Fraud and AML in banking

Banks and credit unions are bolstering their scam defenses through hiring and new services and tools, as they grapple with an increase in scams targeting older customers. 

Fifth Third has expanded its scam investigations team, due to the increased volume of reported scams and the time involved in addressing them, said Kris Edwards, the bank’s head of fraud prevention. The bank declined to detail the number of recent hires, but Edwards said Fifth Third has established a dedicated scams program team and continues to hire. 

The Cincinnati-based regional is also increasing its detection strategies to better spot signals and identify scams as they’re happening, Edwards said in a recent interview. 

The bank’s goal is to intervene during a scam attempt, rather than relying on a post-scam investigation, he said.

“I'd rather spend the time calling out, ‘Hey, we're seeing some signals that you may be participating in a scam,’” where, historically, a lot of the bank’s efforts have been focused on outreach afterward, Edwards said. “I'd rather get out in front of that and place our resources there.”

Edwards told Banking Dive earlier this year that Fifth Third has seen a “dramatic rise” in bank impersonation scams, where a fraudster impersonates the lender to trick a customer into parting with their money. Scams impersonating a government entity or tech support are also common.

Last year, adults age 60 and older reported losses of about $7.7 billion, up about 59% from 2024, according to FBI data. And the number of complaints rose 37%, to 201,266 in 2025.   

Among other recent efforts to combat scam activity, $297 billion-asset Fifth Third has rolled out AARP’s BankSafe training for front-line staff and fraud teams, to educate them on signs of financial exploitation of older adults. And Fifth Third recently added a report phishing capability within SmartShield, its in-app security tool, which allows customers to upload a suspicious text, email or phone call so the bank’s fraud team can analyze its details.

About 25% of the submissions have been deemed fraudulent. The “good news is that 75% are legitimate, and customers are reporting just to get confirmation instead of guessing,” Edwards said. “For that other 25%, we're able to get them on the phone and help them to work through next steps and different pieces of education and prevention.”

Edwards said he didn’t expect so many of the bank’s legitimate fraud alerts to be submitted for scrutiny. 

While it’s positive that customers are on alert, Edwards said he is concerned that the bank’s real fraud alerts aren’t reaching customers, if they struggle to decipher between scam and authentic messages.

That has Fifth Third evaluating the language and phrasing used in its alerts, to make it abundantly clear messages are actually from the bank. The bank recently updated its one-time password protocol language, although Edwards noted it’s an ongoing battle.

Scammers “know exactly what our language looks like, and so it's very easy for them to replicate,” he said.

Star One

Since seeing a rise in scams targeting older members, Sunnyvale, California-based Star One Credit Union in January introduced a new opt-in service that allows members to add a trusted contact, said Vanessa Brosas, vice president of deposit services at the credit union.

That might be a family member or friend the bank can reach out to if a member can’t be reached or is exhibiting signs they might be a scam target, she said. Star One doesn’t share detailed information with the contact, but suggests they reach out to check on the member, she said.

“Sometimes it’s just a matter of talking to people,” Brosas said in a recent interview.

In other cases, the $9.3 billion-asset credit union leans on law enforcement to convince a member they’re being victimized, as it did with a recent situation where a member almost sent a wire transfer for a couple hundred thousand dollars, Brosas said.

Because bad actors try to get people to act quickly, the credit union emphasizes members should “stop, hang up and call Star One,” she said.

To help staff identify scam-related behavior, the credit union is also implementing a new fraud management system later this year that employs AI and features a consortium of thousands of financial institutions, Brosas said.

Star One also hosts webinars and visits senior centers to educate members on scams, as part of its multipronged effort. Charlotte, North Carolina-based Bank of America in June said it’s hosting 1,000 in-person scam and fraud prevention seminars through the rest of the year, as part of its efforts to educate consumers on the topic. 

As scammers alter their tactics, “you can’t just have a one-option solution when it comes to fraud mitigation,” Brosas said. “You really need to layer things on.”

To that end, Brosas welcomes the Financial Crimes Enforcement Network’s updated guidance, issued June 12, which clarifies that financial institutions can share information in real time to respond quickly to emerging threats. Inhibited information sharing among banks and credit unions has prevented the industry from addressing the fraud and scams issue in a more robust way, lawmakers have said.

