Fraud and AML in banking

Financial institutions are facing a flood of fraud, from push-payment scams to business email compromises to bad checks. Nonetheless, they’re often stymied in trying to work together to root out bad actors.

That was painfully clear to attendees listening to several panel discussions at the Nacha Smarter Faster Payments conference in April. The industry event attracted about 2,100 payments, bank and credit union professionals to New Orleans.

Push-payment schemes, also known as credit-push fraud, that move over Nacha’s ACH and other electronic payment rails have been particularly problematic. In these situations, consumers and companies are duped into sending payments to criminals under false pretenses, but because they do so voluntarily, it’s more difficult to combat. 

It’s become a pain point partly because the financial system revolves around monitoring for crooks sending payments, not those receiving them. Today, “mule” accounts belonging to unsuspecting holders are used by criminals to receive funds that are quickly drained.

Payments fraud in the U.S. is a multibillion-dollar problem, especially among elderly consumers, according to the Federal Trade Commission. Fraudsters tap social media and artificial intelligence to their advantage to prey on consumers and corporate clients alike, with schemes becoming increasingly sophisticated.

Tim Thorson, a senior vice president of payments risk at Regions Bank, lamented the problem during a Nacha panel discussion regarding that organization’s plan to implement new rules addressing fraud.

“Credit-push fraud can take a small business down, and I've seen it happen, and I know probably many people in here have, and that's an extremely antisocial thing to happen to a small business, because the country's built on small businesses,” Thorson said.

Perceived legal barriers

Part of the problem is that federal and state laws intended to protect customer confidentiality and thwart money laundering may be interpreted in ways that hamper communication between financial institutions. 

“I wish there was something that we could do amongst ourselves that would amount to something of a safe harbor, where we could talk to each other the way we used to before all the privacy laws came down 25 years ago,” Thorson said. “We're still paranoid about divulging the information on a mule (account), for instance, on somebody clearly taking money that didn't belong to them.”

Fraudsters aren’t protected by such laws, but it’s often difficult to determine quickly whether fraud between different institutions’ accounts is happening. That’s where more communication might help.

“One of the things that we identify as a potential roadblock to some potential sharing is just the sense that folks are not clear what they can share with law enforcement, and how really, they can work together to try and make a broader difference,” Scott Anchin, a vice president of operational risk and payments policy at the Independent Community Bankers of America, said during a separate panel discussion.

Anchin’s trade group created a task force with representatives from some 50 community banks nationwide to discuss fraud, he said during the panel focused on enabling institutions to work together. The cohort has also partnered with the nonprofit International Association of Financial Crimes Investigators to create a guide for bank members, he said.

Financial institutions’ ‘cultural’ problem

Even though banks share staff contact information through a Nacha registry designed to connect workers from different banks and credit unions, such registries aren’t always complete or up to date, often frustrating employees who try to use them. 

All too often, bank employees trying to reach industry peers may have access only to a customer service line that devolves into a series of dead ends. The situation may become more difficult when banks are intermediaries for unlisted fintechs.

Nacha panelists noted a “cultural” problem in the industry with banks and workers not interested in talking to peers, for whatever reason, including potentially competitive instincts. 

“Instead of putting your direct line (in the registry), you put the call-tree-hell (number) because you hope that nobody will sit through it, but that doesn't get us anywhere,” said William Mills, a vice president for deposit and ACH operations at Maplewood, Minnesota-based Premier Banks.

Mills, in a panel discussion, said he endured conversations with 18 bank representatives at a large financial institution over four hours to resolve one issue.

Conference attendees suggested larger institutions may be more guarded because they’re seeking to safeguard their proprietary data.

When asked about banks sharing information to combat fraud during a March interview, JPMorgan Chase’s payments technology head, Sri Shivananda, pointed to the government as the linchpin for information-sharing, via the Homeland Security Department’s Cybersecurity and Infrastructure Security Agency. 

As for JPMorgan’s role, he seemed to favor maintaining an edge on rivals. “We have a competitive advantage on the data that we see through the number of transactions that we support on the platform,” he said.

Missing government coordination

A major government public campaign to call attention to the rising fraud problem, or to address it, has been lacking, some panelists said. 

There is no federal government office coordinating a response to this multibillion-dollar crisis, said Paul Benda, an executive vice president of risk, fraud and cybersecurity policy for the American Bankers Association. The situation reflects a “complete and utter failure” of the national government to spearhead a nationwide solution, he said.

For its part, Nacha is implementing new rules to address the mushrooming payments fraud, asking financial institution members to submit plans for procedural changes. The rules aimed at changing financial institutions’ processes and policies are being phased in, with additional deadlines in 2026.

