How service-based crime is reshaping the threat landscape
September 03, 2026 — Financial institutions are struggling to keep pace with criminals who now access sophisticated fraud tools without needing technical expertise. The rise of fraud-as-a-service and phishing-as-a-service platforms has lowered the barrier to entry, enabling anyone to launch complex attacks using ready-made kits purchased online. This shift is widening the gap between organised crime groups and the defences deployed by banks, which often rely on outdated systems and slow response protocols.
Breaking news
X Money Launches with High-Yield Savings and Cashback Rewards
Splitit Announces White-Label Credit Card Launch
Billing Friction Puts $12.3 Billion in Auto Loan Payments at Risk
OneSpan Unveils New e‑Signature Features Including Identity Wallets and AI Workflow SupportThe accessibility of these criminal services means that even low-level actors can mimic the tactics of established syndicates. Bank of China senior financial crime officer Li Wei noted in a recent interview that defence teams are frequently reacting to threats after damage occurs, rather than anticipating them. He explained that fraud kits now include templates for fake websites, automated message generators, and stolen data bundles — all available for subscription-like fees on dark web marketplaces. As a result, the volume and variety of scams targeting customers have surged, overwhelming traditional monitoring systems that were not built for such speed and scalability.
The commodification of cybercrime tools has transformed fraud from a specialised skill into a mass-market activity. Criminals no longer need to develop malware or spoofing techniques themselves; they can subscribe to services that update continuously to evade detection. This model mirrors legitimate software-as-a-service businesses, complete with customer support and refund policies. Banks, by contrast, often face internal delays in updating fraud detection rules due to bureaucratic approval processes and legacy infrastructure. Li Wei emphasized that while some institutions are investing in AI-driven anomaly detection, many still rely on rule-based systems that fail to catch novel attack patterns emerging from these shared criminal toolkits.
Can banks ever catch up to the pace of fraud innovation?
Experts warn that without fundamental changes in how financial security teams operate, the disadvantage will persist. Response times remain critical — many fraudulent transactions are completed within minutes, yet internal investigations can take days. Li Wei suggested that greater collaboration between banks, telecom providers, and law enforcement could improve real-time threat sharing. He also advocated for adopting adaptive security frameworks that learn from blocked attempts across institutions, rather than relying solely on historical data. Until such measures become widespread, the asymmetry between attackers and defenders is likely to grow, leaving consumers increasingly exposed to scams that appear convincingly legitimate. Frequently Asked Questions What is fraud-as-a-service? Fraud-as-a-service refers to online platforms where criminals can purchase ready-to-use tools for committing fraud, such as phishing kits, fake login pages, and stolen personal data, often with technical support included.
Why are bank fraud teams struggling to keep up? Bank fraud teams are hindered by outdated technology, slow internal processes, and reactive strategies, while criminals use fast-evolving, subscription-based tools that require little skill to deploy.
What could help banks improve their defences? Improved information sharing between institutions, faster adoption of AI-driven detection systems, and real-time collaboration with telecom and law enforcement agencies could help banks respond more effectively to emerging threats.
