geolocation, IP, email, phone, behavioral patterns; Digital Identity Network | "Explainable results using clear reasoning" | Separate LexisNexis products | Not published | Firms whose fraud starts with fake or stolen identities at sign up and login | risk.lexisnexis.com ThreatMetrix page |
| Sardine | Onboarding to payments on ACH, wires, SEPA, RTP, FedNow, Zelle, checks | Its own device and behavioral signals; emulators and bots | Not on the pages read | Yes, by its home page | Not published | US fintechs on instant rails where fraud and AML touch the same payment | sardine.ai home page |
| SEON | Sign up, onboarding, login (step up), transactions | 1,100+ first party signals: IP, digital footprint, device | Score explainability, signals ranked by impact | Yes, AML screening and monitoring in its menu | Starter $699/month (2,500 checks); Premium custom | Smaller teams that want a posted price and their own rules at sign up and login | seon.io home and pricing pages |
What does each of the ten tools do, and who does it fit?
complead (ours)
We publish this list. complead's fraud prevention returns one of four outcomes: "approve, decline, review, or step up". Each comes with a reason. Its signals are first party: device fingerprinting, emulator and tampering detection, network signals and behavioral biometrics. Ready rules cover the known patterns from the start. As labels accumulate, a model trained on your own confirmed cases joins them, while unlabeled anomaly detection runs the whole time. Across accounts, the product resolves shared devices, shared beneficiaries and repeated funding paths. A mule ring shows up as a ring. Fraud shares its engine with onboarding, screening and monitoring, so a customer ends up with a single risk score across all four. Sandbox keys come immediately. There are no integration fees, and our API typically integrates in hours rather than weeks. We hold ISO 27001 and ISO 9001, with GDPR built in and EU data residency; 800+ companies use complead, and G2 named us a Leader in its Summer 2026 report. In a demo, ask us to backtest one of your live fraud rules on your last 90 days.
BioCatch
BioCatch reads the digital session. Its home page says BioCatch Connect combines telemetry, behavioral analysis and predictive intelligence to detect and prevent "account opening fraud, account takeover, social engineering scams, and mule accounts". Those signals, it says, show when a customer is being pressured into authorizing a payment, or when someone other than the owner is in the account. It counts 350+ retail banks as users. That suits a digital bank whose losses come from customers talked into paying and from accounts taken over. Visa has agreed to buy the company. In the demo, ask to see a coached payment from your own app scored, and which signals the score names.
ComplyAdvantage
Fraud detection at ComplyAdvantage sits inside Mesh, its screening and monitoring platform. Detection starts before the transaction, with events such as logins and profile changes, then covers ACH, FedWire, Swift MT and SEPA, with "24x7x365 fraud detection" for FedNow and Faster Payments. By the vendor's account the product "explains the reason why each alert was created", firms can go live in as little as two weeks, and the page calls it a "unified fraud and AML management platform". It suits a payment firm or bank already screening with ComplyAdvantage. Essentials starts at $99 a month. No tier lists fraud detection. Ask which of your rails it scores before release and which only after.
Featurespace (Visa)
Visa owns Featurespace. It paid $946 million in December 2024, according to its annual report. The home page describes a transaction monitoring company built on AI and founded on research at Cambridge. The Featurespace Platform covers payment, card, merchant acquiring, check and application fraud, plus AML, with multi tenancy for issuers and acquirers. The site also points to Visa A2A Protect, which now takes in Scam Detect. The vendor publishes stories from NatWest, Worldpay and Danske Bank. It fits a card issuer or acquirer that wants card and account to account fraud from one supplier inside a card network. Worth asking in the demo: which data sharing and contract terms change now that Visa owns the vendor.
Feedzai
Its platform is called RiskOps. Feedzai sells it to clients "from global banks to emerging fintechs". Its transaction fraud page scores payments in real time across channels and mixes behavioral data with monetary and other customer data. For a new buyer the line to read is "our federated AI models are ready on Day One", next to a pledge that every decision is explainable. The menu also lists AML transaction monitoring and watchlist screening, and the company counts 140 billion events processed a year. It suits a bank or fintech with few fraud labels of its own yet. The question for the demo is what the federated model learned from other clients, and which of your fields flow back into it.