Many financial institutions aren’t ready to make the improvements, according to Dominic Plumeri, who audits banks on the ACH Network in his role as vice president of member services at nonprofit payments association Southern Financial Exchange.

Nacha is also seeking to spur more information-sharing among its members by adding a new online means of connecting with each other to report fraud and attempt to recover funds. 

In addition, some financial institutions are turning to outside software vendors to help develop technology to flag potential account problems, sometimes based on changes in payment behavior, like increases in volumes or values being received or sent by customers.

In the meantime, though, speakers at the conference said they fear losses are contributing to an expansion of organized crime rings, fueling the problem.

Karen Helmberger, director of fintech and payments at the industry fraud-fighting organization FS-ISAC, emphasized the personal and financial tolls the crimes take on people.

“We are losing generational wealth across the sector in this country and it’s going to these scam facilities wherever they may be,” Helmberger said. She urged attendees to focus not on the uncomfortable feelings they have about communicating, but rather on the “really bad things” that happen when they don’t.

Fraud losses reportedly topped $10 billion nationwide in 2023, according to Federal Trade Commission data – but that figure could be as much as $158 billion when adjusted for underreporting.

Underreporting is rampant due to shame, said several panelists at the virtual Fighting Payments Fraud in 2025 event in February.

“Oftentimes, it isn't just the money that's gone. [Fraud] takes an insane emotional toll on the consumer,” said Stephanie Tatar, founder of Tatar Law Firm.

Even after being financially “wiped out,” the emotional impact of fraud is the hardest part, according to AARP Fraud Watch Network Executive Director Kathy Stokes. That’s what she’s hearing from participants in her organization’s victim support group.

“Sometimes that's because they were involved in a fraud that made them believe that they were in a trusted relationship with somebody – whether it's a love relationship or a strong friendship that grows over weeks, months, sometimes even years,” she said. “The other piece of that is just not having the support. People being afraid to say anything to anyone because they're so embarrassed.”

Fraud is at a “crisis level” across the globe, Stokes said, “and I would submit that fraud is the No. 1 crime in this country.”

Authorized push-payment fraud, where a victim is tricked into sending money to a scammer’s fraudulent account under false pretenses is just one type of scam. According to ACI Worldwide, Americans will lose $3 billion to APP fraud annually by 2028.

It’s relatively easy to do, Stokes said, because scammers play to our fear response.

“If you can get your target into a heightened emotional state that allows the bypassing of logical thinking in our brains, it's sort of the fight-or-flight response. Our brains have been doing the same thing for 300,000 years, and a threat that your grandkid is in trouble or your account is being hacked is the equivalent of a saber-toothed tiger in our brains,” Stokes said.

She calls it the amygdala hijack.

Fraudsters may also have a victim’s highly personal information, like account information and Social Security numbers, and they share that with the victim – leading the victim to believe the person they’re talking to is a representative of their bank or payments platform, as they claim.

But much of that information is available for sale, warned Detective Matt Hogan of the Connecticut State Police.

Data breaches are largely to blame for the accessibility of sensitive information, Hogan warned.

“You also have stolen mail, which has been a consistent problem for the past three to five years, [and] social media mining … There's really a wide swath of opportunities for them to get data, and it's relatively cheap,” he said.

A person’s bank credentials are for sale on the dark web for $25, he said.

And it’s not fraudsters who are stealing victims’ money, Stokes said: It’s criminals.

“We tend not to look at fraud as a crime perpetrated by a criminal. We've got to really put this in the right frame so that we understand that the victim is not at fault,” Stokes said.

“Speaking my language,” Hogan echoed.

Carla Sanchez-Adams, a senior attorney for the National Consumer Law Center, said stricter rules of liability – for telecommunications companies that let scam calls or texts slip through, or for social media platforms like Meta, which allow for scam products to be sold on Facebook Marketplace – would put some of the onus for these crimes on the companies that help facilitate them.

“Part of the reason why [fraud is] successful is because of the lack of protections in some of these systems and the lack of incentives to make the systems more protective,” Sanchez-Adams said.

Although the Bank Secrecy Act requires banks to have strong customer due diligence, those perpetuating fraud do, in most cases, have bank accounts, she noted.

“Those financial institutions should be doing more to prevent those customers from receiving [money], to basically debank those customers that are committing fraud, and to ensure that they're not getting access to our financial system,” she said.

Tatar, who has represented victims of APP fraud, said banks can prevent victims’ emotional damage “if they just have the appropriate measures in place when a consumer disputes a transaction as unauthorized and have people that understand … the impact of such a scam.”

