I really doubt this is the problem, many banks offer open APIs and still handle fraud successfully. You can always rate limit the number of transactions and not allow the same user to log in/send APIs from two different locations too fast.