The opinions expressed here are those of the authors. They do not necessarily reflect the views or positions of UK Finance or its members.

The industry stopped 70p of every £1 criminals tried to steal, and unauthorised losses fell 5%. Confirmed unauthorised fraud cases still reached a record 4.06 million, up 11%. Both things are true at once, and the reason is that case count no longer measures how well banks are doing. It measures how much attackers are producing. 

A case, in the reporting, is a confirmed instance of fraud against a customer. A campaign is what a criminal group actually runs, and the distance between the two has grown. A single phishing kit or mule network can target many banks at once, and each strike it lands becomes its own case, logged and worked separately, often across different institutions. The record reflects one adversary reaching more victims, rather than a rise in the number of adversaries. Bank fraud teams see the effect directly: a single phishing campaign can trigger hundreds of investigations before the working day is over.

For banking trojans and account takeover, the same attacker is reconstructed again and again, each time from nothing, because the queue presents one campaign as hundreds of unrelated events. The device in one case appears in a dozen others, but nothing surfaces the link while the clock is running, so the pattern is rebuilt rather than reused. In authorised push payment fraud, the linkage runs differently - through mule account chains and beneficiary patterns that cross institutions - but the outcome is the same: fragmented visibility of a campaign that is anything but fragmented at the attacker's end. Human effort scales almost linearly with case volume. Criminal effort barely changes once the infrastructure exists. Those curves parted some time ago, and no hiring plan brings them back together. 

The natural response is that more analysts cannot close the gap on their own. Extra hands raise throughput on individual cases, but the structural mismatch remains, and the campaign is now divided across more people who each see a smaller part of it. Each case has grown heavier at the same time. An attack that once touched one channel now crosses the mobile app, the browser session, a compromised device and a mule account, so building the picture means drawing evidence from systems that were never designed to share it. Teams face three pressures together: more cases, more evidence buried in each, and less sight of the campaign behind them. 

None of this reflects on the people doing the work. Judgement, deciding whether risk is real and what to do about it, is the scarce and valuable act. Reassembling scattered signals into a picture is mechanical, and it is consuming the capacity that judgement needs. 

For a Head of Fraud or a CISO, a more useful question than the weekly case count is whether investigation keeps pace with the rate at which attacks are generated. Closing that gap means work starting from the campaign rather than the isolated case, so experienced investigators spend their time on the decisions only they can make: judging the response and shaping the controls that reduce future exposure. 

The record in this year's report is not a mark against the banks that cut losses and blocked most of what was thrown at them. It shows that fraud has industrialised while investigation stayed manual, and the case count is only where that first becomes visible. More counting will not change it, and neither will more hiring. The advantage belongs to whoever can see the whole campaign, and for too long that has been the criminals.