And while IDs, credit cards, phone numbers and IP addresses can be faked, consumer spending history can’t be — but that’s “oftentimes completely overlooked” in investigations, Tatar said.

Banks are spending billions on fraud detection and mitigation, and tracking down fraudsters can be difficult — but if lenders can do it, customer retention is their reward.

That’s one of the major takeaways from recent research co-authored by Vamsi Kanuri, marketing professor at the University of Notre Dame’s Mendoza College of Business.

Banks might think the outcome of a fraud investigation doesn’t matter if a customer’s funds have been returned. Yet, “whether that investigation results in finding the perpetrator or not actually does matter quite a bit in terms of customers continuing with banks,” Kanuri said in October.

Customers who experienced fraud that wasn’t resolved with an attribution of blame were about 41% more likely to leave the bank than customers who never experienced fraud, researchers found after reviewing data from a major U.S. bank covering 422,953 customers over five years. 

If customers who experienced fraud were told the bank had found the fraudster, however, those clients were far more likely to stay with the bank than customers who never dealt with fraud, according to the study, co-authored by Professors Sriram Somanchi of Notre Dome and Rahul Telang from Carnegie Mellon University.  

The study, published in the October issue of Production and Operations Management, demonstrates “the effectiveness of blame attribution on customer behaviors in a financial fraud context,” researchers wrote. 

“When firms are unable to hold an external entity accountable for customer-identified account-based fraudulent transactions, customers retaliate by severing their relationship with the firm, even when the firm credits the entire amount that the customers have lost due to fraud,” the study said.

The study findings embody the “service recovery paradox,” Kanuri said. That’s when customers who’ve experienced a problem that’s dealt with swiftly and sufficiently are more loyal and satisfied than customers who never encountered a problem.

“Our initial hypothesis was that these people should be mad, regardless, and we should see attrition, regardless of what the outcome is,” Kanuri said of customers who experienced fraud. “But it turns out, for these subset of customers, their trust is reinforced by the fact that if something were to happen to their money, the bank has the technological know-how to actually track the perpetrator, and that restores trust for customers, which eventually leads to these people staying longer than those customers that never experienced fraud.”

The findings underscore the importance of banks’ spending on fraud detection and mitigation, Kanuri said.

Kanuri recalled conversations study authors had with bank leaders, noting “one of the bank execs said, ‘We are spending all this money, what is the [return on investment]? When stakeholders and investors ask these questions, when board members ask these questions, we don’t have answers, but in our gut, we do know that it helps immensely with gaining back trust from the customers.’”

Because the bank that researchers worked with didn’t want to give current customer data due to the sensitive nature of information, the data Kanuri and his colleagues worked with was several years old, but “the context is still relevant,” Kanuri said. 

“This is a recurring problem,” he said. “It doesn't matter which year you look at; there's going to be problems.” 

About half of U.S. adults have had fraudulent charges made with their credit or debit card, Pew Research Center said in July. The FBI says more money is being lost to online scams and cybercriminals than ever, with a record $16.6 billion in losses reported to the agency in 2024. The Federal Trade Commission estimated 2024 fraud losses at $12.5 billion. 

As fraud and scams have become more pervasive, the issue has drawn increased attention and calls for collaborative action from lawmakers, financial services regulators and the industry. Banks intended to spend more on tech, with fraud mitigation being one of their top priorities in 2025, according to American Banker.  

Kanuri and his co-authors also discovered that customers who have more touchpoints with the bank and engage with it more frequently “tend to discount these one-off fraud cases, even when the bank is not able to identify the perpetrator” — which is notable given the low success rate associated with identifying fraudsters, he said. 

Educating customers on technological advances and what banks are doing to safeguard customer accounts seems to offer banks “a cushioning effect,” he said.  

Banks should also explore ways to soften the blow by testing different communication strategies with customers, Kanuri said. Rather than sugarcoat the information, lenders who’ve been unsuccessful in attributing fraud blame should put it plainly that they’ve not been able to find the perpetrator of the fraud. 

“It’s actually the beginning of the service recovery process, because once you do that, there’s going to be an after-effect of how customers perceive of your services,” he said. “So you should be following up with customers and doing everything possible to actually regain their trust.”

Companies battling payments fraud need better information- and data-sharing, enhanced consumer education and help from telecommunications and social media companies, according to September suggestions in response to a federal call for ideas to tackle the problem.

Banks, payments companies, and trade and consumer groups filed dozens of comments in response to a June request for information from the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. Those regulators requested input on ways to address payments fraud, with a particular focus on check fraud. The comment period, which closed Sept. 18, drew nearly 200 comments.

