The cashier’s chime was barely a whisper before the next customer stepped up.
Embedded payments. They’re the sleek, almost invisible financial plumbing of modern commerce. Think booking a flight and the payment just… happens. Buying something within an app, and your card details are already there, waiting. It sounds brilliant, doesn’t it? Frictionless. Effortless. The future. Except, that same elegance is a neon sign for the bad actors.
This isn’t about a stolen card number at a sketchy website anymore. That’s practically antique. Fraud has migrated. It’s moved upstream. Eric Frankovic from WEX laid it out plainly: “As payments get easier and faster, fraud gets smarter and moves upstream.” It’s a perfect encapsulation of how innovation often creates its own shadow.
What does “upstream” even mean? It means before the actual tap or click of payment. It’s in the onboarding process. It’s in how the different pieces of software talk to each other via APIs. It’s in the murky world of third-party partners that power these smoothly experiences. Attackers aren’t just looking for a wallet; they’re looking for the keys to the entire kingdom.
Where Does the Buck Stop?
This distributed risk means that the old models of defense — checking a transaction as it happens — are about as effective as a screen door on a submarine. If you’re only looking at the moment of payment, you’re already too late. The damage is done. The fraudsters have already slipped through the cracks. Accountability, as Frankovic puts it, can’t be ambiguous. “If ownership isn’t clear, fraud will find the gaps.” This is where things get messy, as multiple FinTechs, banks, and platforms all have a hand in the cookie jar.
And who usually ends up holding the bag? The platform orchestrating the whole dance. They’re the ones with the user data, the transaction logs, the final decision point. When an ecosystem is built on a dozen different vendors, each with their own security protocols (or lack thereof), pinpointing blame becomes a bureaucratic nightmare. This lack of clarity isn’t just an operational headache; it shapes how security is even built in the first place.
Prevention Is the New Detection
Remember those days of a suspicious transaction triggering a text message asking, “Did you just buy a yacht in Monaco?” Those days are rapidly disappearing. The speed of embedded payments means there’s no time for a human to ponder. “There’s no time for the manual review. Everything shifts to real-time scoring automation controls and the ability for us to act immediately,” Frankovic told PYMNTS. The best strategy, he says, is disarmingly simple: “The best fraud strategy remains simple. It’s don’t let the bad transaction happen.”
This shifts the entire paradigm from catching fraudsters after they’ve acted to building defenses so strong that they never get the chance. It means integrating security checks directly into the transaction flow, making decisions at machine speed. It’s a constant, silent battle fought in milliseconds, invisible to the end-user unless, of course, something goes wrong.
The Tightrope Walk: Security vs. Experience
Here’s the eternal quandary for any fintech trying to be both secure and user-friendly. Embedded payments won the user experience race by being invisible. Adding security measures risks reintroducing that dreaded friction. Nobody wants their perfectly smooth checkout interrupted by a gauntlet of security questions. Frankovic’s take? It’s not about blanket restrictions, but precision. “Adding friction only when something looks off.” That requires sophisticated data analysis. It means looking for deviations from normal behavior, flagging those that truly seem suspect. The trick is calibrating these interventions so they don’t annoy legitimate customers. It’s a delicate art, balancing the need for caution with the expectation of instant gratification.
Building Fortresses in the Flow
WEX’s approach, for instance, leans heavily on these upstream controls. Virtual cards are a prime example. These aren’t your dad’s credit cards. They can be locked down tight: specific merchants, specific dates, specific dollar amounts — “down to the penny,
🧬 Related Insights
- Read more: What is AML (Anti-Money Laundering)?
- Read more: CEXs Shun Hype: Realistic Listings & Reserves Rule 2026
