Asymmetrical Warfare: Why Banks, Despite Having All the Resources, Suffer Tactical Defeats from Carders

[Professor]

The Role of Banks and Payment Systems: Why Do They Often Lose in the Battle Against Fraudsters?​

The paradox of modern financial security: banks and payment systems possess trillions of dollars, superior technology, and the legitimate right to use violence, yet in the daily battle with fraudsters, they often find themselves playing catch-up or losing. This is no accident, but a consequence of a fundamental asymmetry in goals, constraints, and economic incentives.

1. Asymmetry of Goals: System Defense vs. Vulnerability Attack​

• The bank/payment system's goal is to maximize legitimate turnover, minimize losses, and comply with regulatory requirements (AML/KYC). Security is one of many objectives, and its tightening directly conflicts with customer convenience and conversion.
• The fraudster's goal: to find and exploit one specific vulnerability in the chain (weak store verification, an outdated bank algorithm, human error) to profit. This is the sole objective to which all resources are devoted.

Bottom line: The bank defends the fortress perimeter, while the swindler looks for one crack in the wall or bribes one guard. Defending everything is always more difficult than attacking one thing.

2. Economic Asymmetry: Costs of Defense vs. Costs of Attack​

• Bank's costs for protection:
  • Enormous. Implementation of new systems (AI anti-fraud, biometrics), maintenance of security departments, compensation for fraud victims (according to the laws of many countries), and regulatory fines.
  • Every false positive means a lost client, negative reviews, and lost revenue. The bank is forced to balance the books.
• Costs of attack for a scammer:
  • Minimal. A full-zill package ($10-$100), a month's worth of proxy and anti-detection software ($100-$300), and software (often downloaded for free). Even with a 90% failure rate, one successful $5,000 operation pays for itself.
  • The losses from a failed attack for the fraudster are zero (unless they are arrested). For the bank, the losses from a successful attack are direct losses plus reputational damage.

Bottom line: For a bank, security is an expense that reduces profits. For a fraudster, it's an investment with a monstrously high potential ROI. The bank skimps on security, the fraudster skimps on everything but it.

3. Regulatory and legal asymmetry: Rules vs. Rulelessness​

• Bank restrictions:
  • Data protection laws (GDPR, CCPA): Make it difficult for banks and merchants to collect and share customer information.
  • Client obligations: In the EU and the US, banks are often required to reimburse victims of fraud (chargeback liability). This turns them into "insurance companies," which is economically disadvantageous.
  • Difficulty of prosecution: Initiating a case and making an arrest requires irrefutable evidence, warrants, and interagency cooperation — a process that can take months.
• Freedom of action for the fraudster:
  • There are no rules. You can use fake documents, stolen data, and anonymous networks.
  • Speed: The transaction from order to cashout takes hours or days. Banks and police simply don't have time to physically respond.

Result: The bank is bound by red tape; the fraudster operates in a legal vacuum of speed and anonymity.

4. Technological and organizational asymmetry​

• Bank vulnerability – legacy systems: Large banks operate on outdated mainframe infrastructure, which is difficult and dangerous to upgrade. The implementation of new security systems is slow.
• A bank's vulnerability is the human factor within: the weakest element. This includes employees susceptible to phishing or insider attacks, and clients who fall for social engineering and violate security rules.
• Fraudster adaptability: Fraudulent schemes evolve faster than banks can release patches. As soon as a bank closes one vulnerability (for example, introducing 3D-Secure), fraudsters find a new one (OAuth attacks, tokenization, SIM swaps).
• Collaboration vs. Disunity: Fraudsters actively share data on dark forums. Banks, on the other hand, compete with each other and are reluctant to share information about breaches due to concerns about their reputation and regulatory repercussions.

5. Why do banks "often lose" in specific incidents?​

• They can't block everything. A hard block on any suspicion would lead to a revolt by legitimate clients.
• **They often cover losses at their own expense. Therefore, from a P&L perspective, it's sometimes cheaper to periodically lose money to fraud than to invest endlessly in 100% protection, which is impossible anyway.
• They react after the fact. Their systems are tuned to detect anomalies, not to predict new, unknown attacks.
• Their ultimate goal isn't to "defeat fraudsters," but to keep losses within the planned risk appetite. If fraud losses amount to 0.1% of turnover and are within the budget, the bank is "managing" from a management perspective.

Where banks still win (strategically)​

1. Pressure on the ecosystem: Banks, through regulators, are forcing all participants to tighten the rules : stores (PCI DSS), telecom operators (fight against SIM swaps), crypto exchanges (KYC/AML).
2. Investigation and dismantling of groups: Although they are losing tactically, strategically, bank security services (in collaboration with the police) are dismantling entire fraudulent networks through complex, multi-stage operations. One network is simply replaced by another.
3. Slowly but surely, new standards are being implemented: The introduction of tokenization (Apple Pay/Google Pay), FIDO2 authentication, and behavioral biometrics is gradually raising the bar, weeding out the least skilled fraudsters.

Conclusion: Banks are not "losing the war"; they are fighting it on an unfavorable battlefield.​

Banks are losing tactical skirmishes due to asymmetry, but are waging a strategic war of attrition. They can afford to lose millions if it's economically justified, and they are slowly but surely pushing fraudsters into increasingly narrow and expensive niches.

For fraudsters, this means the "easy money" is running out. Only complex, high-risk, and capital-intensive attacks remain. For banks, it's an admission that perfect security doesn't exist, only risk management and a balance between convenience, profit, and loss. They are losing battles, but thanks to their size and resources, they have every chance of surviving the war by making mass carding unprofitable. The real confrontation, however, has shifted to the level of states' fight against organized cybercrime, where banks are just one of many parties, albeit a key one in terms of finances.