Trade group the Financial Technology Association called for a “coordinated national fraud strategy” that includes the formation of a federal and state task force and awareness campaigns.

Zelle operator Early Warning Services, in its comment letter, offered a five-point plan that underscored its view that fraud “is not the burden of financial institutions alone,” and necessitates a collaborative, comprehensive approach. 

The Scottsdale, Arizona-based company also suggested a task force be created that includes payments companies and banks, regulators, social media platforms and telecom companies to coordinate on fraud prevention.

EWS called for bolstering sector-wide engagement and best practices across the “scam lifecycle,” because social media and telecom firms “play critical roles” in enabling and disrupting scams, according to the letter. 

“The fight against payments fraud can't be won in silos,” Ben Chance, head of identity and payments risk at Early Warning, said in a news release.

Others, such as Nacha and the National Consumer Law Center, also emphasized the need to involve social media and telecom providers and the Federal Communications Commission in the conversation. 

Social media and telecom companies “must be asked to provide additional insights related to payments fraud and scams,” wrote Michael Herd, executive vice president of ACH Network administration at Nacha. “Both types of entity could be effective collaborators in detecting, preventing, and mitigating payments fraud and scams by identifying accounts involved in active fraud schemes, or in disseminating information that induces consumers to commit fraud or become unwitting accomplices in the illicit transfer of funds.”

A bipartisan group of senators proposed legislation in June that would create a task force to study payment scams and recommend ways for regulators and lawmakers to thwart them. 

EWS also suggested information sharing be standardized across stakeholders with speed in mind, and further called for enhanced law enforcement coordination; and investments to scale consumer education initiatives. 

Herd, of Nacha, suggested regulators consider rules requiring telecom providers, such as Verizon, AT&T and Comcast, to identify scams that use voice and text messages.

The FTA called on bank regulators to reform Bank Secrecy Act/anti-money laundering requirements, modernize customer identification program rules and update confidential supervisory information sharing rules. 

The fintech trade group also suggested regulatory guidance and support for the development and adoption of advanced fraud detection tools, including clarifying that many applications of artificial intelligence – especially in fraud and compliance contexts – are not high-risk.  

Further, the FTA urged regulators to expand fintechs’ access to core payment systems such as FedNow and modernize charter options, including supporting the development of optional federal payments charters, and promoting the move away from paper checks. 

Fintechs and payments firms are “well-positioned” to combat fraud threats, but “doing so effectively requires modern policy frameworks and approaches, clear regulatory expectations, enhanced data sharing, and public-private collaboration,” FTA CEO Penny Lee wrote in the Sept. 18 letter.

The U.S. Faster Payments Council labeled data standardization as a crucial area for reform. “The lack of universal definitions, reporting timelines, and coding systems for fraud has been a significant obstacle,” Reed Luhtanen, the group’s CEO and executive director, wrote in a Sept. 9 letter.

The NCLC, in its comment letter filed Sept. 15, urged regulators to strengthen laws that require banks and other companies to protect consumers from fraudulent charges, and improve enforcement of BSA/AML obligations as it relates to banks that receive fraudulent payments.

Regulators should employ “a holistic approach to the problems caused by fraud and scams instead of just relying on consumer education and information dissemination,” the NCLC said in its letter.

In its comment letter, dated Sept. 15, card network Visa sought to pitch its services and capabilities for use in the broader fight against fraud. 

Those include integrating the real‑time artificial intelligence risk‑scoring capabilities of Featurespace – the cybersecurity and analytics firm Visa bought in 2024 – into Treasury Department and Federal Reserve payments to prevent potential fraud, and partnering with government agencies to expand fraud‑prevention education. 

EWS has also pitched Zelle as a tool the Treasury Department can use as the federal government eliminates paper checks. 

House Financial Services Committee Chair French Hill, R-AR, and two other lawmakers told Fed Chair Jerome Powell in a Sept. 17 letter that “[a]gency action to safeguard consumers from payments fraud is well overdue,” and the issue will “require increased cross-agency collaboration.”

In the face of increasing generative AI-based deepfake attacks, banks must fight fire with fire and invest more in artificial intelligence themselves, Federal Reserve Gov. Michael Barr said in April.

Banks must evolve their AI efforts to thwart deepfake attacks with the use of facial recognition, voice analysis and behavioral biometrics, he said during a New York Fed event, and technical solutions can be used to detect subtle inconsistencies that point to the use of AI in audio or video that human observers may miss.

With deepfakes, cybercriminals use generative AI to copy a person’s voice or image and then use that voice or image to commit fraud. One in 10 companies have experienced a deepfake attack, a 2024 business.com survey found.

