An online payments business wants to reduce fraud losses, but it will not accept any control that blocks or delays legitimate customer transactions. Which type of control is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation
When you can't put a gate across the road without causing a traffic jam, you put up cameras instead. Detective monitoring lets the business keep moving while you catch the fraud. The trap is reaching for prevention when the business has told you that friction's off the table.
Full Explanation
Control selection must fit business constraints as well as risk. When the business will not tolerate controls that block or delay legitimate transactions, a detective control that monitors transaction patterns and flags anomalies for investigation reduces fraud losses without adding friction to every customer interaction. Combined with rapid response processes, it limits impact by catching fraud early and supports later tuning toward more targeted measures. Holding every transaction for a second approval is a preventive control that delays all customers, directly violating the stated constraint, and it would not scale. Requiring step-up authentication for every transaction also adds friction to legitimate customers on each payment, which the business has ruled out. Reversing all transactions from new customers each day is a corrective control that harms legitimate customers and revenue, causing far more disruption than the fraud it addresses. Exam caveat: risk-based prevention, applied only to transactions that monitoring identifies as high risk, can be introduced later if the business agrees to limited friction. Operational check: confirm the monitoring rules have defined alert thresholds, that alerts are investigated within an agreed time, and that fraud losses are tracked against target to show effectiveness.