When fraud hits one bank on shared infrastructure, it has usually already hit three others. A Nigerian fintech company, Qore is set out to fix that, not just with their products, but with a process.
Low-value account funding, consistent transaction timing, and rapid withdrawals across any single institution are patterns that are easy to miss. This kind of activity falls below alert thresholds, gets reviewed on a Monday morning, and is quietly filed away without action.
For Qore, these patterns immediately signal suspicious behavior. It is not just seen as a coincidence but coordination.
By the time a financial institution would have assembled enough internal data to name what it is seeing, Qore has already validated the pattern, built the controls, and deployed the fix network-wide, within days. Together, through shared infrastructure, they noticed the pattern and stopped it anyway.
This is the difference collective infrastructure makes where fraudulent transactions that would have propagated across multiple institutions are stopped before they reach scale, not because any single institution caught them, but because the network did.
Why Shared Infrastructure Changes the Fraud Equation
Every financial institution sees only its own transactions, but fraud networks, by design, see more. They test typologies across multiple targets simultaneously, identify which defenses are weakest, concentrate on their attacks, and move on before any single institution has accumulated enough data to respond.
Shared infrastructure should change this calculation. In practice, it often does not because operating on common rails without a governance model for shared threat intelligence means the information advantage of the network is never actually realized. Each institution still responds in isolation, still writes its own rules, still sees only its own slice of a coordinated attack.
Qore’s argument and increasingly, its evidence is that shared infrastructure only becomes a security asset when the governance model behind it is designed to translate network-level signals into institution-level protection, fast enough to matter.
The Problem with Moving Fast
Speed is the obvious answer to fraud that moves quickly. Deploy controls faster. Shorten the gap between detection and response. Get there before the scheme reaches scale.
But speed without validation is its own risk, and it is a risk that regulated financial institutions cannot afford.
Deploying an unvalidated fraud control against a weak signal does not just fail to stop the fraud. It flags legitimate transactions, triggers customer complaints, generates regulatory questions about false positive rates, and creates an audit trail of decisions made without adequate evidence. For institutions operating under the CBN’s 2024 Risk-Based Cybersecurity Framework which now requires documented threat intelligence programmes and evidence-based control deployment; a fast but undocumented response can create compliance exposure even when it works.
This is the tension that Qore’s remediation model is designed to resolve: responding at the pace that fraud demands, while generating the documentation that regulators and boards require.
How the Process Actually Works
Qore’s four-stage remediation lifecycle is built around a single principle: no control reaches a live system without passing through a validation gate. The process is not sequential in the sense of being slow, it is sequential in the sense of being defensible.
Fraud signals are first identified at the infrastructure layer, where transaction patterns across hundreds of institutions can be assessed for statistical significance that no single institution data could provide. A pattern appearing at one institution is noise. The same pattern appearing across a dozen institutions within 48 hours is a typology.
Once a candidate pattern is flagged, it goes through structured validation. A documented assessment against three criteria: Is it consistent across multiple institutions? Does it represent a meaningful deviation from normal behaviour? And what is the estimated exposure if it is not addressed? Patterns that do not meet all three criteria do not advance.
Those that do are addressed through targeted controls, transaction velocity rules, sequence-based flags, identity correlation checks, tested in parallel environments against historical transaction data before any live deployment. This parallel testing phase produces two things: proof that the control works, and the audit documentation that proves it was tested.
Deployment is then executed across the network simultaneously, with each institution receiving an anonymised briefing on the nature of the threat and the response, enough information to satisfy their own audit and regulatory obligations, without exposing the data of other institutions in the network.
After deployment, the controls are monitored continuously. If the fraud pattern evolves, the controls evolve with it. The loop closes detection, validation, testing, deployment, monitoring, refinement — and begins again.
What This Tells Us About the Direction of African Fintech Security
Nigeria’s financial sector lost N52.26 billion to fraud in 2024. The NIBSS data shows the number of incidents falling — but the value lost per incident is rising sharply. Fraud is consolidating. The attacks getting through are the coordinated, high-value kind — precisely the attacks that individual institution defences are least equipped to catch.
The World Bank’s research on fraud risks in fast payment systems, and the IMF’s increasingly explicit framing of data-sharing infrastructure as a resilience imperative, point in the same direction: the response to networked fraud cannot be a collection of individual institutional responses. It has to be systemic.
What Qore has demonstrated, with documentation that can withstand a regulatory audit, is that systemic response is operationally achievable — not as a future aspiration, but as a current practice. The governance model exists. The evidence of its outcomes exists. The institutions connected to it are not simply better defended against the fraud patterns of today. They are structurally positioned to respond to whatever comes next.
The fraud analyst who spotted the unusual cash-out pattern that opened this story did not stop the scheme alone. The network did. And the documentation of how it did is the part of the story that tends to get left out — the part that matters most when the auditors arrive.
References
- Central Bank of Nigeria, Risk-Based Cybersecurity Framework and Guidelines for DMBs and PSBs, issued 31 May 2024, effective 1 July 2024.
- IMF, Global Financial Stability Report, October 2025. Risk transmission in interconnected digital financial systems.
- World Bank (2023). Fraud Risks in Fast Payments. fastpayments.worldbank.org
- Nigeria Inter-Bank Settlement System (NIBSS), Fraud Report 2024 (released February 2025).
- LexisNexis Risk Solutions (2025). True Cost of Fraud Study. truecostoffraud.com
- Basel Committee on Banking Supervision (2023). Digital Fraud and Banking: Supervisory and Financial Stability Implications. bis.org
- Technext24, “Nigeria fintech fraud data sharing gap costs industry billions,” April 2026.