FICO Falcon Fraud Manager
FICO's annual report dates Falcon Fraud Manager's use of neural networks for fraud prediction to the 1990s. The product page lists out of the box AI and machine learning models by portfolio and region, trained on consortium data from "more than 10,000 financial institutions". Falcon watches credit, debit, prepaid and commercial cards, digital and real time P2P payments, account to account transfers and wires. Business users deploy rules themselves. They also define and test them, and the case management can be adapted. It fits a card issuer that wants models trained on far more fraud than its own book holds. In a demo, ask what your portfolio adds to the consortium. Then ask how the model scores you before your own data arrives.
Hawk
Hawk puts fraud, AML and screening on one platform, delivered as SaaS or in a private cloud. Its transaction fraud product takes ACH, BACS, card, check, P2P, SEPA and wire through one API and can block, hold and release a payment. By Hawk's account it trains and deploys models "in under three days". Alerts from all three areas meet in one unified case manager with AI explanations, four eyes review and audit trails, and buyers get a production grade sandbox with live data. Hawk publishes no price. It says it charges no extra fees per rail or seat. It fits a bank or payment firm that wants fraud and AML analysts in one queue. Have the vendor walk a held wire through the case manager and show the explanation the analyst sees.
LexisNexis ThreatMetrix
Identity and device decide here. ThreatMetrix names four moments: "new account opening, logins, account management and payments/transactions". It reads device, geolocation, IP address, email address, phone and behavioral patterns, shares them through the LexisNexis Digital Identity Network, and adds behavioral biometrics through LexisNexis BehavioSec. Models come out of the box or as "bespoke, customer specific models", and the page promises "Explainable results using clear reasoning". AML screening is sold as separate LexisNexis products. ThreatMetrix fits a firm whose fraud starts with fake or stolen identities at sign up and login. Ask for the reasons behind one declined sign up from your own traffic.
Sardine
Sardine's home page describes one platform for fraud prevention, AML compliance and real time transaction monitoring, used by banks, merchants and fintechs. It reads its own device and behavioral signals from onboarding to payments, catches emulators and bots, and lists ACH, wires, SEPA, RTP, FedNow, Zelle and checks among its rails. Most are US rails. It also checks consumers and businesses at onboarding, offers agents for fraud and AML operations, and counts 6.58 billion transactions on the platform. That mix fits a US fintech or bank on instant rails, where a fraud decline and an AML alert often concern the same payment. Explanations per decision are not on the pages read. A useful demo: one instant payment declined for fraud, and whether it reached the AML queue.
SEON
SEON is the one rival here with a published fraud price. Its Starter plan, pitched at small and medium businesses, costs $699 a month for 2,500 fraud checks, 10 users and 50 custom rules; Premium is custom. At sign up it reads IP, digital footprint and device signals before KYC begins. At login it can trigger step up verification, and the home page counts 1,100+ first party data signals in all. Score explainability ranks the signals behind a score, and SEON's AI retrains daily on the transactions your team labels as fraud or legitimate. AML screening and monitoring sit there too. It fits a smaller team that wants a posted price and its own rules at sign up and login. Ask what the bill becomes once checks pass 2,500 a month.
How do you test a fraud tool on your own data before you switch?
Picture an illustrative electronic money institution (EMI) that sends two vendors the same 90 days: 1,200,000 payments, 240 of them confirmed fraud. Tool A raises 3,000 alerts and catches 180 frauds, a 75 percent catch rate at 6 percent precision. Tool B raises 1,800 alerts and catches 168, 70 percent at 9.3 percent precision.
Now cost the review. At 60 reviews an analyst day, tool A needs 50 analyst days for the quarter and tool B needs 30. Tool A misses 60 frauds and tool B misses 72. The choice comes down to whether 12 extra missed frauds cost more than 20 analyst days. A firm with large average losses per case picks A. A firm with small card frauds and a stretched team picks B. Your own labeled history settles it.
