Identifying Unusual Activity: What the Bank Should See

Over the years, the relationship between the client and the bank was based on human interaction. We knew the teller, we knew who managed the branch, and they, in turn, knew our consumption habits. They knew when we were saving for a family event and when we were exceeding our credit limit due to home renovations. Today, branches are closing, and human interaction has been replaced by algorithms. But does the fact that the bank has become digital exempt it from knowing who we are? Shouldn't the bank's "electronic eye" flash red when our account behaves as if it has been hijacked by a foreign entity?

In this chapter, we will delve deep into the banks' computerized systems—those "anti-fraud" risk-monitoring systems that are supposed to be our last line of defense. We will understand what the red flags are that should trigger within bank systems, and why they sometimes remain dormant while money flows to straw accounts overseas. This is the space between technology and law, the place where the big question arises: where does the customer's responsibility end and the bank's duty of care begin?

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Dalia's Story: When Routine Is Shattered

Dalia (a pseudonym), a retired teacher, had never been late with an electric bill payment. Her account was a model of order: a pension deposited on the first of the month, standing orders for insurance, and a regular weekly cash withdrawal. Dalia was what banks call a "low-risk customer." The most dramatic activity in her account in recent years was the purchase of a household appliance.

One Tuesday, at 2:30 PM, Dalia's phone rang. "Hello Dalia, this is Roi from the bank's security department," said a young, authoritative voice. "We are currently detecting an attempted break-in to your account from a device located abroad. Did you just perform a transfer of thousands of Euros to someone in Romania?"

Dalia felt her pulse quicken. "What? No! Absolutely not! I am at home," she replied with a trembling voice. "Don't worry Dalia, we are with you," Roi reassured her. "To block the activity and transfer your funds to a protected temporary account, I need you to perform a few actions with me in the app. It's an emergency procedure."

For the next two hours, Dalia was captive in a conversation with "Roi." She performed the actions he requested, including significant wire transfers to accounts provided to her as "safe accounts." Every time the app requested confirmation, she clicked "Approve." She even provided him with codes that arrived via SMS, after being told they were "protection codes."

While Dalia was performing the actions, the bank's systems could have identified an unusual picture: a customer who had never transferred large sums to a private individual is suddenly making multiple large transfers in a short time to new accounts. Furthermore, the digital address (IP) from which the connection to the account was made was not the regular address, and the activity was carried out at a pace foreign to her normal usage patterns.

The transfers were carried out one after the other. Only at a late stage, when the balance had already diminished significantly, did the bank's system block the account. For Dalia, the damage had already been done. When she approached the bank the next day, the initial answer she received was: "You approved the transactions. The codes were sent to you. The responsibility is yours."

The Anatomy of the Red Flag: What Does the System Actually See?

When we talk about "unusual activity," we are referring to professional data analysis. Banks operate advanced systems that analyze many parameters at any given moment. These systems build a "behavioral profile" for every customer, which includes regular connection locations, activity hours, and average transfer amounts.

There are three main types of anomalies that the system is supposed to identify:

1. Anomaly in money amounts and volume of activity: A private customer who suddenly transfers large sums nearing their daily transfer limit, especially in a sequence of transfers within a short time, should trigger an alert. The system is supposed to examine why a customer who usually makes small transfers is suddenly moving significantly larger sums in multiple installments.

2. Anomaly in transfer destination: Transfers to new accounts that have never appeared for the customer are a warning sign. If these accounts are in other banks, or in countries defined as having a high risk of fraud, the risk level increases. A proper monitoring system should also examine whether the receiving account has been previously flagged as suspicious.

3. Technological and behavioral anomaly: The system detects if the customer connects from a new device, if the geographical location has changed drastically, and even the way the interface is used. In "remote takeover" fraud, the system can detect movement patterns in the interface that differ from those of the regular user.

The Bank's Duty of Care: The Customer's Legal Shield

In the legal arena, banks may argue that the customer's approval of the transaction exempts them from responsibility. However, standard legal analysis also examines the bank's duty of care. The bank is perceived as a gatekeeper and a trustee of public funds.

