December is almost here. Your fintech is preparing for festive promotions, customers are getting ready to spend, and transaction volumes could rise as the holidays approach. But while your growth team plans campaigns and offers, has your fraud team prepared for the activity those campaigns will bring?

More transactions mean more events to monitor. New signups bring unfamiliar behaviour, and staff taking holiday leave can leave fewer people to investigate suspicious activity. There’s another risk that often gets overlooked: what happens to your internal controls when key employees are away, temporary access is granted, and approval responsibilities change?

The challenge isn’t simply whether fraud increases in December. It’s whether your platform can identify and respond to suspicious activity while operational pressure is high.

The best time to prepare your fraud controls for December is November.

Here’s a practical plan for what to review before the festive rush, what to monitor during it, and what to improve afterwards.

Why December needs a different approach

December brings a mix of operational challenges for digital banks, payment platforms, lenders and other fintechs.

Festive promotions attract new customers. Existing customers may transact more often or pay unfamiliar beneficiaries. Support teams handle more payment complaints while fraud investigators take leave.

None of this automatically means fraud. But it makes it harder to tell legitimate changes in behaviour from suspicious activity.

Nigeria’s figures give useful context. According to the Nigeria Inter-Bank Settlement System (NIBSS), digital payment fraud cost Nigeria’s financial system ₦25.85 billion in 2025. NIBSS identified social engineering, particularly insider abuse, as the most common technique, alongside SIM-swap fraud, account compromise and phishing. Its chief executive also stressed the need to monitor staff activity, strengthen institutional controls and coordinate across the industry.

These findings are specific to Nigeria, but the operational challenges of changing transaction volumes, holiday staffing and fraud monitoring apply to fintechs across African markets. Regulations, fraud patterns, and payment infrastructure will differ by country.

December doesn’t have to be your peak fraud month to expose weaknesses in your controls.

Seasonal readiness comes down to four questions:

• Detection: Can suspicious activity be identified as it happens?
• Response: Can the team investigate and act on alerts quickly?
• Internal controls: Are sensitive systems and approvals still protected when staff is away?
• Customer protection: Can suspicious activity be challenged without blocking legitimate transactions?

Five fraud risks to prepare for

Every fintech’s risks differ. A digital lender may worry about fake loan applications, while a payment platform may see more beneficiary changes and suspicious transfers. Still, five scenarios deserve attention before the festive season.

1. Account takeover during high-value transactions

A customer who usually makes small transfers suddenly logs in from a new device and tries to move a large amount to an unfamiliar beneficiary.

It might be legitimate. The customer could be travelling or making a big purchase. But a new device, an unusual amount, and an unfamiliar beneficiary together deserve closer attention than any one of them alone.

Watch for signals such as:

• new-device logins
• unusual locations or access patterns
• repeated authentication failures
• changes to phone numbers or account recovery details
• transactions inconsistent with the customer’s history

Where the risk justifies it, require additional authentication before processing a sensitive action.

2. Fake accounts created through promotions

Festive campaigns bring genuine customers. They also attract people trying to exploit signup bonuses, referral rewards, or promotional credit.

For example, several accounts may be created with different identity details but overlapping devices, contact information, or other shared indicators. The aim is to distinguish ordinary promotional growth apart from coordinated account creation.

Useful controls include duplicate identity detection, device and network signals, unusual referral patterns, and repeated attempts using previously flagged information.

3. Social engineering and payment scams

Fraudsters don’t always need to break into an account. Sometimes they persuade the customer to send the money themselves.

During the festive season, scam messages may impersonate delivery companies, support teams, merchants, or people asking for emergency help. A customer may authorise a transfer before realising the recipient is fraudulent.

Transaction monitoring can flag unusual payments, but it doesn’t replace customer education. Prepare clear warnings, easy reporting channels and an escalation process for suspected scams.

4. Mule accounts moving funds quickly

An account receives several transfers from unrelated senders and quickly moves the money on to other beneficiaries. That pattern can indicate an account being used to launder fraud proceeds.

But many incoming transfers aren’t automatically suspicious. A legitimate merchant receives payments from many customers. Investigators should consider the customer’s established activity, the timing and size of transfers, beneficiary relationships, and the overall flow of funds.

