Fraud Scoring for a Neobank: The Onboarding and First-Transaction Window

The risk is front-loaded

A neobank's fraud exposure isn't spread evenly across the account lifecycle — it's concentrated in the first few days. A mature account has a behavioural baseline a model can score against. A brand-new one has nothing, and that's exactly when application fraud, synthetic identities, and money-mule accounts do their damage. Neobank fraud detection has to work hardest where it has the least to work with.

Why the usual signals aren't there yet

Behavioural fraud models lean on history — transactions per card in the last hour, geo-velocity, a device seen before, this account's normal spend. On a first transaction, all of those are empty or undefined. The "seen before" flag is false for everything. The velocity aggregates have one data point. The model that catches account takeover on a two-year-old account has almost nothing to say about day one.

What the first-window model leans on instead

• Onboarding signals. Time to complete the application, copy-paste versus typing in form fields, whether the applicant's details match across the documents, IP and device geolocation versus stated address.
• Device and network. Device fingerprint reputation, whether the device has been seen with other new accounts, emulator and VPN indicators.
• Funding source. The first inbound transfer — its origin, whether the name matches, whether it's a card top-up from a card that's been used to fund other new accounts.
• The first outbound move. A new account that immediately tries to move the full balance out looks different from one that buys a coffee.

The narrative layer helps here

A gradient-boosted model on these signals catches the statistically obvious. A language-reasoning layer over the application narrative and the document set can catch what the features miss — an address that doesn't geographically make sense with the employer, a funding pattern that reads as a mule. The architecture pattern from our fraud-scoring project — a boosted baseline plus a concurrent reasoning layer, combined before a three-tier routing decision — transfers directly; what changes is the feature set feeding it.

Route, don't just block

A new account the model isn't sure about shouldn't be silently declined — that's a lost genuine customer at the worst possible moment. Route it to a soft-hold: limited functionality, a lower transfer cap, or a step-up verification, with a human review path. As the account accumulates history over the first weeks, it graduates out of the high-scrutiny window.

The graduation curve

An account shouldn't sit under maximum scrutiny forever. Define graduation criteria — a set number of days, a handful of normal transactions, no flags raised — and let the friction lift automatically once they're met. As the account accumulates a week or two of ordinary behaviour, the velocity aggregates and "seen before" flags fill in, and it moves to standard scoring. Making that transition explicit stops legitimate new customers being treated as suspects longer than the risk justifies.

Mule accounts look genuine early

A money-mule account is usually opened by a real person — often recruited, paid, or coerced — who passes KYC because they are a real person with real documents. The onboarding and identity checks won't catch it. The tell is the money flow afterward: funds arriving from multiple unrelated sources and being moved straight out, a pattern the behavioural model and the reasoning layer catch in the first days, not the identity check.

Where this stops being right

• A neobank with heavy upfront KYC already catches much of this at onboarding; the first-transaction model is a second layer, not the whole defence.
• Very low new-account volume — a manual review of every new account is cheaper than a model until volume grows.
• The window isn't only the first transaction — first credential change, first new payee, and first large transfer each deserve the same elevated scrutiny.

FAQ

Why is the first transaction so risky? There's no behavioural history to score against, so the model is least able to tell a genuine new customer from application fraud, a synthetic identity, or a mule — exactly when those are most active.

What replaces behavioural history on day one? Onboarding behaviour, device and network reputation, and the funding source and first outbound move.

Should uncertain new accounts be blocked? No — route them to limited functionality or step-up verification with a human review path. A silent decline loses a genuine customer at the worst moment.

ISTRALLEN builds fraud scoring for the account lifecycle, with a first-window model where behavioural history isn't there yet; see AI for Fintech.