“In the past, a skilled forger could pass a bad check by replicating a person's signature. Now, advances in AI can do much more damage by replicating a person's entire identity,” Barr said of deepfakes, which have the “potential to supercharge identity fraud.”

While banks often use voice detection as a tool of identity verification, that technology could become vulnerable to generative AI tools, Barr said.

“If this technology becomes cheaper and more broadly available to criminals — and fraud detection technology does not keep pace — we are all vulnerable to a deepfake attack,” he said.

Cybercrime is an “asymmetrical” game, Barr said, in which fraudsters can cast a wide net and find success in ensnaring only a small number of victims without too much cost.

Banks, on the other hand, must “undergo a rigorous review and testing process to mount effective cyber defenses and will thus be slower in developing their defenses.” Even when they prevent many attacks, a single failure can still cost them, he said.

“As we consider this issue from a policy perspective, we need to take steps to make attacks less likely by raising the cost of the attack to the cybercriminals and lowering the costs of defense to financial institutions and law enforcement,” he said.

Banks, Barr said, can employ advanced analytics to identify potentially suspicious activity, and further review activity that raises red flags. And they can invest in human controls by keeping staff trained on emerging risks.

The onus is not just on banks: Customers and regulators also have to do their part in preventing such schemes from taking hold, Barr said.

Customers must educate themselves on prevalent schemes to make themselves less likely victims, and they should value strong security practices at their banks and financial institutions, including those that add friction to their experience, he said.

Regulators, for their part, can reinforce the importance of cybersecurity through “appropriate updates to guidance and regulation,” he said. Regulators should also consider how AI can be leveraged on their end to enhance the ability to monitor and detect fraud in real time.

“This could help provide early warnings to affected institutions and broader industry participants, as well as to protect our own systems,” Barr said.

Barr has previously expressed high hopes for the possibilities generative AI will lend banking in the future.

While such tools can help prevent attacks, Barr suggested that regulators should work with domestic and global law enforcement to make cybercrimes like deepfake attacks more costly for the perpetrators.

“The official sector and banks should continue efforts to improve fraud data sharing within the financial sector and help institutions respond more quickly to emerging Gen AI-driven threats. This will make it far harder for fraudsters to operate undetected, increasing the complexity and cost of their activities,” he said.

When U.S. agencies in October 2024 laid out TD’s anti-money laundering failures and announced a $3.09 billion settlement with the bank, it marked the “darkest day” for the Canadian lender, TD board Chair Alan MacGibbon said.

“The settlements were extraordinarily painful,” MacGibbon said, according to The Globe and Mail. “The Oct. 10 public consent agreements was the darkest day that we could have imagined it to be, and I apologize to all investors for how difficult this was and the consequences of the actions.”

MacGibbon’s comments came in response to a shareholder’s question at TD’s annual general meeting in April – the first opportunity for investors, on a grand scale, to talk to the bank’s brass since the settlement, which included a $434 billion cap on the lender’s U.S. retail assets.

Ray Chun, in his first annual general meeting as TD’s CEO, said the bank is redesigning its training programs at all levels, including for front-line employees who interact directly with customers.

Senior leaders are learning more about encouraging accountability and effectively flagging issues to senior staff, MacGibbon said.

“It is about changing our culture,” Chun said. “A culture of accountability and a culture of curiosity within our front lines and our second lines to ask why and be more curious to all these issues.”

The meeting heralded several changes to the board, too. Five directors – Amy Brinkley, Colleen Goggins, Karen Maidment, Claude Mongeau and Brian Ferguson – chose not to stand for reelection. Three of them – Brinkley, Maidment and Goggins – sat on the bank’s risk committee. Ferguson sat on TD’s audit board.

Meanwhile, shareholders voted four new directors in, including two with banking experience. Paul Wirth, who served as Morgan Stanley’s deputy CFO for 10 years, is joining. So is Ana Arsov, a longtime Moody’s executive who earlier worked at UBS, Morgan Stanley and Lehman Brothers. 

A third former banker – Frank Pearn, who once served as JPMorgan Chase’s chief compliance officer – is set to join in August.

Elio Luongo, the former CEO of KPMG Canada, and Nathalie Palladitcheff, former CEO of the investment group Ivanhoé Cambridge, also joined.

Of TD’s remaining board members, MacGibbon received the narrowest reelection, as 57.7% of shareholders voted in his favor. MacGibbon announced in January 2025 he would step down by the end of the year.

Investors voted against every shareholder proposal raised at the annual meeting, such as those urging the bank to adopt an artificial-intelligence code of conduct and disclose its energy supply ratio.

An individual shareholder submitted proposals calling on TD to dismiss former CEO Bharat Masrani as a special adviser. Masrani’s term was set to end July 31, anyway.

