If you run fraud or product at a fintech, every check you add to a transaction costs you some legitimate customers who give up at the step, and every check you remove leaves a gap that fraudsters can use. 

Now picture two transfers on your platform on the same Monday: One customer tops up their wallet with ₦500, as they do every week. Someone else, on a phone the account switched to two days ago, sends ₦500,000 to a beneficiary the account has never paid. If both go through the same flow, either your regular customer is stopped for a selfie, or OTP they did not need on a ₦500 top-up, or the ₦500,000 transfer gets the same light check as the top-up. 

The CBN’s March 2026 circular on instant payments points the same way. Its enhanced authentication requirements ask for stronger checks at specific moments, such as when a customer reactivates an online account or logs in from a new device. If you run a bank, another financial institution, or a payment service provider, the rules have applied since July 2026. The fintechs that handle this well add friction only where the risk is, and keep everything else fast.

This article shows you how to identify high-risk transactions and how to structure a risk-based approach that catches fraud without slowing down your legitimate customers.

What Makes a Transaction High-Risk

Size alone does not make a transaction high-risk. What counts is how far it moves from what is normal for that specific account. Four signals matter most, and your platform already holds the data for each one. They match the high-risk moments in Dojah's guide to account takeover fraud.

• An amount far above the account's normal pattern: A customer who usually sends ₦20,000 suddenly sends ₦400,000. A transfer several times larger than the account's norm is a signal, whatever the absolute amount. What matters is the gap from that account's baseline.
• A first-time beneficiary with an elevated amount: A customer who has only ever paid their landlord in small amounts and a few friends sends ₦3,000,000 to a number they have never paid before. This is a classic account takeover pattern. Neither signal proves anything alone, but together they justify a step-up.
• A device change just before a high-value action: A login from a new phone, followed within minutes by a transfer request, can mean someone else has taken over the account. A check at that point confirms the account holder is still in control before the money moves. The CBN circular treats this as a risk moment too, with enhanced authentication required on first login from a new device.
• A dormant account with sudden high-value activity: An account that has been silent for 90 days or more suddenly sends ₦2,500,000. The person acting may not be the original account holder.

Spotting the signal is one decision. Matching the right check to it is the other.

What Verification Each Risk Level Warrants

Not every high-risk signal needs the same response. One mild signal calls for a light check, and several strong signals call for a heavy one. Matching your response to the signal keeps legitimate customers moving and puts your scrutiny where it is needed.

1. One indicator → light check: A customer sends a slightly larger amount than usual and nothing else looks odd. Ask for a PIN re-entry or an OTP, which confirms they started the transfer without slowing them down. If there is any sign of a SIM change on the account, use the PIN, because an SMS OTP can be intercepted in a SIM swap.
2. Two or more indicators → biometric step-up: A customer logs in from a new phone and adds a first-time beneficiary in the same session. Ask for a liveness check or face match before the transfer goes through. Liveness shows a real person is present, and face match shows it is the right person. For your customer, it is a quick selfie. For a fraudster working the account remotely, it is a real barrier.
3. Strong combination → hold or liveness plus face match: A SIM swap, then a new device, then a high-value transfer to a first-time beneficiary. Either hold the transaction and notify the account holder through a verified channel, or require liveness plus face match before it clears. Some combinations are strong enough to pause the transaction until the account holder confirms through a channel the fraudster cannot reach. Dojah's account takeover guide suggests holding high-value transfers for 24 hours when several risk signals appear.

A tiered response is what makes step-up verification workable day to day, instead of a blanket layer of friction.

How to Structure a Risk-Based Verification Approach

Your risk model takes every signal you collect, from documents and biometrics to device data and transaction intent, and decides what the customer has to do next. The principle is simple: lower risk means lighter friction, and higher risk means more checks. Putting it into practice takes three parts, each feeding the next:

1. A risk signal layer that watches continuously: Your step-up checks can only fire at the right moments if something is watching for those moments. Monitor transaction patterns, device consistency, session anomalies and account inactivity to build the baseline that makes a deviation visible.

    Without it, you only learn a transaction was high-risk after it clears. The CBN circular makes this an expectation, with fraud monitoring that covers both inflows and outflows.

2. A decision engine that maps signals to responses: Write down which combinations of signals trigger which check. That is a product and compliance decision before it is a technical one. Your engine then turns the policy into rules: what triggers a liveness check, what triggers a hold, and what passes with no extra friction.
3. A verification response layer that is fast: A step-up that is slow, or fails on entry-level phones, leads to abandonment, not security. Your liveness and face match flow has to suit the devices and connectivity your customers actually have. A legitimate customer should barely notice it, and a fraudster cannot complete it.

The monitoring that makes the signal layer work, and the biometric checks that act on it, are where Dojah's products come in.

How Dojah Supports Risk-Based Verification on High-Risk Transactions

To put this approach into practice, you need three things: a monitoring layer that watches for signals, a decision that picks the response, and a verification layer that carries it out fast enough that your customers are not disrupted. Dojah covers all three.

• Risk signals and decisions via Profiled Risk: Profiled Risk builds a living risk profile for each customer from event data, behavioural patterns and the rules you set. It watches for location changes, device patterns, velocity abuse and behavioural drift, and its rules engine lets you set conditions without code. Automated actions can trigger extra checks, reviews or webhooks when a rule fires or a profile changes state.
• Liveness for moderate-risk moments via Liveness Check: Liveness Check confirms a real person is present at the point of a step-up, before a high-risk transaction goes through. It is built to authorise transactions and logins, using facial biometrics from a selfie or short video.
• Face match for higher-risk moments via Biometric Verification: Biometric Verification checks that the customer is live and that their face matches a valid ID. Dojah lists high-risk transactions among the things you can automate with it, so the check can run at the exact moment a risky transfer needs it. 

If you want to track high-risk transactions without creating unnecessary friction, Dojah gives you signal detection and step-up response on one platform. 

See how Dojah helps African fintechs verify high-risk transactions without adding friction to every user.

Frequently Asked Questions About Verifying High-Risk Transactions in Africa

1. What is a high-risk transaction in fintech?
A high-risk transaction is one that deviates from what is normal for that account. Common signals are an amount far above the usual pattern, a first-time beneficiary, a new device, and sudden activity on a dormant account.

2. What is step-up verification?
Step-up verification adds a stronger identity check only when the risk of a session or transaction goes up, instead of applying the same check to everyone. A low-risk action might need a PIN, while a high-risk one might need a liveness check and face match.

3. How can fintechs verify high-risk transactions without adding friction for every user?
Monitor signals continuously, define which combinations of signals trigger which response, and keep the check itself fast. Most transactions pass with no extra step, and only the risky ones meet a stronger check.

4. What does the CBN's March 2026 instant payment circular require?
The circular is addressed to banks, other financial institutions and payment service providers and took effect on 1 July 2026. It requires fraud monitoring across inflows and outflows, enhanced authentication for online account reactivation, and an opt-in and opt-out option for instant payments protected by multi-factor authentication.

5. What checks suit high-risk KYC in Nigeria?
It depends on the risk level. A PIN re-entry or OTP suits a single mild signal, liveness or face match suits several signals together, and a hold with confirmation through a verified channel suits the strongest combinations.