As digital wallet adoption accelerates, fraudsters are increasingly exploiting the card enrolment process to gain unauthorised access to Apple Pay and Google Pay accounts. Rather than targeting payment transactions alone, attackers are using phishing campaigns to add stolen cards to digital wallets before fraudulent spending begins. Tieto has introduced a layered fraud detection platform designed to identify suspicious wallet registrations at the point of enrolment and strengthen protection across the payment lifecycle.
Targeting Fraud Before Transactions Begin
Tieto has expanded its fraud prevention capabilities with Token Enrolment Monitoring (TEM), a solution developed to detect suspicious attempts to register payment cards in digital wallets.
The platform analyses every wallet enrolment request by assessing multiple behavioural and contextual indicators, including IP address, device language and geographic location. These signals are compared with a cardholder’s normal activity to identify anomalies that may indicate fraudulent enrolment attempts.
Where suspicious activity is detected, the enrolment process is interrupted, allowing the issuing bank to verify the request before the card is activated within the digital wallet.
A Multi-Layered Defence Strategy
TEM represents the first layer of Tieto’s broader fraud prevention framework.
Transactions that pass enrolment monitoring are subsequently assessed by Card Transaction Monitoring (CTM), which analyses payment activity in real time to detect unusual transaction behaviour, including spending patterns that are inconsistent with a customer’s normal activity.
The layered approach is designed to improve fraud detection at multiple stages, reducing the likelihood that compromised cards can be successfully used after being added to a digital wallet.
Fraud Volumes Continue to Increase
According to Tieto, TEM currently prevents between 70% and 80% of attempted digital wallet enrolment fraud.
The company also reported a 100% year-on-year increase in digital wallet enrolment fraud cases between 2024 and 2025, highlighting the growing sophistication and frequency of phishing-driven attacks.
During a phishing campaign in late 2025, TEM identified approximately 3,000 attempted fraudulent wallet registrations before any financial losses occurred. A further 600 cases progressed to the transaction stage, where CTM successfully prevented around half from being completed, while losses in the remaining cases were partially mitigated.
Expanding Fraud Prevention Capabilities
Tieto’s wider fraud prevention operation blocked fraudulent activity valued at more than €1.132 billion during 2025, more than three times the level recorded the previous year. Within that total, its 3D Secure Monitoring capability declined transactions worth more than €225 million.
The company plans to further strengthen its fraud prevention portfolio during 2026 with the introduction of Money Mule Monitoring and Manipulation Risk Monitoring, adding additional behavioural analytics designed to detect financial crime earlier in the payment lifecycle.
As digital wallet usage continues to grow, financial institutions are increasingly investing in layered fraud detection technologies capable of identifying threats before fraudulent payments occur.
What this means for the industry
- Earlier fraud detection can significantly reduce financial losses while improving customer trust in digital payment channels.
- Digital wallet enrolment fraud is becoming an increasingly significant threat for banks and payment providers.
- Fraud prevention is shifting upstream, with greater emphasis on stopping compromised cards before they are added to digital wallets.
- Behavioural analytics are becoming essential for identifying phishing and social engineering attacks.
- Multi-layered fraud detection models are replacing single-point security controls across payment ecosystems.
- Banks are investing more heavily in real-time monitoring as digital wallet adoption continues to accelerate.
Image Source: Pexels.com
