You can use the search function to find a range of UK Finance material, from consultation responses to thought leadership to blogs, or to find content on a range of topics from Capital Markets & Wholesale to Payments & Innovation.
Most fraud detection AI runs on fixed rules: useful only for catching what it's been told to look for. Inference models reason differently, learning patterns rather than a checklist and connecting scattered signals that don't belong together, even years apart. But not all inference models reason from the same material: the one behind this session's case is built on years of real criminal-underground data – malware logs, breach records, phishing captures, exposed card BINs – and the investigative tradecraft to correlate it, not generic public text. It's recaptured directly from the infrastructure fraud actors use, never purchased from criminal marketplaces.
We'll walk through one of many real cases relevant to UK institutions: a threat actor with victims in both the US and the UK, the kind of cross-border fraud UK Finance members increasingly hold a piece of without knowing it. In 2020, a malware infection surfaced an email address and the fraud infrastructure behind it. Breach data since, shows the email still active, now linked to a current US romance scam complaint. Each piece alone is a fragment; together, they become identity intelligence, raising the possibility of full real-name attribution. The same signal that resolves this case after the fact could just as easily inform a risk decision before an institution ever takes that identity on as a customer.
A rules-based system has no reason to hold onto a five-year-old infection record, let alone connect it to an unrelated complaint years later. An inference model can, with an analyst confirming before anyone acts.
Systems Engineering and Investigations Manager, EMEA SpyCloud
Mandeep Sandhu is a Systems Engineering and Investigations Manager for EMEA at SpyCloud and based in the UK. With over 27 years in IT and the last 20 ...
Mandeep Sandhu is a Systems Engineering and Investigations Manager for EMEA at SpyCloud and based in the UK. With over 27 years in IT and the last 20 focused on security technology, he works directly with law enforcement on criminal investigations and helps financial institutions understand and minimise their threat exposure and prevent & investigate fraud. Mandeep brings deep knowledge of advanced targeted attack techniques and how stolen data drives the fraud attack lifecycle, grounding the session in UK and European context.
Investigations Manager (Law Enforcement/Fraud), SpyCloud
Tom Harper is SpyCloud's Investigations Manager (Law Enforcement/Fraud), with nearly 30 years investigating criminal, cybercrime, and fraud cases. As ...
Tom Harper is SpyCloud's Investigations Manager (Law Enforcement/Fraud), with nearly 30 years investigating criminal, cybercrime, and fraud cases. As a retired Senior Federal Agent and former Special Agent in Charge of Cyber Crimes at the U.S. Department of Education, he led investigations into computer intrusions, financial fraud, and digital forensics that contributed to landmark legislation and multiple high-profile prosecutions.
At SpyCloud, Tom uncovers threats using identity intelligence and tradecraft built from digital forensics, malware analysis, and scripting in Python and Bash – the same pivots, prioritisation, and pattern recognition now built into how the Research Agent investigates. A former Major in both the U.S. Marine Corps and the Virginia Army National Guard, he also brings deep leadership experience in national cyber defence operations and investigative program management.
Director of Financial Crime , UK Finance
Kathryn Westmore is Director of Financial Crime at UK Finance, working with government, regulators, law enforcement and the financial services industr...
Kathryn Westmore is Director of Financial Crime at UK Finance, working with government, regulators, law enforcement and the financial services industry to develop practical and effective responses to money laundering, illicit finance and wider economic crime issues.
Prior to joining UK Finance, Kathryn led the Financial Crime Policy Programme at RUSI, where her work focused on emerging financial crime threats and the design and implementation of effective policy and regulatory responses. During this time, she served as Specialist Adviser to two Parliamentary inquiries and contributed to national and international policy discussions on economic crime and illicit finance.
Earlier in her career, Kathryn spent 15 years at PwC advising financial institutions on financial crime risk and regulatory change.
SpyCloud transforms recaptured darknet data from malware-infected devices, successful phishes, combolists, and third party breaches to disrupt cybercr...
SpyCloud transforms recaptured darknet data from malware-infected devices, successful phishes, combolists, and third party breaches to disrupt cybercrime. Its automated identity threat protection solutions use advanced analytics and AI to accelerate investigations and protect workforce, consumer, and supplier identities from the threats that matter most: authentication bypass, session hijacking, malicious insiders, account takeover, ransomware, and fraud.
SpyCloud's Cybercrime Investigations with Research Agent, helps fraud and financial crime teams correlate identifiers, attribute threat actors, and close cases in minutes rather than days, all while keeping the analyst in control of the final call. Customers include majority of Fortune 10 and several London FTSE organisations, including global banks, financial institutions, building societies, and challenger banks across the UK and Europe.
By downloading this document, you understand and agree that any sharing, distribution or republishing of the content, without prior written authorisation from the author or content managers at UK Finance, shall be constituted as a breach of the UK Finance website terms of use.
