Digital payments are removing many of the physical barriers that once prevented millions of people from accessing formal financial services, particularly in markets where building extensive branch networks was commercially difficult. A new $700 million initiative from the International Finance Corporation shows how significant the next stage of that expansion could become, with participating institutions expected to add 90 million active users and issue hundreds of millions of additional cards. Yet the same expansion creates a less visible challenge for the financial industry. Every newly connected customer also introduces another digital identity, device, account relationship and potential fraud target, meaning the infrastructure required to protect digital finance may need to grow almost as quickly as the infrastructure being built to distribute it.
Financial Inclusion Is Becoming a Technology Infrastructure Challenge
Financial inclusion was once primarily an infrastructure problem. Extending banking services into underserved communities meant opening branches, installing ATMs, building agent networks and creating enough physical distribution to make formal banking accessible. Digital payments have fundamentally changed those economics by allowing a mobile device, payment card or wallet to provide access without requiring a bank to establish a substantial physical presence.
The IFC’s latest initiative demonstrates how much further this model could expand. The World Bank Group institution has launched a risk-sharing programme providing up to $700 million in guarantees to cover part of the settlement risk faced by banks, fintechs and other financial institutions seeking to participate in global payment ecosystems. IFC estimates that participating institutions could generate approximately $280 billion in additional digital-payment volume, issue 360 million more cards and increase the number of active users by 90 million, including 39 million women.
Those figures demonstrate the potential reach of modern payment infrastructure, but they also illustrate the corresponding security challenge. Tens of millions of new users mean tens of millions of additional identities that need to be verified and authenticated, while hundreds of millions of new cards and substantially greater transaction volumes create more opportunities for account takeover, social engineering, identity fraud and other forms of financial crime.
Financial inclusion therefore increasingly depends on two infrastructures developing together: the technology that gives people access to financial services and the security architecture that allows them to use those services safely.
The Mobile Phone Is Becoming Part of Financial Identity
This challenge is particularly important in mobile-first markets, where the smartphone and mobile number can play several roles simultaneously. The device provides access to the financial application, while the phone number may also be used for authentication, transaction confirmation and account recovery. What appears to the customer as a simple banking relationship can consequently depend on infrastructure operated by banks, fintechs, telecommunications providers and other technology companies.
SIM-swap fraud demonstrates why those dependencies matter. If criminals can transfer a customer’s mobile number to another SIM, they may be able to intercept authentication messages or exploit recovery processes associated with the compromised number. Phishing and social engineering can create similar problems by persuading legitimate customers to disclose credentials or approve transactions themselves.
This is one reason banks are beginning to reconsider their dependence on SMS one-time passwords. As Finnoex explored recently in The OTP Isn’t Dead Yet. But Banks Are Already Building What Comes Next, the issue is increasingly not whether an OTP proves possession of a telephone number, but whether that information is sufficient to establish who is approving a transaction and whether the approval itself is legitimate.
The International Telecommunication Union is also addressing these vulnerabilities through its Digital Financial Services Security Lab, which helps regulators develop the ability to independently test mobile financial applications and assess security controls. Its recommendations cover areas including mobile application security, SS7 signalling vulnerabilities and SIM-related risks, while also providing a framework for cooperation between telecommunications regulators and central banks. More than 20 countries across Africa, the Caribbean and Latin America have received assistance through the programme.
This regulatory cooperation reflects an important change in digital finance: securing the bank is no longer necessarily sufficient to secure the banking experience because important parts of the customer’s identity and authentication chain can exist outside the institution itself.
Stronger Security Cannot Become Another Barrier to Inclusion
The natural response to rising digital fraud is stronger authentication, but financial inclusion creates a difficult balance. Every additional verification step can make an account more secure while simultaneously making the service more difficult to use, particularly for customers entering formal financial services for the first time.
A customer with a modern smartphone, reliable connectivity and years of digital banking experience may have little difficulty navigating multiple authentication requirements. Someone using an inexpensive handset, inconsistent mobile connectivity or a financial application for the first time may experience those same controls very differently. Security mechanisms that create excessive friction can therefore recreate some of the barriers that digital finance was intended to remove.
This makes risk-based authentication increasingly important. Instead of subjecting every customer and every transaction to the same verification process, financial institutions can use device intelligence, behavioural patterns and transaction context to determine when additional authentication is necessary. A familiar customer making a routine payment from a recognised device may require very little intervention, while a sudden device change followed by a large transfer to a new beneficiary could trigger additional checks.
The objective should not be weaker security for customers in emerging markets. It should be stronger security that requires less effort from legitimate users.
Newly Included Customers Can Become Attractive Fraud Targets
Rapid digital adoption also creates another challenge. People entering digital finance for the first time may not have years of experience recognising phishing messages, fraudulent payment requests, fake customer-service calls or manipulated account-recovery processes. Criminals do not need to defeat the payment infrastructure if they can persuade the customer to cooperate with the fraud.
This places limits on how heavily the industry can rely on consumer education. Awareness campaigns remain important, but a digital financial system designed for mass adoption has to accommodate customers with widely different levels of financial and technological experience.
