Reap sharpens card fraud defences with Sentry

With payment fraud evolving into a more coordinated and industrialised threat, businesses must contend with attacks that span the entire payment lifecycle, from compromised credentials and automated authorisation attempts to merchant breaches and organised fraud networks. For payment providers, the challenge lies in real-time detection of emerging threats while minimising false positives that disrupt legitimate transactions.

To help payment providers address these issues, fintech company Reap launched a managed card fraud and risk service called Sentry. Harris Leow, Reap’s Head of Product, detailed to SMEhorizon the complexity of the payment fraud landscape, and how it led to the launch of Sentry.

How is the payment fraud landscape changing as digital payments become more instantaneous, global, and deeply embedded into business operations?

The biggest change is that fraud is now faster, more connected and more industrialised.

Businesses are not only managing individual fraudulent card transactions; they are dealing with coordinated attacks that can combine social engineering, malware, automated bot activity, compromised credentials and mule networks. Research found that risk now spans the full payment lifecycle, rather than sitting at one point in the transaction.

For card programmes, that raises the premium on real-time decisions. For every card fraud needs to be identified and contained at that very moment, not discovered after the funds have moved.

What were the biggest technology and operational challenges Reap identified in how businesses currently manage card fraud?

The central issue is that effective card-fraud management is not stemming from one single tool; it is a continuous operating function. A business launching a card programme needs rules and decisioning technology, but it also needs specialists to tune controls, investigate alerts, manage chargebacks, report confirmed fraud and respond quickly when an attack evolves. Industry research shows how difficult this is operationally: 78% of financial-institution fraud and risk professionals said their fraud-prevention teams were too slow to keep pace with increasingly agile attackers, while 66% of global fraud executives were concerned siloed controls, rising to 72% among issuers in Asia-Pacific and North America.

Rather than treating fraud management as a standalone technology problem, we combine the technology with the specialist work required to operate it day to day. In practice, that means tailoring controls to each programme’s unique requirements.

What makes threats such as BIN attacks and merchant breaches particularly challenging to detect and contain, and how can businesses improve their resilience against them?

These threats are challenging because the signal is often visible only at scale. In BIN’s scenario, attacks are difficult to detect because individual attempts often look insignificant — typically a low-value authorisation or decline.

Improving resilience therefore requires businesses to connect signals across the portfolio and act before isolated attempts become material losses.

At Reap, this thinking informs how we operate Sentry: we monitor the authorisation layer for emerging patterns and adjust programme controls as threats develop, while working with clients on investigation and containment. The objective is not to suggest that any single control can eliminate these attacks, but to identify them earlier and limit their impact without unnecessarily disrupting legitimate transactions.

How does Reap balance aggressive fraud prevention with the need to minimise false positives and avoid declining legitimate transactions?

We do not believe that good fraud performance means simply declining more transactions. The objective is precision: identifying the activity that is genuinely anomalous while allowing normal business spending to continue.

In practice, that means tuning controls to the client’s specific programme rather than applying generic thresholds. Sentry tailors controls to the programme’s cardholder profile, geographic footprint and more, then reviews and refines them as the programme and threat environment evolve.

We also look at patterns across the portfolio, which is essential for identifying coordinated activity without treating every unusual individual transaction as fraud.

Beyond the immediate value of a fraudulent transaction, what are the broader operational and financial consequences of payment fraud that organisations often underestimate?

The transaction value is often only the most visible part of the loss. 76% of executives surveyed by Datos Insights identified loss of consumer trust as their leading card-fraud concern, while 69% pointed to high false-positive rates — a reminder that declining genuine customers can create its own revenue and loyalty cost.

That is why fraud needs to be managed as an end-to-end operational issue, rather than simply as a loss-recovery exercise.

We focus on helping clients address activity at authorisation, while also supporting the follow-on work around alert investigation, chargeback processing and programme reporting. This is important because earlier, more precise intervention can reduce both direct losses and the operational disruption that tends to follow.

As payment fraud becomes increasingly data-driven and real-time, how do you see the role of fraud management technology evolving over the few years, particularly as attackers adopt more sophisticated tools such as AI?

Fraud management will move further from static, transaction-by-transaction rules toward continuous risk intelligence. AI is making it easier for attackers to automate reconnaissance, generate more convincing social-engineering content and test weaknesses at scale; at the same time, it can help defenders connect weak signals across transactions, merchants, card ranges and behavioural patterns.

Research showed 74% said financial-institution fraud and risk professionals had cyber-threat-intelligence capabilities but lacked the ability to apply that information effectively to card-fraud outcomes.

In practice, I expect fraud management to move beyond assessing one transaction at a time. It will increasingly combine real-time decisioning with broader portfolio intelligence, so teams can identify coordinated attacks earlier while avoiding unnecessary friction for legitimate cardholders.

Technology will assist, but human judgement, clear risk policies and accountable operational processes remain essential.

For Sentry, controls are monitored and refined as threats emerge, with specialist investigation supporting the real-time authorisation layer rather than relying on a static set of rules.