In Nigeria, the CBN’s March 2026 amendment to the BVN operations and watch-list framework adds a regulatory measure here. Since May 1, 2026, financial institutions, including payment service providers, must keep a temporary watch-list for BVNs linked to suspected fraudulent transactions. A BVN can stay on it for up to 24 hours while the owner is contacted for clarification.

This regulatory watch-list is separate from a fintech’s own internal monitoring lists and must be operated according to the CBN’s requirements. The amendment also allows a BVN-linked phone number to be changed only once, which makes accurate identity records and secure account recovery especially important.

5. Insider fraud and weak holiday approval controls

Not every fraud risk comes from outside. NIBSS identified insider involvement as a significant concern and stressed the need to monitor staff activity.

Holiday operations make this harder. An employee who approves sensitive transactions goes on leave. Someone else gets temporary access to cover. Teams work under pressure to resolve customer issues quickly.

If these arrangements aren’t managed, they create openings for unauthorised activity. A temporary reviewer might receive more permissions than the role needs, or one person might be able to both initiate and approve a sensitive action.

Fraud prevention needs to cover both customer transactions and the people who manage them.

Before December: eight actions to take in November

1. Review previous fraud cases and monitoring rules

Start with the data you already have. Look at incidents from last year’s festive period alongside recent cases. Identify which rules caught fraud, which created unnecessary alerts, and where fraud slipped through. Look for patterns in amounts, frequency, devices, beneficiaries, and customer behaviour, and check whether slow investigations contributed to losses.

The goal isn’t to make every rule stricter. It’s to find the controls that need improving before transaction patterns change.

2. Configure monitoring rules for high-risk activity

Your rules should reflect the behaviours you need to detect. Here are four scenarios to review:

These are examples of monitoring logic, not fixed thresholds. A lender, a remittance business and a payment platform will see very different patterns. Set thresholds around your own customers, products and risk exposure, and test proposed rules against historical activity before publishing them.

3. Review limits for newly opened accounts

New accounts have little behavioural history, which makes unusual activity harder to judge. Consider whether new accounts need extra transaction restrictions, closer monitoring, or approval conditions early on. An account that receives a large sum shortly after registration and immediately tries to move it out may warrant review.

Any restriction should align with applicable regulations, approved account limits, and your customer risk policies. The aim is to manage real risk without creating unnecessary friction for legitimate new customers.

4. Introduce step-up authentication at sensitive moments

Not every transaction needs another identity check, but some actions justify one, such as:

• an unusually high-value withdrawal
• a login from an unfamiliar device followed by a sensitive account change
• suspicious activity after account recovery
• a change in account details followed by unusual transfers

A fresh selfie and liveness check can confirm that the person acting matches the customer’s enrolled identity. For customers with an existing authentication reference, that’s far quicker than repeating onboarding. If you’re adding a new authentication flow this month, confirm that the reference data it needs is available for both new and existing customers.

5. Review risk lists and suspicious identifiers

Review known suspicious identifiers before the festive period: IP addresses, phone numbers, email addresses, and identity-related information linked to confirmed or suspected abuse. Keep lists current, document why each entry was added, and have a process for reviewing inaccurate ones.

A shared device or IP address alone isn’t evidence of fraud. Legitimate users share networks and public internet connections.

Take extra care with sensitive identifiers such as BVNs and NINs. You need a lawful basis for processing them, accurate records, restricted access and a way to investigate and correct entries listed in error. An identifier appearing on a risk list is not proof that a person committed fraud. Because a wrong listing can affect someone’s access to financial services, review how you use identity identifiers in fraud controls with Legal and Compliance.

6. Review privileged access and holiday approval arrangements

Don’t leave this step until December. Identify employees with privileged access to customer data, transaction systems, fraud tools and admin functions, then plan how those permissions will be managed during leave. Four controls matter most:

• Privileged access: Confirm employees have only the permissions their roles need. Remove dormant accounts, unnecessary admin rights and access left over from old projects.
• Maker-checker approvals: Keep segregation of duties for sensitive actions. Holiday cover should never let one person initiate and approve the same high-risk transaction or change.
• Activity logging: Make sure sensitive staff actions are logged, including permission changes, manual overrides, approval decisions and changes to fraud rules.
• Temporary access: Record who receives extra access, why, who approved it and when it expires.

Remove temporary permissions when they’re no longer needed, and schedule a formal access review for January.

Holiday staffing should change who performs a control, not whether the control exists.