Masrani’s successor, Chun, said TD is conducting a strategic review to identify new opportunities to expand its business. With limits placed on U.S. growth, the bank is expected to turn to its home country. A plan focusing on the Canadian unit, from which TD derives more than 75% of its profit, is set to be unveiled by the end of 2025.

Additionally, TD has launched an online service to ease the mortgage application process and has hired specialists to help customers with home buying and retirement investments.

“Those businesses have tremendous momentum,” Chun said. “The entire strategic review − a large portion of that is what we’re going to do to accelerate that momentum.”

As for the bank’s anti-money laundering failures, Chun deemed them “unacceptable.”

“We are making consistent progress every day, with more work ahead,” the CEO said, according to Bloomberg.

JPMorgan Chase recorded a $170 million charge-off in the third quarter connected to bankrupt subprime auto lender Tricolor, executives said in October.

“It is not our finest moment,” CEO Jamie Dimon said during a media call. 

Dallas-based Tricolor, which also sold used cars, filed to liquidate in bankruptcy court Sept. 10. Federal prosecutors are investigating the company over allegations of fraud, Bloomberg reported. 

“When something like that happens, you could assume that we scour every issue, every universe, everything about how it could be taking place,” to make sure it doesn’t happen again, Dimon said during the media call. “You can never completely avoid these things, but discipline is to look at it in cold light, and go through every single little thing, which you can imagine we’ve already done.”

The $4 trillion-asset bank’s net charge-offs in the quarter totaled $2.6 billion, up $506 million. Charge-offs in the lender’s wholesale unit “were slightly elevated as a result of a couple of instances of apparent fraud in certain secure lending facilities,” CFO Jeremy Barnum said during the New York City-based bank’s quarterly earnings call. 

Dimon also underscored the company’s efforts to review its processes, procedures and underwriting approach, in the wake of such situations. “My antenna goes up, when things like that happen,” he said during the call with analysts. 

“Everyone should be forewarned on this one,” Dimon said. “When you see one cockroach, there are probably more,” Dimon said.

Investment bank Jefferies, days earlier, clarified its exposure to another bankrupt auto firm, First Brands.

Jefferies CEO Rich Handler and President Brian Friedman, in a letter, estimated their bank’s exposure to First Brands at about $45 million – a far smaller figure than the $715 million mentioned in an initial disclosure. 

The executives also said “nobody” at Jefferies was aware of fraudulent activity at First Brands.

“We learned of the fraud allegations when the rest of the public learned,” Handler and Friedman said. “The issues surrounding First Brands are the result of decisions and actions at First Brands.”

JPMorgan executives, meanwhile, said their bank has no exposure to First Brands.

When Dimon and Barnum were asked how they’re thinking about the Tricolor and First Brands failures as part of the broader landscape, Dimon noted the length of the current credit bull market and high asset prices. 

“These are early signs there might be some excess out there,” Dimon said.

Cincinnati-based Fifth Third is another large lender affected by Tricolor’s collapse. Fifth Third said in September it had recently discovered “alleged external fraudulent activity at a commercial borrower” of the bank that could result in an impairment charge of up to $200 million.

Referring to scenarios involving apparent fraud, “at some level, a motivated party is going to find a way to do that, almost no matter what controls you put in place,” Barnum said during the media call. “But it's not like we don't have controls. We have a lot of controls. We try to minimize the risk of that type of thing.”

“Whenever something like that happens, we have to evaluate whether those controls are as effective as we want them to be,” he said. “Certainly, you would be correct in assuming that those reviews are taking place, and I'm sure that some adjustments will be made.” 

For the megabank, the Tricolor exposure is small, Truist Securities analyst John McDonald noted. But “the bank remains diligent on managing credit exposures and is constantly improving its procedures,” he wrote. 

The vast majority of JPMorgan’s lending to nonbank financial institutions is highly secured and not extremely risky, Barnum said during the conference call. 

“Everything you do is, in one way or another, risky, but I'm not sure that our lending to the NBFI community is an area of risk that we see as more elevated than other areas of risk,” he told analysts. 

Dimon said he believes “there will be additional risk in that category, that we will see when we have a downturn.” He said he expects it to be worse than others might predict, because the underwriting standards of other entities may be unknown.

New York Attorney General Letitia James sued Early Warning Services in August, alleging the bank-owned payments company allowed fraud on its Zelle network for several years, costing consumers more than $1 billion in losses.

The complaint, in New York state court, said Zelle “has been teeming with fraudsters who have stolen staggering sums from consumers” since the banks began offering the Zelle payments system in 2017.

