Banks and neobanks
Customers are talked into sending money, and the accounts that receive it can sit in your own books. APP scam losses are forecast to reach $7.6 billion by 2028 in six real-time payment markets (ACI Worldwide Scamscope, November 2024; a forecast). WoWyrd runs inside your environment and scores each payment before it leaves.
What WoWyrd flags, from account opening to payout
Each stage below names the rules that fire there, and every flag shows its reason.
Account opening
Many new accounts on one device or IP address, throwaway email domains, and a brand-new account that moves a large amount (new accounts).
Login
One session from several IP addresses, countries or networks, impossible travel, and a payout right after a password reset or a contact-detail change (account takeover).
Payment and money coming in
Receiving accounts that collect money from many new senders and pass it straight on, and a new account that receives a large incoming payment (money mules).
Payout
A payout that takes most of the balance to a payee added minutes earlier ("safe account" scams). WoWyrd recommends a pause and a call to the customer, not a hard block. A recipient added just before the payout (account takeover).
What data you need
Only the IP address is required; each optional field switches on the rules that need it, and comes from your digital channels and core systems.
| Field | Where it comes from | Mandatory |
|---|---|---|
ip | Your edge or load balancer (the real client IP) | Yes |
customer_id, account_created_at | Your core banking or account system | No. Needed for new-account and mule rules |
session_id, device_fp | Your mobile app or online banking | No. Needed for session and multi-account rules |
preceding_event (e.g. password_reset, phone_change, beneficiary_added) | Your login and payee services | No. Needed for account-takeover and scam rules |
beneficiary_id, amount, available_balance | Your payment service and ledger | No. Needed for the "safe account" scam rule |
sender_id_hash | Your incoming-payment records, hashed on your side | No. Needed for money-coming-in mule rules |
How a pilot starts here
We start with one stream, such as instant transfers or new payees, observed in your environment for 30 days in shadow mode while WoWyrd decides nothing. For a larger bank, a workshop without data can come first: your fraud typologies against our rules.
Talk to us about one stream, one owner, one question.
In the UK? See how WoWyrd maps to the FCA's draft guidance CP26/38.