Fraud prevention therefore needs to continue operating even when a customer makes a mistake. Transaction velocity, unusual beneficiaries, sudden device changes, location patterns and relationships between accounts can all provide additional signals that help financial institutions identify suspicious activity after authentication has succeeded.
This becomes increasingly important as payment networks expand because fraud can also move between institutions. A compromised customer at one provider may transfer money into a mule account held elsewhere, which can then disperse the funds through additional banks, wallets or payment platforms. The security problem consequently becomes larger than the individual account.
More Payments Also Create More Intelligence
Digitalisation creates risk, but it also produces something cash-based financial systems could never provide at comparable scale: data about how money moves.
Every legitimate digital transaction contributes to a customer’s behavioural history. Devices generate signals, accounts develop transaction patterns and payment networks reveal relationships between senders and beneficiaries. When those signals are analysed together, financial institutions can potentially identify anomalies that would be invisible when looking at a transaction in isolation.
A newly opened account receiving payments from many unrelated customers before rapidly transferring the funds elsewhere could indicate mule activity. A customer making a large payment immediately following a device change could justify additional verification, while multiple customers sending funds to the same suspicious beneficiary could expose a wider fraud campaign.
The industry’s ability to share some of that intelligence may eventually become as important as the fraud models operating inside individual institutions. Finnoex recently examined this development in India Tests Real-Time Fraud Intelligence Network Across Eight Banks, where a pilot involving eight banks is exploring whether fraud signals identified by one institution can help protect customers across the wider payments ecosystem.
This creates an important counterbalance to the security challenge created by financial inclusion. Expanding digital payments increases the attack surface, but it simultaneously produces the information required to understand that attack surface more effectively.
Identity Infrastructure Could Become as Important as Payment Infrastructure
The first phase of digital-payment expansion understandably concentrated on connectivity. Customers needed accounts or wallets, merchants needed acceptance infrastructure and financial institutions needed reliable networks capable of moving money.
The next phase could place much greater emphasis on identity. Institutions need to establish that customers are genuine when they enter the financial system, authenticate them without unnecessary friction when they return, recognise compromised accounts and provide secure recovery mechanisms when devices or credentials are lost.
For technology providers, this could bring payment infrastructure, digital identity and fraud prevention much closer together. Identity orchestration, device intelligence, behavioural analytics, biometric authentication and transaction monitoring may increasingly operate as components of the same security architecture rather than separate technologies added at different stages of the customer journey.
The ITU’s work provides an indication of how broad this architecture is becoming. Its Digital Financial Services Security Lab does not concentrate only on financial applications; it addresses mobile-network security, SIM risks, application security, consumer protection and coordination between financial and telecommunications regulators.
The payments industry has spent years making it possible for money to move quickly and cheaply across digital networks. Maintaining confidence in those networks will increasingly depend on whether identity and fraud infrastructure can operate at comparable scale.
Financial Inclusion Should Include Fraud Resilience
There is also a broader question about how the financial industry measures successful inclusion. Opening an account or issuing a payment card provides access, but meaningful financial inclusion requires customers to continue trusting and using the system.
A first-time digital-finance customer who loses savings through fraud may remain statistically included in the financial system, yet their willingness to use that system can be severely damaged. At sufficient scale, this becomes more than an individual consumer-protection problem because declining trust can undermine the adoption that governments, development institutions and financial companies have spent years encouraging.
Fraud resilience should therefore be considered part of financial inclusion rather than a separate cybersecurity objective. Payment networks, identity systems, authentication, regulatory oversight and consumer protection need to develop alongside one another rather than security being added after adoption has already accelerated.
The scale envisaged by IFC shows why this matters. The ability to potentially connect 90 million additional active users to digital payments demonstrates how technology can overcome barriers that physical banking infrastructure struggled to address. IFC But bringing people into the digital financial system is only the beginning of the relationship.
The longer-term measure of successful financial inclusion may be not simply how many people gain access to digital finance, but whether the industry can make that access secure enough for them to remain confident using it.
What this means for the industry
- Financial inclusion and payments security need to scale together. Adding millions of users and hundreds of millions of cards increases access but also expands the number of identities, devices and transactions that financial institutions need to protect.
- Mobile infrastructure is becoming part of banking security. In mobile-first markets, devices, SIMs and telecommunications networks increasingly form part of the authentication chain, making cooperation between banks and telecom providers more important.
- Authentication needs to become stronger without becoming more difficult. Risk-based controls, device intelligence and behavioural analytics can help increase protection without creating unnecessary friction for newly included customers.
- Digital payments create intelligence as well as risk. Transaction histories, device signals and network relationships can provide financial institutions with information that cash-based systems never generated.
- Fraud prevention may increasingly need network-level intelligence. As money moves rapidly between banks, wallets and payment platforms, detecting fraud within one institution may not be sufficient.
- Fraud resilience should become part of financial inclusion itself. Providing access to digital finance is only sustainable if customers can use those services safely and retain confidence in the system.
