Fraud prevention is a legitimate interest and does not need a consent request.
I’m pretty sure that is specifically called out in GDPR. Certainly ICO (UK) has loads of articles on it.

However legitimate interests are often difficult to demonstrate compliance, so it can be easier to rely on consent.