What UK Consumers Expect From Fraud Protection and Authentication

UK financial institutions already operate in a mature fraud prevention environment, with established controls for account takeover, authentication and payment risk. The pressure is now shifting because many scams do not begin with a criminal breaking through the front door. They begin with a criminal persuading a genuine customer to open it.

A 2026 country report was based on a UK sample of 1,005 respondents. The research formed part of an exclusive survey of 7,029 consumers across seven countries, with approximately 1,000 respondents in each market.

Impersonation and support scams have the broadest reach

The UK survey found that 49% have experienced impersonation and support scams personally or through close family or friends.  The criminal may pose as a bank, a trusted organisation, a technical support agent or another credible party. The interaction can feel ordinary enough to keep the customer engaged, while still pushing them toward an unsafe action.

This creates a detection challenge. Fraud teams cannot treat each scam type as a sealed category, because tactics change quickly and often overlap. A scam may include impersonation, remote guidance, new payee setup, unusual payment timing and mule-account exposure within the same event.

Effective controls need flexibility in detection and decisioning. They must read different risk patterns as they emerge, apply the right signals and adapt interventions as the nature of the risk changes.

Consumers explain why impersonation scams are hard to spot

Surveyed respondents recognise that today’s scams are difficult because they can look legitimate in the moment.

“What worries me most is that scammers are becoming more sophisticated and can impersonate banks or trusted organisations, making it difficult to tell what is genuine.”

“The clever scams that trick people into willingly sending money themselves – the ones that look genuine and play on urgency. Harder to spot, especially for people who aren't as tech-savvy.”

These comments point to the same operational problem. Authentication may confirm who is acting, but it does not always confirm why the action is happening.

Scam detection needs to combine device, behavioral, account and payment context. Changes in navigation, hesitation, unusual sequencing, unfamiliar payees or signs of coaching can all matter when viewed together. The intervention also has to arrive before funds leave, with a warning that is timely, clear and specific enough to change the outcome.

Scam losses create pressure on both sides of the payment

APP scam defence is now a sending-bank and receiving-bank priority. Consumer expectations and applicable reimbursement rules both raise the stakes, because responsibility does not stop at whether the customer authenticated.

• 57% of surveyed respondents believe responsibility for scam losses should sit with the sending bank, receiving bank or both.
• That total is made up of 25% saying both, 20% saying the sending bank and 12% saying the receiving bank.

The sending side must understand the customer’s payment journey, including signs of pressure or abnormal behaviour. The receiving side must understand whether the destination account shows mule or suspicious inbound activity. A confirmed customer and a completed authentication step are not enough on their own.

Provider response determines the lasting confidence impact

A fraud or scam event can affect more than the immediate loss. It can change how a customer sees the provider, how much support they need and whether the wider relationship feels secure.

The findings show that 33% say fraud or a scam reduced their trust in the provider involved. However, provider response can shift that outcome: 20% say their trust increased.

That difference matters. The incident itself is only part of the outcome. Clear communication, fast action, fair handling and visible protection can materially shape how customers judge the provider afterwards. A weak response can compound harm. A strong one can show competence at the moment customers need it most.

Fraud protection is part of the customer proposition

Fraud prevention is not separate from pricing, service or digital experience. Surveyed respondents increasingly evaluate it as part of what they expect from an account provider.

That expectation is reflected in provider choice, with 60% ranking strong fraud protection among their top three considerations.

That places fraud protection inside the customer proposition. A provider that handles risk well can reduce losses, protect digital adoption and support stronger customer relationships. A provider that lets scams through, or responds with blunt friction, risks losing confidence even when other parts of the experience are strong.

Consumers accept security when it feels proportionate

Security friction becomes a business problem when it interrupts legitimate activity too often or feels hard to navigate.

• 64% of surveyed respondents have abandoned an online purchase because the payment or security process was difficult, slow or confusing.
• Crucially, this does not mean respondents reject security outright. Acceptance rises when the reason for an extra check is clear: 65% accept one for a high-value payment, and 64% accept one when the bank thinks the activity looks unusual.

The lesson for UK fraud and payments leaders is practical: step up when the evidence supports it, and make the intervention understandable. Amount alone is not the only indicator. Payment context, behavioural change, recipient risk and account history all help determine whether added assurance is justified.

Consumers want protection in the background, not extra waiting

Surveyed respondents show a clear preference for protection that works without slowing every journey.

This preference is visible in the technology choices: face recognition (39%) and fingerprint (38%) lead the remaining preferences, while 77% welcome background fraud-prevention technology.

The qualitative responses explain why.

“Have better background technologies or use facial/ fingerprint recognition. Two step verification and waiting for texts is quite frustrating”.

“I think it is important to be cautious of fraud and scams but sometimes it can feel like you can't use your own money without the bank wanting an explanation and that feels infantising. It would be great if a lot of the checks could happen in the background so you don't end up feeling this way.”

This is not a call for weaker security. It is a call for better targeting. Passive device and behavioural signals can help assess risk continuously, while biometric or app-based approval can provide faster assurance when a step-up is needed. Repeated text-code journeys are not always the best answer, especially when the fraud pattern is social engineering.

Protection should be strong, contextual and proportionate

A modern fraud strategy needs to bring prevention, authentication and customer experience into the same operating model.

Four priorities stand out:

• ‍Connect the journey: Evaluate identity, device, behaviour, transaction and recipient signals in the same decision context.
• ‍Detect coaching: Look for changed behaviour, remote guidance and unusual payment context, even when the customer is genuine.
• ‍Target friction: Step up on combined risk, not amount alone, and explain interventions clearly inside the journey.
• ‍Operationalise evidence: Carry warnings, decisions and customer actions into investigation, reimbursement and case handling.

The aim is proportionate protection across the journey: strong enough to change the outcome, precise enough to preserve legitimate activity.

One decision context for All-Cause Fraud Prevention

Fraud journeys overlap. Account takeover, authorised scams, mule activity and payment fraud often share signals, channels and operational consequences. If the controls remain fragmented, context can disappear between teams, systems and decision points.

Protection works best when institutions can authenticate customers and assess behavior, device, transaction and payment context together, across authorized and unauthorized fraud.

Three capabilities matter:

1. ‍Native risk and behavioral signals: Understand how genuine customers normally interact and surface meaningful deviations in real time.
2. ‍Connected risk intelligence: Combine device, behavioral, identity and transaction signals so context is not lost between controls.
3. ‍Proportionate intervention: Apply stronger authentication or intervention strategies when risk is elevated and reduce avoidable friction.

For institutions, the goal is not simply to add more checks. It is to make each decision better informed, more explainable and better aligned to the risk in front of the customer.