7. Staff the fraud review queue

A detection rule is only useful if someone can act on its alerts. Before December, decide who monitors cases, who can approve decisions and who takes over when a reviewer is away. Cover weekends and public holidays, and define how critical alerts are escalated out of hours.

If only one person can approve certain decisions, fix that dependency before leave begins. Cross-train backup reviewers, agree on handover requirements and make sure everyone knows which cases need immediate escalation.

8. Prepare customer support and fraud awareness messages

Support often hears about suspicious activity first. Give agents clear instructions for reports of unauthorised transfers, suspected account takeover, phishing and compromised contact details.

Remind customers about common scams. For example, make clear that legitimate support will never ask for PINs, passwords or one-time passwords. Give customers a simple way to report suspicious messages or transactions, and make sure those reports reach the fraud team.

During December: monitor, investigate and report

Once the festive period starts, fraud management becomes a daily routine. Review monitoring performance every day, with closer oversight of critical alerts and high-risk activity.

Watch behaviour, not just amounts

A large transfer isn’t necessarily fraudulent, and a small one isn’t necessarily safe. Look for combinations of unusual behaviour: an account that suddenly receives frequent transfers from unfamiliar senders and moves the money straight on, or a customer who logs in from a new device, changes key details and then attempts an unusual transfer. Combined signals tell you far more than any single transaction.

Keep the investigation queue under control

Track how many cases are waiting, how old they are, how severe they are and who owns them. Critical cases shouldn’t sit in the same queue as routine alerts without clear prioritisation.

If alert volume rises, work out whether the system is catching activity it previously missed or generating false positives. Don’t weaken detection just to cut the number of alerts.

Adjust rules without creating new problems

Fraud patterns can shift quickly, and rules may need updating if you spot coordinated activity across new accounts or suspicious beneficiaries. Changes should still go through approval and testing. Record what changed, why, who approved it and how it affected detection and legitimate customers. A temporary control that blocks large numbers of genuine transactions creates its own operational and reputational problems.

Don’t let fraud reporting stop for the holidays

According to NIBSS, fraud reporting by Nigerian financial institutions fell by 34% in the final quarter of 2025. NIBSS warned that, because incidents weren’t reported, people involved in fraud were able to move to other institutions.

Even with reduced staffing, reporting must stay covered. Make sure confirmed incidents are reported through the required regulatory and industry channels on time, and decide who handles interbank communication and follow-up on recovery or investigation requests. The holidays shouldn’t leave a gap in reporting or industry cooperation.

What your fraud dashboard should show

A useful dashboard answers practical questions rather than just counting events:

Read these alongside overall transaction volume. Alerts may rise simply because you’re processing more payments, so comparing alerts with total activity and confirmed outcomes gives a clearer picture. Track staff-related exceptions separately too: temporary privileged access, manual overrides and unusual approval activity.

After December: use January to improve

The festive period shouldn’t end with a quiet return to normal settings. January is the time to review what worked, what didn’t and what should change permanently.

Review detection performance. Check which rules produced confirmed fraud findings and which generated repeated false positives. Compare losses, suspicious activity, review times and complaints with the months before December. Review any temporary restrictions: keep those that cut risk without hurting genuine customers, and remove or revise the rest through your approved change process.

Remove temporary access and review internal controls. Holiday access shouldn’t become permanent by default. Confirm temporary permissions have been removed, review privileged-user activity and investigate unexplained changes to sensitive settings. Check that maker-checker approvals were followed, and document the reason, approval and corrective action for any exceptions.

Review reporting and escalation. Confirm that December incidents were properly investigated, documented and reported where required. Look at delays, incomplete reports and unresolved coordination with other institutions, and use what you find to improve next year’s holiday plan.

How Dojah helps fintechs prepare for December

Preparing for December means configuring monitoring rules, investigating flagged activity, recognising repeat risks and authenticating customers at sensitive moments. Dojah supports this through EasyDetect and Easy Authentication.

Real-time monitoring with EasyDetect. Dojah EasyDetect evaluates events against your configured rules and returns a risk score and an Allow, Review or Block decision. You can, for example, flag unusual transfers from newly opened accounts, or high-value transactions that come with other suspicious signals, as events happen rather than in retrospective reviews.

