NatWest

As one of the UK's largest retail banking groups, NatWest faces fraud threats across millions of customer accounts and every payment channel it operates. The rise of Authorised Push Payment (APP) fraud — where customers are manipulated into authorising transfers to fraudsters — created particular exposure, as these transactions appear legitimate to rule-based systems. Simultaneously, the bank needed to avoid over-blocking genuine activity: excessive false declines erode customer trust and drive churn. Fragmented fraud controls operating in silos across channels left blind spots that bad actors could exploit, while static rule-based detection could not keep pace with rapidly evolving fraud typologies.

NatWest selected Featurespace in late 2019 and subsequently completed an enterprise-wide deployment of the ARIC Risk Hub platform. The system applies adaptive behavioural analytics — a form of anomaly detection and pattern recognition — at the individual account level, building a continuous behavioural baseline for each customer rather than relying on population-wide rules. ARIC Risk Hub collates account-level data across all customer touch points in real time, flagging deviations that signal potential fraud or scam activity the moment they occur. The enterprise-wide rollout was critical to eliminating channel-level blind spots, ensuring consistent fraud detection whether the transaction originates from digital banking, branch, or payments infrastructure. Featurespace's models adapt continuously as new fraud patterns emerge, removing the lag inherent in manually updated rule sets.

The deployment enables NatWest to intercept a broader range of fraud — including APP scams — while simultaneously reducing the rate at which genuine customer transactions are incorrectly declined. Real-time individual behavioural monitoring means the bank's fraud teams receive higher-quality, prioritised alerts rather than high volumes of low-confidence flags. Alasdair MacFarlane, Head of Fraud Prevention and Response at NatWest, noted that ARIC Risk Hub's adaptive capability allows the bank to detect new fraud and suspicious activity in real time, ensuring the high level of transactional convenience NatWest offers customers is matched by uncompromising security standards.

• Catches more fraud across APP and scams typologies
• Reduces false positives (genuine transactions incorrectly declined)
• Real-time detection adapts to emerging fraud patterns without manual rule updates

• Enterprise-wide coverage is non-negotiable — channel-specific or siloed fraud tools create exploitable gaps; deployment must span all touch points simultaneously.
• Individual behavioural baselines outperform population rules — anomaly detection at the account level reduces both fraud losses and customer friction compared to static thresholds.
• Adaptive models are a prerequisite for APP fraud — fraud typologies like authorised push payment scams evolve faster than rule update cycles allow.
• Vendor selection should precede major product changes — NatWest locked in Featurespace in late 2019, allowing deployment to align with expanded payment capabilities rather than react to them.