“This is nothing more than a copycat of the Consumer Financial Protection Bureau lawsuit that was dismissed in March,” a spokesperson for Early Warning Services said in an email. “Despite the Attorney General’s assertions, they did not conduct an investigation of Zelle.” 

The spokesperson also reiterated that 99.95% of transactions on Zelle occur without any fraud or scam reports.

The New York lawsuit revives litigation over an issue – fraud on Zelle and what Early Warning Services has done to address it – that the CFPB abandoned at the federal level in March.

In the complaint, James’ office offers a litany of consumer complaints over fraudulent activity they faced on Zelle, with redactions throughout the lawsuit as the AG spelled out how EWS and banks handled fraud. Her office alleges the company had plans to implement safeguards, but then waited years to do so.

“EWS knew from the beginning that key features of the Zelle network made it uniquely susceptible to fraud, and yet it failed to adopt basic safeguards to address these glaring flaws or enforce any meaningful anti-fraud rules on its partner banks,” the attorney general’s office said in a press release accompanying the lawsuit.

The agency withdrew the December 2024 lawsuit against Early Warning Services, based in Scottsdale, Arizona, and its three largest bank owners as the Trump administration began massively shrinking the CFPB’s mission and staffing. The federal agency had alleged in the lawsuit that EWS and the three banks failed to protect users from fraud and scams and didn’t do enough to help victims recover their money.

Zelle customers at the three largest bank owners, JPMorgan Chase, Bank of America and Wells Fargo, lost a total of $870 million to fraud on the peer-to-peer network over seven years, the CFPB said in its lawsuit.

Democratic lawmakers led by Sen. Elizabeth Warren, D-MA, wrote to EWS’ owner banks in July, seeking information about how Zelle monitors and addresses fraud on the platform.

The New York AG aims to force EWS to “maintain the basic network safeguards and any other antifraud measures that are necessary to protect consumers and limit consumer harm from fraudulent activity.” 

The lawsuit also seeks restitution for defrauded New York consumers who reported losses to EWS or its participating banks, and the disgorgement of profits gained from any fraudulent practices.

Frank co-founder Charlie Javice called JPMorgan Chase’s $200 million loss at her hands “not consequential” in a September court filing arguing for a light sentence for her fraud conviction.

The $200 million loss JPMorgan incurred in its purchase of Frank – done under the impression of incorrect information about the fintech’s user base – was pennies on the dollar compared to its $4 trillion in assets and annual revenues exceeding $169 billion, Javice lawyer Sara Clark, a partner at Quinn Emanuel Urquhart & Sullivan in Washington, D.C., argued.

“This case lacks the devastating human impact that typically justifies lengthy fraud sentences, and the Court should impose a penalty proportionate to the offense’s actual harm,” Clark wrote. “Evidence introduced at trial further underscores the limited practical impact of the alleged loss.”

Judge Alvin Hellerstein should “consider the unique nature of the victim” at Javice’s sentencing, the defendant’s lawyer argued. Comparing the bank’s annual revenue against the median U.S. household income of $80,610, the Frank co-founder’s lawyer said the bank’s alleged $200 million loss equates proportionately to $58.

“This comparison provides a more realistic picture of the relative scale of the alleged loss when measured against the resources of the institution involved,” Clark wrote.

Javice and Frank co-founder Olivier Amar were convicted on one count each of securities fraud, wire fraud, bank fraud and conspiracy in March, roughly two years after they were charged with those counts for allegedly grossly misleading JPMorgan on their user count. Both face years in prison.

Prosecutors recommended a 12-year sentence for Javice, according to Business Insider.

But Javice’s attorney argued the “absence of tangible or lasting harm to an individual victim or vulnerable community weighs strongly in favor of a below-Guidelines sentence” – and posited that unlike other companies involved in fraud, Javice’s fintech “delivered genuine social good” by helping students navigate the “often prohibitive” financial aid process.

Clark also compelled Hellerstein to consider Javice’s fertility concerns. Javice has undergone fertility treatments, and according to Clark, several of her friends and family have written the court for leniency “so she may have that chance” to be a mother.

Additionally, Clark wrote that a custodial sentence isn’t necessary to deter future conduct for Javice, whose effective banning from financial services and entrepreneurship, international shame in the media and financial ruin add up to “collateral consequences,” she wrote.

“A period of incarceration is not necessary ‘to protect the public from further crimes of the defendant,’” Clark wrote.

A JPMorgan spokesperson did not immediately respond to a request for comment.

Former Flagstar CEO Alessandro DiNello is accused of allegedly being aware of a client’s money laundering activities and discussing sensitive company transactions over a virtual conference while a “junior employee sat on his lap.”

