Fraudsters are great improvisers. The moment a control closes one door, they look for the next open window. Financial services spend billions chasing these windows, layering on more monitoring, alerts and investigations. But what if the smarter move isn’t to react faster – it’s to design systems where crime simply doesn’t fit in the first place?

This is the principle of designing out financial crime.

It borrows from criminology’s concept of “crime prevention through environmental design” and “situational crime prevention” – the idea that physical spaces can be structured to reduce opportunities for burglary or theft. Just as a well-lit street deters crime, a well-designed digital journey can block fraud before it ever happens.

Why Friction Isn’t Always Bad

Financial services often treat “friction” as the enemy of customer experience. But not all friction is created equal.

Bad friction is clunky, confusing, and makes legitimate customers give up. Good friction is subtle, purposeful, and protective.

Think of a confirmation screen that nudges a customer to reconsider sending money to a brand-new payee late at night. Or a short delay that prevents high-risk instant transfers from being exploited in real time. A little well-placed friction can save millions – and reputations. Particulary if the friction arrives ‘just in time’.

Principles for Designing Out Crime

Designing out financial crime isn’t about adding more checks for the sake of it. It’s about embedding resilience into the system. Some core principles:

• Default safe states: Products should be secure by default, not reliant on customers opting in.
• Layered defences: If one control fails, another catches the attempt.
• Human-centred design: The safest path should also be the easiest path for customers.
• Explainability & transparency: Controls should be visible and understandable, building trust rather than confusion.
• Interoperability: Protections shouldn’t stop at the edges of a single bank or platform. Criminals exploit weak links, and so, idealistic or not, defences must be shared.

The Emerging Threats Demanding New Design

The fraud landscape is changing too fast for patchwork responses – Deepfakes and impersonation challenge biometric verification and KYC. Generative AI makes scam scripts more persuasive, more human-like, and harder to detect. Instant payments shrink the response window to seconds. Cross-platform exploitation, fraud that jumps between social apps, marketplaces, and banking systems, bypasses siloed controls.

Each of these threats demands design responses: more robust verification layers, risk-based delays, collaborative standards, and built-in protections for vulnerable users.

A Simple Design Audit: Questions to Ask

Every product or system team can start with a few straightforward questions:

• What is the path of least resistance for a bad actor?
• Where is friction optional versus mandatory?
• What happens if a control fails, what is the fallback? How easily can that be compromised?
• Which user flows are most attractive to money mules or scammers?
• How interoperable are our controls with partners and vendors?

These questions don’t just identify weaknesses. They spark the redesign conversations that lead to more resilient systems.

The Barriers (and How to Overcome Them)

Designing out crime is not without its challenges. Product teams fear that new safeguards slow delivery. Compliance teams worry about cost. Legacy infrastructure creates drag.

But lets really think about this here – every pound spent on building resilient systems saves multiples in fraud losses, regulatory penalties, and customer churn. And designing out crime is not about slowing down innovation – it’s about building sustainable innovation.

Change doesn’t come from a single team. It requires collaboration across product, compliance, technology, and customer experience. That agility needs to be given space, time and resources to happen.

Where We Go From Here

Designing out financial crime is more than a technical exercise. It’s a mindset shift: from reactive to proactive, from patchwork to architecture.

The financial services industry already has the tools and knowledge to make this shift. What’s missing is the framework to embed crime-resistant design at every stage of product and policy development. That’s the work I’m passionate about: helping organisations design systems where fraud simply doesn’t fit.

If you’re building products or controls in banking, fintech, or RegTech and want to explore how design audits or labs could strengthen your resilience, I’d love to hear your perspective. What challenges keep you awake at night? lets see how we can design them out together.