One fraud prevention platform. Built for lean teams.
Acoru gives you one platform that covers transaction monitoring, account takeover, new-account fraud, scams, and money mule classification. Through Continuous Account Intelligence, you can replace legacy tools or start fraud prevention without buying three products.
Most institutions run multiple fraud tools, each bought to solve one problem. None connect to the others, and some institutions run no fraud solutions at all.
Datos Insights describes financial criminals' exploitation of AI as a critical inflection point: fraudsters can now automate and scale attacks that were previously impractical. Size no longer decides who gets attacked. They probe the gaps between tools, starting with test payments of a few cents to confirm a route.
You do not have to originate fraud to pay for it. Regulators are shifting liability to the receiving side, so a money mule account on your books is a cost you carry today.
Isolation of data and intelligence is a systemic vulnerability.
Pallavi Kapale, Senior Financial Crime Officer, Bank of China (January 2026)
Capabilities
How Holistic Fraud Prevention stops fraud earlier
01
360-degree visibility, starting from your own history
Every channel, event, session, and transaction is scored in real time. Across all channels you operate: digital banking, mobile, call center, IVR, ATM, branch, cards, and payments. It picks up account changes that often precede fraud, such as a dormant account reactivating. Acoru learns from your historical data before go-live, so classifications are useful from day one.
02
An AI workforce, so the platform runs with the team you have
Your analysts spend their time on the decisions that need them. AI Workforce continuously monitors every account’s full behavioral history, surfaces emerging patterns, and runs investigation and mitigation workflows within the guardrails your institution sets.
AI Assistant explains every classification in plain language and drafts the report. Your policy decides what runs automatically and what waits for analyst approval, and every decision traces to observable account behavior.
03
Transaction monitoring, in and out
Real-time fraud detection scores every payment, fast enough to stop instant payment fraud: inbound and outbound, across all rails, at any value, with no minimum threshold. A low-value test payment that validates a mule route is scored the same as a high-value transfer. When risk warrants it, Acoru orchestrates step-up authentication or other controls.
04
Account takeover, read against the account’s own history
A takeover shows up as a break in an account’s established pattern: a never-before-seen device, an unfamiliar session, or a detail change followed quickly by a payment attempt. Acoru correlates device and session signals across sessions rather than judging each one in isolation.
05
One account lifecycle, and the customer behind it
Acoru continuously classifies every account (Regular, Victim, or Mule) and scores the entities around it, for payers and payees alike, at Level 1 (accounts you hold) and Level 2 (their external counterparties), using your own data alone. Link analysis connects accounts that share a holder, device, IP, or phone, so a risk change re-scores every linked account. Consortium Manager adds Level 3 as an optional add-on.
06
One console to analyze and manage all levels of customer risk
One console analyzes every event, so tuning happens in one place. The platform detects events, determines risk level, explains why, and recommends an action. Analysts open an investigation from any account, alert, or query and expand through related entities with graph tools. Rules and thresholds change in a no-code interface and take effect in real time, under role-based access controls. Detection runs on Acoru's standard library of attributes, signals, and rules.
Most institutions buy transaction monitoring and online fraud detection solutions separately. That means multiple contracts, multiple integrations, multiple rule sets, and two teams tuning thresholds. It also means no link between the login session and the payment that follows it. Holistic Fraud Prevention covers both on one platform:
01 / 04
One integration
Connect your channels and data sources once. Every event lands in one model of the account.
02 / 04
One set of rules
Build a signal once and use it across payments, sessions, and onboarding, instead of maintaining the same logic in two systems.
03 / 04
One console
Analysts work one alert per account, with the session, device, and payment history in one view, not one alert per system.
04 / 04
One contract
One vendor to procure, deploy, govern, and audit.
01 — 04
The savings are not only in licenses. They're in the integration projects you don't run, the independent rule sets you don't maintain, and the investigations your team doesn't repeat across tools.
Use cases
Relevant use cases
Warn likely scam victims at the point of payment
using victim classification.
Detect mule activity on inbound payments
to limit receiving-side liability.
Replace legacy transaction monitoring
with real-time inbound and outbound scoring across rails.
Stop fraudulent account openings
by spotting links to known fraud or mule activity before the account can collect scam proceeds or run up losses.
Confirmation and verification of payee
by reading sessions, devices, and payments against the account's own history.
Acoru learns from your historical data and back-tests against known fraud cases before any live decision. Start in monitor-only mode, move to escalate-only, and raise automation as confidence builds.
01Learn from your historical data
02Back‑test against known fraud cases
03Start in monitor‑only mode
04Move to escalate‑only
05Raise automation as confidence builds
Data privacy and residency
Acoru runs on-premises, in your private cloud, or in a hybrid environment.
Single- or multi-tenant: the institution decides where Acoru runs and who operates it. Shared intelligence follows data minimization: only what each purpose needs, within what each jurisdiction allows.
