Cybersecurity for Card-to-Card Transfers: Sber Deploys AI-Powered Protection for Mir Transactions
Sber has deployed AI algorithms to protect card-to-card transfers made through the Mir payment system. Transactions are analyzed in real time and compared against each customer's typical behavior, taking into account factors such as transaction amount, time, location and payment frequency.
If a transfer deviates significantly from a customer's usual patterns, it may be temporarily suspended. The system also considers indirect indicators of social engineering, such as a series of incoming phone calls immediately before an unusual transaction. This is particularly important in situations where customers authorize a transfer under psychological pressure and conventional authentication methods, such as login and password verification, are no longer sufficient.
Behavioral Analytics at Scale
Sber serves one of the world's largest retail banking customer bases, meaning the new anti-fraud mechanisms affect a substantial share of cashless transactions. For the banking industry, this signals a shift from verifying isolated formal parameters to comprehensive behavioral analysis. That trend is driving the development of Russian technologies in machine learning, big data, real-time transaction processing and anti-fraud analytics.
The practical effect should be a lower risk of customers transferring money to fraudsters during fraudulent phone scams. At the same time, the ability to stop unusual transactions in time and provide more personalized protection should improve. However, the number of temporary holds on legitimate payments may also increase, with much depending on model accuracy and the convenience of transaction verification.
Projects of this kind strengthen the technological foundation of banking cybersecurity, help reduce fraud-related losses and increase trust in digital payments. While the concept of behavioral anti-fraud is not new, Russia's experience may prove valuable for countries facing high levels of remote financial fraud.
Aligned With the Central Bank's Strategy
Future development is expected to focus on combining multiple data sources, including customer transaction history, device characteristics, recipient information, call activity and other contextual signals. That will allow the system to evaluate not only the transaction itself but also the circumstances surrounding it. This approach aligns with the direction set by the Bank of Russia, which has already expanded its list of indicators for suspicious transactions to include atypical payment amounts and unusual transaction timing.
The technology is expected to evolve toward more accurate detection of payments made under psychological pressure, stronger protection for vulnerable customers, closer integration between banks and telecom operators, and broader deployment of similar systems across other banks and fintech providers. Hundreds of millions of prevented fraud attempts and tens of billions of rubles in avoided losses demonstrate that anti-fraud technologies require continued advancement.
Export prospects remain limited by data localization requirements, regulatory frameworks and the specific characteristics of national payment systems. Realistically, only individual components – such as behavioral analysis models, transaction-processing platforms, and anti-fraud solutions for banks and telecom operators – are likely to be exported. Potential markets include CIS countries and nations already using Russian IT solutions or cooperating with Russia's financial sector. However, these models will need to be adapted to local languages, fraud schemes, legal requirements and payment infrastructures.
The Evolution of Protection Mechanisms
Sber and major telecom operators have been developing joint solutions against phone fraud since 2021. Their systems correlate data on suspicious calls with customers' banking transactions. The latest upgrade extends that approach through broader use of AI and behavioral analytics. In 2024, the Bank of Russia expanded its criteria for suspicious transfers by approving six indicators of fraudulent transactions. Banks were then required to suspend such transactions, which, against the backdrop of rapidly growing attack volumes, helped prevent tens of millions of theft attempts, saving trillions of rubles.
Additional protection mechanisms evolved in parallel, including self-imposed loan restrictions, cooling-off periods and the "Second Hand" option. These measures complemented automated anti-fraud systems with user-controlled and organizational safeguards. Then, in January 2026, the regulator doubled the number of suspicious transaction indicators from six to 12, creating a stronger foundation for deeper contextual analysis and more sophisticated algorithmic models in banking security systems.
Conclusions
Sber's adoption of AI in its anti-fraud systems points to the financial sector's transition toward context-aware protection. The challenge is no longer limited to confirming the identity of the account holder. It is equally important to determine whether that person is acting independently or under pressure from fraudsters.
Over the coming years, such solutions are expected to rely on the integration of banking, telecommunications and behavioral data. That will make it possible to identify common social engineering scenarios more accurately, from suspicious phone calls and changes in device settings to loan applications and large cash withdrawals.
The principal technological challenge will be reducing the number of false transaction blocks. The more parameters a system analyzes and the more sophisticated its models become, the greater its potential effectiveness. At the same time, providing customers with a clear and rapid process for confirming legitimate transactions will become increasingly important.