Test sheet for a fraud detection tool, run on the firm's own labeled history
| Test | How to run it | Pass line you set before the run |
|---|---|---|
| Same labeled history | Send every vendor the same 90 days with confirmed fraud marked | All vendors scored on identical data |
| Catch rate at your alert budget | Cap alerts at what your team can review, then count confirmed fraud caught | Minimum share caught within the budget |
| Precision per rule | Confirmed fraud divided by alerts, for each rule and score band | Lowest precision you will keep a rule at |
| Decision time | Measure inside your own payment request, in the sandbox | Longest wait your payment flow allows |
| Reason per decision | Open declined cases and read the reason returned | Every decline explainable to an examiner |
| Step up path | Check what the customer sees when the tool is unsure | Step ups your support team can absorb |
| Model ownership and retraining | Ask who retrains, on whose labels, how often, and who approves | A named approver for every model change |
| Data leaving the firm | List the fields sent to the vendor or a consortium | Only fields your privacy review accepts |
| AML record update | Confirm a fraud case and check the customer's AML risk | Risk moves without anyone retyping it |
Which fraud detection systems are best for reducing false positives?
Precision on your own data decides it. Read precision for each rule and each score band, never one average, because a single noisy rule can hide inside a good overall number. Then check what happens to a false positive once an analyst clears it. SEON retrains daily on the labels your team gives, and ThreatMetrix offers customer specific models. Either way, ask how a cleared alert reaches the model, and confirm that an analyst makes the final call and is named on the record.
When should fraud and AML share one customer record?
Take the same illustrative EMI. At 9:00 its fraud tool blocks a login from a new device and declines two payments as account takeover. At 14:00 the same customer receives five transfers from strangers and sends the money straight on. That is a mule pattern. The AML monitoring system still rates the customer low risk, because the morning's decision sits in another tool with its own score.
Fraud detection acts before or during a login or a payment, to stop a loss; AML monitoring reviews activity over time to find and report suspected laundering. For receiving banks, Nacha's rule links the two. Watching incoming credits for fraud, it says, "aligns with AML monitoring practices in place today". On the pages read, fraud and AML share a platform at complead, ComplyAdvantage, Featurespace, Feedzai, Hawk, Sardine and SEON. BioCatch covers mule accounts, and the FICO Falcon and ThreatMetrix pages describe fraud products. Ask each vendor whether a confirmed fraud case changes the customer's AML risk on its own, and whether the fraud and AML teams can then work it as one investigation case.
How is fraud detection software priced?
Three price models show up. The first is a monthly plan with a check allowance: SEON's Starter costs $699 a month for 2,500 fraud checks, about 28 cents a check when the allowance is used in full, and Premium is priced to order. The second is a platform tier with a published floor. ComplyAdvantage's Essentials starts at $99 a month, but none of its published tiers lists fraud detection, so fraud is quoted.
The third, and the most common here, is a quote after a call: BioCatch, Featurespace, Feedzai, FICO, Hawk, ThreatMetrix, Sardine and complead publish no price. Ask every vendor for the price at your own monthly volume, with set up fees included.
When should a fraud team look past complead?
Take a fintech opening in a new market whose first gap is checking passports and selfies at sign up. It needs an identity verification provider first. complead's risk model takes the verified identity as an input, while the document and biometric checks themselves are "handled by your IDV provider".
A buyer whose procurement requires a SOC 2 report is the second case: complead holds ISO 27001 and ISO 9001 but no SOC 2 report. The third is a team that wants to start on a posted monthly price without a sales call. complead publishes no price; SEON's Starter plan is public.
Which 2026 rules and deals changed this shortlist?
- 20 March 2026. Nacha's Phase 1 took effect for all originating banks and for the largest business originators, third party senders and receiving banks (at least 6 million originations or 10 million receipts in 2023).
- 22 June 2026. Phase 2 reached all the others on the practical effective date, the banking day after the 19 June holiday.
- 30 July 2026. The UK regulator's reimbursement dashboard showed 88 percent (£316 million) of money lost to APP scams reimbursed between 7 October 2024 and 31 March 2026.
- August 2026. Visa agreed to acquire BioCatch for $2.4 billion in cash, subject to closing conditions (annual report of 5 November 2026).
- 6 November 2026. FICO's annual report says it continues to move standalone applications onto FICO Platform; Falcon Fraud Manager is one of its key standalone products.
- Next. EU payment providers outside the euro area must offer payee verification by 9 July 2027.
Go back to 9 October 2025 and 20 March 2026. One rule put a fraud check inside the payment and the other made fraud monitoring an ACH duty, so a shortlist now gets tested in two places. Ask each vendor two things. First, which decision it returns inside your payment request. Second, what record of that decision your AML team and your examiner can open afterwards.