Rules without code. The visual Rule Builder lets fraud teams set conditions, risk scores and decision thresholds without engineering work. A team might combine an unusual amount, a new device and recent account changes into one higher-risk rule, then update it through its approval process as patterns change. For a step-by-step guide, see How to Configure Transaction Monitoring Rules Using Dojah’s EasyDetect API.

Custom Lists for repeat risks. Reusable Custom Lists hold identifiers such as IP addresses, phone numbers, email addresses, BVNs and NINs, which your rules can reference. Update a list once and every rule using it picks up the change. For example, identifiers from a confirmed account-farming scheme can feed both onboarding and transaction rules. Manage these lists under the safeguards described in action 5. They are internal monitoring tools, separate from the CBN’s regulatory BVN watch-list.

Case management. EasyDetect’s case management lets analysts review event details and risk indicators and record decisions in one place, rather than tracking alerts across spreadsheets and messages. That consistency matters most when volumes are high.

Step-up checks with Easy Authentication. Easy Authentication allows returning customers to verify their identity through a selfie and liveness check without repeating the full onboarding process. When an EasyOnboard flow with liveness is linked to Easy Authentication before initial onboarding, the captured liveness record becomes the reference for future checks.

For customers onboarded before the flows were linked, businesses should confirm the available authentication or enrolment options with Dojah before introducing the feature. See the February 2026 product update for setup details.

Your business remains responsible for its rules, thresholds, list management and fraud decisions. Dojah provides the tools to apply them consistently in real time.

Don’t let December expose gaps you could fix in November

December may bring more customers, new transaction patterns and extra pressure on fraud teams. The most important preparation happens before that pressure arrives.

Review previous fraud cases. Configure and test monitoring rules. Plan for high-risk account activity. Check privileged access and holiday approvals. Set up investigation coverage and make sure customers know how to report suspicious transactions.

When December starts, monitor results, investigate new patterns and keep reporting. Then use January to review what worked, remove unnecessary restrictions and strengthen the controls that proved their value.

The goal isn’t to stop legitimate holiday transactions. It’s to spot suspicious activity early enough to act without disrupting the customers you’re trying to serve.

Is your fraud team ready for December? Explore Dojah EasyDetect to see how real-time monitoring, configurable rules and case management can support your fraud prevention before the festive rush.

Frequently asked questions

• Does fraud always increase in December?

No. December adds operational pressure, but that doesn’t mean every market or institution sees its highest fraud levels then. Focus on changing transaction behaviour, promotional activity, staffing arrangements and your team’s ability to detect and respond.

What should fintechs do before the December festive season?

Review past fraud incidents, test monitoring rules, prepare step-up authentication for sensitive actions, review privileged access and set up holiday investigation coverage. Prepare customer support guidance and fraud awareness messages too.

• What are the main fraud risks for fintechs during December?

Account takeover, promotional account abuse, social engineering, mule-account activity and insider fraud. Your exact exposure depends on your business model, customers and existing controls.

How can fintechs reduce insider fraud during holiday periods?

Review privileged access, keep maker-checker approvals in place, monitor sensitive staff activity and set clear rules for temporary cover. Remove temporary access when it’s no longer needed and review any exceptions in January.

• Which transactions should be flagged during December?

Unusual transaction velocity, large transfers inconsistent with customer history, rapid movement of incoming funds, and sensitive account changes followed by suspicious activity. Assess these signals with customer context rather than treating them as automatic proof of fraud.

• Should fintechs tighten controls for every customer in December?

No. Target controls at risks linked to customer behaviour, account history and transaction patterns. Blanket restrictions create avoidable friction and disrupt legitimate payments.

• What does the CBN’s 2026 BVN amendment mean for fraud prevention?

Since May 1, 2026, financial institutions, including payment service providers, must keep a temporary watch-list for BVNs linked to suspected fraudulent transactions, for up to 24 hours while the owner is contacted. The amendment also allows a BVN-linked phone number to be changed only once. Treat regulatory watch-listing as separate from your internal fraud monitoring tools.

• Can Dojah EasyDetect help monitor fraud in real time?

Yes. EasyDetect supports real-time monitoring, configurable rules, risk-based decisions and case management, so teams can identify suspicious activity and investigate events that need review.

• How can fintechs reduce fraud without hurting customer experience?

Use risk-based controls. Let routine activity proceed and apply extra checks or review only where behaviour presents meaningful risk. Regularly review false positives, investigation outcomes and customer friction to improve detection without blocking genuine users.