Compliance
Regulatory trends
New regulation and payment-scheme rule books are moving fraud accountability earlier, to before a transaction is initiated. They are also spreading it across sending and receiving banks.
United Kingdom
Since 7 October 2024, the Payment Systems Regulator's reimbursement requirement has obliged payment service providers to refund victims of authorised push payment (APP) scams on Faster Payments and CHAPS, up to £85,000 per claim, unless the customer acted with gross negligence. The sending and the receiving Payment Service Provider (PSP) split the cost 50:50. Confirmation of Payee checks the name on the account; it cannot tell you the account is a mule.
“Now that both parties in the payment journey (the sending PSP and the receiving PSP) share the cost of reimbursing victims, there is a much stronger incentive for all PSPs to prevent APP scams from occurring in the first place.”
European Union
Since 9 October 2025, the Instant Payments Regulation (IPR) has required Verification of Payee (VoP) on euro credit transfers. A money mule account opened in the right name passes cleanly. Once they apply, the EU Payment Services Regulation and PSD3 will require fraud monitoring, fraud-data sharing, and refunds for consumers deceived by bank impersonators. The mule account is becoming the receiving bank’s problem.
“Mandatory fraud preventive measures will be applied and lead to less payment fraud. Banks have to share more of the burden if they fail to do their part.”
United States
Nacha’s Operating Rules are private-sector rules that bind every Automated Clearing House (ACH) participant by contract. The largest participants have been covered since March 20, 2026, and all others since June 19, 2026. The rules require risk-based monitoring of ACH credits initiated due to fraud, including those made under false pretenses. For a receiving bank, that means watching the credits that land in its customers’ accounts.
“These rules require fraud monitoring by Originators, Third-Party Service Providers, Third-Party Senders and ODFIs to identify ACH credit entries initiated due to fraud, including transactions authorized under false pretenses.”
Which Continuous Account Intelligence solution is right for you?
This solution
Holistic Fraud Prevention
If you are replacing legacy tools, consolidating or establishing a fraud stack baseline
Scam Prediction and Mule Classification
When scams or money mules are your biggest challenge, add decisions span the full account lifecycle, with mule and victim subtypes and orchestration built in.
No. Holistic Fraud Prevention is designed to be your first platform or to replace legacy tools.
How is this different from Scam Prediction and Mule Classification?
Both predict scams, at different depths. Holistic Fraud Prevention covers the core fraud types on one cost-contained platform, including three account states: Regular, Victim, and Mule. Scam Prediction and Mule Classification goes deeper for banks with a mature stack. It adds broader orchestration, Acoru’s most capable Large Account Model, custom models, five account states, and mule subtypes. It also tells genuine victims apart from first-party fraud and decides at any point in the account lifecycle.
Do we need the consortium to get value from Acoru?
No. Your own accounts and their external counterparties deliver value from your own data. The consortium is the upgrade, the accounts with no relationship to any of your customers. Consortium Manager is an optional add-on when you want to share fraud intelligence with other institutions.
How does Acoru get our data?
In whatever form it already exists. Acoru takes structured and unstructured data in any format or schema, and normalizes it on ingestion. You can push data to Acoru through APIs, streams, or queues, or Acoru can pull it from your systems through plug-in connectors. Data can arrive in real time or in batches, as a full snapshot or just what changed. No migration project is needed.
How do our systems get results from Acoru?
Two ways, and you can combine them.
Pull: your systems query Acoru's API endpoints on demand. For example, your payment flow can check a new payee before releasing the payment.
Push: you provide the endpoint, and Acoru sends results to it as they change. This works for your SIEM, transaction monitoring system, core banking system, or case management. Results include scores, classifications, alerts, and executed policies, delivered through queues or standard connectors.
With push, risk changes reach you without waiting for a query. When a re-score cascades across linked accounts, each update arrives as it happens.
What data does Acoru need, and how do we provide it?
Three types: account data, transaction data, and session data.
Account data describes each account and its holder, such as opening date, product, status, and KYC attributes.
Transaction data covers payments in and out, with amount, channel, payment rail, and counterparty.
Session data captures digital activity: logins, device and network attributes, and events such as payee setup or limit changes.
Recent historical data lets the models learn your baseline, so Acoru is useful from day one. Extra sources such as onboarding, device intelligence, or case outcomes sharpen the picture, but you don't need them to start. None of this data leaves your environment. If you join a consortium, only the intelligence you choose to share reaches other members.
How is Acoru deployed?
On-premises, in your private cloud, or in a hybrid environment, single- or multi-tenant. Your institution decides where Acoru runs and who operates the infrastructure. Consortium Manager: each member connects through its own node, with no intermediate storage and no shared database.
This solution
![Benefits of Continuous Account Monitoring [A 2026 Guide] cover](/hubfs/acoru-2026/blog/benefits-of-continuous-account-monitoring.webp)
![Cross-Border Banking Regulatory Challenges [+Solutions] cover](/hubfs/acoru-2026/blog/cross-border-banking-regulatory-challenges.webp)