The complaint was filed in July by Ross Marrazzo, the onetime enterprise chief compliance officer at the bank who was terminated before he could conclude an investigation related to money laundering and insider trading allegations and report the findings to the appropriate government entities, according to the lawsuit.

“While Marrazzo investigated and raised many clear ethics complaints as part of his role, his termination was a brazen attempt to block an investigation into DiNello,” Marrazzo’s lawyers wrote in the lawsuit filed in the U.S. District Court of Eastern District of New York.

Marrazzo, a 40-year veteran in the regulatory compliance field, worked at New York Community Bank, which merged with Flagstar in 2022 and adopted the Flagstar name.

At NYCB, he monitored the lender’s ethics program and was involved in reviewing ethical violations and breaches related to federal laws and regulations.

In March 2023, NYCB bought a large segment of the failed Signature Bank for nearly $2.7 billion. In March 2024, as NYCB faced financial problems, the bank’s CEO resigned and the board installed DiNello as chief executive.

DiNello’s tenure as NYCB’s CEO was short-lived. He stepped down in April 2024, when Joseph Otting took the helm. (Since the NYCB/Flagstar merger, DiNello had been serving in a non-executive capacity.) 

Following the leadership changes, Marrazzo – who had previously led remediation efforts for Signature Bank's regulatory issues – headed multiple investigations involving DiNello, the lawsuit noted.

In February 2024, the bank's anti-money laundering system flagged a client for illegal “structuring” of deposits. After Marrazzo's investigation confirmed at least three instances of the activity, he informed DiNello that the account needed to be closed. DiNello urged Marrazzo to keep the account open and suggested informing the client about the investigation – a violation of federal regulations, the complaint noted.

Marrazzo closed the account, but later discovered DiNello had personally contacted the client about their “gambling problem,” according to the lawsuit. This communication may have constituted illegal “tipping,” according to the suit, and violated the Bank Secrecy Act.

When Marrazzo defended his actions, DiNello explicitly threatened, “I would fire you if you did [it again],” according to the complaint. Following this incident, Marrazzo was excluded from executive meetings, the complaint indicated.

In early 2024, during a video meeting with law firm Skadden, Arps, Slate, Meagher & Flom, where material nonpublic information was discussed, DiNello had “a clearly-visible junior NYCB employee sitting on his lap and rubbing his head.”

Another executive who witnessed it, reported the incident to Marrazzo as a whistleblower complaint, providing screenshots as evidence, raising two concerns: a human resources issue related to a potentially inappropriate workplace relationship; and a regulatory one about discussing sensitive, nonpublic information in the presence of a junior staff.

Marrazzo reported the incident to the chair of the audit committee, and outside counsel from the law firm Cravath, Swaine & Moore investigated the matter. Despite the investigation, DiNello faced no disciplinary action, as board members reportedly dismissed the incident as a “misdemeanor,” according to the suit.

When probed further, the board said there was no specific company policy prohibiting such behavior and that the outside counsel advised management that DiNello “would have sued” the bank if terminated and that it would be a “mess” if he was fired, according to the suit.

The lawsuit claims DiNello’s termination is a direct follow-up of an investigation into the suspicious financial transactions.

DiNello maintained a substantial multimillion-dollar account with NYCB. Around the time Liberty Capital acquired controlling interest in NYCB, management was offered reduced-price stock, though that offer was later rescinded, according to the suit. During this period, DiNello made a $5 million transfer to a millionaire and received $1.7 million back, according to the complaint.

These transfers triggered the bank's AML monitoring system. Marrazzo, along with the financial crimes compliance officer, interviewed DiNello in June last year. DiNello claimed he simply “lent” money to an “old friend” without documentation, according to the suit.

The money was sent to an LLC's bank account, not an individual, but the $1.7 million return came from the friend's personal account, not the LLC.

Marrazzo and his team raised a request with other banks to obtain more information on the bank transaction and was “abruptly” terminated, effective in September 2024, while he was awaiting crucial information from another bank.

Marrazzo had entered an agreement with the company in June 2022 for 36 months, which stipulated that Marrazzo was entitled to a severance package if terminated by the bank. When he was terminated, he was neither offered nor paid the severance amount he was entitled to under the agreement and his termination was classified as “without cause,” he said in the suit.

Marrazzo is seeking employment restoration along with financial compensation, including back pay with all bonuses, compensation for all monetary and economic damages and those arising from physical and emotional distress.

Marrazzo is also requesting an order to stop the defendants from violating whistleblower provisions and to prevent the defendants from sharing disparaging information about Marrazzo to potential employers and protection from interference with his future employment applications.