The Payment Services Law, 2019, is a central tool in examining these cases. The law establishes a framework of responsibility for the payment service provider in the event of "unauthorized use" of payment instruments. Legal boundaries are carefully examined in cases of sophisticated fraud where the customer becomes a tool in the hands of the fraudster.

One can examine whether the bank acted as a reasonable financial institution would have acted under the circumstances. If the systems identified extremely unusual activity and the bank did not take action to prevent it or clarify it with the customer, its responsibility for the damage may be examined. The central question is whether the information needed to prevent the event was available to the bank and whether it acted upon it in real-time.

One must remember the knowledge gap between the bank and the customer. The bank is exposed to extensive information on fraud patterns and alerts from relevant bodies, therefore the argument that "the customer approved the transaction" is weighed against the bank's professional duties.

The Paradox of the System: Aspects of Monitoring and Control

During my professional years, the question is often asked: if the activity is so unusual, why wasn't it stopped? The answer lies in the complexity between risk management and the desire to maintain a seamless service experience. Banks process a massive number of transactions, and there is a desire to prevent the blocking of legitimate transactions.

There is a constant tension between the level of security and the ease of use. Fraud schemes sometimes exploit this gap, including activity during hours when human response is limited, which leaves the decision to automated systems only.

Additionally, there is an aspect of economic risk management. Against certain business approaches stands the legal and professional duty to protect customers, and especially populations that may be more vulnerable in the digital space.

Contributory Negligence vs. Professional Negligence

In cases of legal disputes following digital fraud, the issue of "contributory negligence" often arises. The bank may argue that the customer acted carelessly when they provided codes or ignored warnings. Conversely, one can raise an argument regarding the professional negligence of the bank in managing its monitoring systems.

It is important to understand that even in cases where a customer made a mistake, the bank is still required to activate its preventive measures. If the system identified an anomaly but no appropriate action was taken, this may be considered a failure of the bank.

In various cases, it can be discovered at the document disclosure stage that the systems did indeed generate an alert for suspicious activity, but it was not handled in time for various reasons. In such circumstances, the customer's position when demanding a review of the refund of funds may be strengthened.

Warning Signs in the Monitoring System

• Sudden change in end-device: Connecting from a device or operating system not familiar to the account's history.
• "Test" transfers: Executing a small transfer to test the account's validity, followed immediately by transfers in significant amounts.
• Change in contact details: Attempting to change details such as a phone number or email address near the time of performing transfers.
• Activity at unusual hours: Performing actions at hours that do not match the customer's past patterns.
• Transfers to suspicious beneficiaries: Bank accounts that have been flagged in financial systems as linked to problematic activity.

Immediate Steps Upon Discovery of Suspected Fraud

Time is a critical factor. The moment a suspicion of fraud arises:

1. Urgent contact with the bank's call center: One must demand an immediate blocking of all channels for funds leaving the account.
2. Full documentation: Saving screenshots of messages, recording details of conversations with bank representatives, and keeping all documentation of communication with the suspicious party.
3. Reporting to authorities: Filing a police complaint is a required step in the procedure against the bank to receive recognition as crime victims.
4. Legal advice: One can approach an attorney to examine the options for freezing funds and investigating the bank's duties in the specific case.

Legal Aspect: Summary of Bank Liability

In the legal discussion on unusual activity, not only the customer's behavior is examined but also the actions the bank could have taken under the circumstances. The duty of loyalty of the bank is a fundamental principle, and as technology advances, so does the expectation that the bank will use it to protect its customers.

Every case must be examined according to its unique circumstances: the customer's characteristics, the nature of the account, the type of fraud, and the bank's response. Although the refund of funds depends on many circumstances and is not guaranteed in advance, identifying failures in the monitoring system is a central pillar in examining the case at the legal level.

The goal in legal representation in these cases is to prove that in a place where monitoring systems failed in their role, the financial institution must examine its responsibility toward the customer.