AML vs fraud detection: how they differ and where they overlap

Fraud detection protects a business and its customers from being cheated, usually by deciding on each payment in real time. Anti-money laundering (AML) looks for criminals moving their own money through the business, often by watching patterns over time, and comes with legal duties to report. They share signals and data, but they answer different questions.

Updated 1 November 2026 · RiskCogs team

Fraud detection asks: is someone trying to take money or goods from us or our customer right now? A stolen card at checkout, an account takeover, a fake refund claim. The criminal wants to take value out, and the loss is immediate.

Anti-money laundering asks: is someone using us to make dirty money look clean? The criminal may pay in full, never dispute anything and look like a model customer. The goal is to move funds from crime into the legal economy, and the business is a pipe, not a victim, at least at first.

This difference explains almost everything else: what the teams look at, how fast they need to decide, who they answer to and what they do when they find something.

• Goal: fraud teams prevent losses; AML teams meet legal duties and stop the business being used for laundering.
• Timing: fraud checks run in milliseconds at the point of payment; AML monitoring often runs after the fact across many transactions.
• Unit of analysis: fraud looks at a single payment or session; AML looks at a customer's behaviour over time and their connections.
• Outcome: fraud leads to a block, a challenge or a review; AML leads to enhanced due diligence, account restrictions and, where required, a suspicious activity report.
• Accountability: fraud is a business risk owned by risk or payments teams; AML is a regulatory obligation with a named compliance officer in regulated firms.
• Tipping off: fraud teams can tell a customer why a payment was declined; AML rules usually forbid telling a customer they are being reported.

The overlap is in the data. Both teams care about who the customer really is, which devices and payment methods they use, how many accounts are connected, and whether behaviour is normal for that customer. A device shared by twenty accounts is a fraud signal and an AML signal. So is a burst of deposits followed by a quick withdrawal to a different method.

Some crimes also sit in both worlds. Stolen card money spent on a gaming site and withdrawn to a bank account is fraud against the cardholder and laundering of the proceeds at the same time. Mule accounts that receive scam payments are a fraud problem for the victim's bank and an AML problem for the receiving one.

This is why many firms now talk about financial crime as one area, with shared data and tooling, even if the legal duties and teams stay separate.

Classic money laundering is described in three stages: placement, where criminal money enters the financial system; layering, where it is moved around to hide its origin; and integration, where it comes back out looking legitimate. Online payments can be used at each stage.

Patterns that compliance teams commonly watch for include:

• Deposits followed by withdrawals with little or no real activity in between, such as almost no play on a gaming account.
• Funds coming in on one payment method and going out to another, especially to accounts in other names.
• Many small payments that add up to a large amount, kept just below thresholds that would trigger checks.
• Purchases of easily resold goods or stored value, such as gift cards, followed by quick resale.
• Groups of accounts with shared devices or addresses that pass money between each other.
• Refunds requested to a different card or account from the one that paid.

Even without legal duties, fraud teams benefit from watching these patterns. Several of them are also early signs of fraud: refunds to a different card are a classic way to cash out stolen cards, and account rings that pass money around often run bonus abuse or chargeback schemes too. Spotting them early protects the business either way.

Almost every business that takes payments online needs some fraud detection, because almost every checkout is attacked sooner or later. The level of protection depends on what you sell and how fast you deliver it.

AML duties apply to regulated sectors. In the EU, the anti-money laundering directives and the newer AML regulation cover credit and financial institutions, payment and e-money institutions, crypto-asset service providers, gambling services and several other professions, with national rules on top. A typical online shop is not an obliged entity, although its payment provider is.

If you are not sure whether you are regulated, ask a lawyer in your jurisdiction. This article is a general overview, not legal advice.

• Identity consistency: names, emails, phone numbers and documents that agree with each other.
• Device and network: the same device or IP range linked to many accounts.
• Payment methods: many cards or wallets added and removed quickly, or cards issued far from the customer's location.
• Velocity: unusual numbers of transactions in short windows.
• Flow of funds: money arriving one way and leaving another way soon after, with little real use in between.
• Account links: shared addresses, beneficiaries or behaviour across supposedly separate customers.

1. Collect signals once. Device, network and identity data used for fraud decisions can also feed AML monitoring.
2. Keep decisions separate. The fraud system decides in real time; the AML process reviews and reports under its own rules.
3. Share alerts both ways. A fraud team that finds a mule network should tell compliance, and the reverse.
4. Agree on case handling, so a customer is not blocked by one team while another is investigating quietly.
5. Document who owns each decision, since regulators will ask about AML and acquirers will ask about fraud.

Online gambling is where the two meet most often. Operators are obliged entities for AML in the EU and many other markets, and they face heavy payment fraud, bonus abuse and multi-accounting at the same time. Deposits with stolen cards, minimal play and quick withdrawals are both a fraud loss and a laundering pattern.

For operators like these, one shared view of player identity, devices and payment methods saves a lot of effort, while the AML decisions themselves stay with the compliance team and its regulated processes.

RiskCogs is a payment fraud scoring tool, not an AML or transaction monitoring system, and it does not file reports to authorities. It scores each payment through POST /v1/risk-score with device, network, card and history signals and returns readable reason codes.

Those signals and links, for example many accounts on one device, can be useful inputs to your compliance team's own monitoring. Fraud decisions use default bands of allow under 40, review 40 to 69 and block from 70.

• Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering or terrorist financing (AML Regulation), Official Journal of the EU, 19 June 2024.
• Directive (EU) 2015/849 (Fourth Anti-Money Laundering Directive), as amended.
• FATF, International Standards on Combating Money Laundering (FATF Recommendations).

• Payment fraud prevention
• iGaming fraud prevention
• Device fingerprinting
• Bonus abuse in iGaming
• Pricing
• Talk to the RiskCogs team