How banks are winning the digital wallet fraud war

Phishing and fraud targeting digital wallets are rising fast, and the mechanics are depressingly straightforward: criminals steal card details, trick cardholders into revealing activation codes, then load the card into a wallet they control. Tieto Banktech says its answer, Token Enrolment Monitoring (TEM), is already stopping most of that activity before the card ever reaches a usable wallet.

1. Tieto Banktech launched TEM in 2024 to scrutinise every attempt to register a card in a digital wallet. It checks signals such as IP address, language and location against the customer’s normal behaviour, and freezes suspicious enrolment attempts before activation.
2. Silje Andrea Kvernberg, Tieto Banktech quality & risk manager, Financial Crime Prevention, said that if something does not add up — for example, an unfamiliar language or an IP address from a completely different country — the process is halted and the bank contacts the cardholder to confirm whether the attempt is legitimate or fraud.
3. Sverre Larsen, Tieto Banktech fraud specialist, said TEM alone stops between 70 and 80 per cent of all attempted digital wallet enrolment fraud. He added that there was a 100% increase in cases related to digital wallet enrolment from 2024 to 2025, which is a tidy way of saying the attack surface is growing faster than the wallet features are.
4. Attempts that get past TEM are handled by Card Transaction Monitoring (CTM), which looks for purchases that break behavioural patterns. Larsen gave the obvious example: if a card is used in a shop in Norway in the morning, the same card appearing in Asia that same afternoon is a red flag; the purchase is blocked, the customer is contacted, and the card is blocked immediately if the activity is confirmed as fraud.
5. More than 60 banks use Tieto Banktech’s monitoring services. During a phishing wave in late summer 2025, around 3,000 cases were stopped in TEM without losses, while CTM stopped or curbed hundreds more. In 2025, Tieto’s Defence Centre blocked fraud worth €1.132bn, more than triple the prior year, and 3D Secure Monitoring declined over €225m in transactions.

For PSPs and banks, the useful detail here is the layering: enrolment monitoring catches the wallet setup attack, transaction monitoring catches what slips through, and Tieto says the system gets stronger as it learns across countries. In 2026, Money Mule Monitoring and Manipulation Risk Monitoring are due to add another layer.