“We were all celebrating,” Brosas said of the FinCEN update. 

Edwards, too, said it’s a positive step and eliminates most uncertainty and legal risk tied to information sharing between banks. 

But more needs to be done, Brosas contended, from holding telecommunication companies accountable to broader education and awareness campaigns for consumers. 

“With the use of AI, if we don’t do something differently, the bad actors are going to far surpass our capabilities,” Brosas said.

When a trained employee intervenes in a fraudulent bank transaction, they can stop a scam “before a single dollar leaves the account,” said Jilenne Gunther, national director of an AARP program focused on protecting seniors from fraud.

Bank employees that place a hold on a suspicious transaction or delay the transaction to ask questions stop the scams about half the time, Gunther said, citing research from AARP’s BankSafe Initiative.

Gunther spoke alongside Kris Edwards, Fifth Third’s head of fraud prevention, and Avy Mallik, a partner at Morrison Foerster and former general counsel at the California Department of Financial Protection and Innovation, at a panel hosted by Banking Dive and Payments Dive in March.

Training on warning signs is ongoing for Fifth Third staff, Edwards said, and the bank maintains mechanisms for its retail staff to share information on fraud and threats up the chain.

While large institutions like Fifth Third often have dedicated fraud intelligence teams, smaller banks and fintechs may not.

But size, Mallik said, is not an excuse when things go wrong – and institutions, no matter the size, need to have a handle on it.

“Speaking as a former regulator, the regulator will expect you to have the right systems in place to find these red flags and to have the right amount of methodology to understand the typology of fraud and assess what the best course of action is,” he said.

To avoid becoming the weakest link, Mallik said, small banks and fintechs with limited resources should work with well-reputed vendors “that do the work for them, while also making sure that the licensee has the right amount of oversight over the vendor.”

“It’s not an easy task,” he said, but engaging the right partners “can help catch [and] solve problems before they become much larger storms.”

But the legislative onus on scam prevention should not focus solely on banks, Gunther said. “We need to start looking upstream.”

With an average loss of $17,000 per case, she said, citing suspicious activity reports, “we need to bring in these social media companies at the point where [scammers are] first contacting consumers, to look at shared liability.”

Edwards echoed Gunther, adding that’s a focal point of his when discussing the issue with regulators.

“[A] scam does not start with the bank,” he said. “That's the last piece where money moves.”

Sponsored content

By Adyen

Across digital platforms, fraud is no longer just isolated incidents. It operates as repeatable, automated playbooks. That shift is changing where fraud risk sits, how it needs to be managed, and what it costs when it isn't. 

5 trends defining fraud in 2026

1. Fraud has become systematic

Automation has turned fraud into a continuous test-and-learn cycle.

2. Even good customers can game the system

First-party fraud and policy abuse are growing concerns.

3. Precision drives growth

The cost of stopping fraud is increasingly measured in lost lifetime value.

4. Identity isn’t static

Point-in-time checks are no longer sufficient. Trust is built over time through behavior, history, and recognition.

5. Trust must begin earlier

As AI agents begin to act on behalf of customers, fraud prevention must start earlier.

When policy tightens without precision, customers pay the price

In the dating platform sector, a 38% reduction in refund rates led to a 66% increase in chargeback volume. Without a resolution path, customers default to disputes.

So while tightening policies can reduce abuse without clear alternatives, it can also erode trust with legitimate customers, leaving chargebacks as their only option.

Filtering out trial abuse to secure recurring revenue

In early 2025, a global software leader saw a rise in trial abuse. Users were signing up for free trials with no intent to convert, often using invalid or low-quality payment credentials. The issue only became visible later when the first billing cycle failed.

The problem wasn’t at renewal. It started at sign-up.

To address this, the business worked with Adyen to shift validation earlier in the lifecycle. Rather than relying on basic checks that simply confirm a card number exists, they introduced upfront validation of payment methods during trial registration.

This approach allowed them to assess whether the provided payment method could support the subscription amount once billing began — without charging the customer during the trial period. As a result, invalid cards, insufficient funds, and higher-risk payment instruments were filtered out before access was granted, while legitimate users continued to enjoy a seamless sign-up experience.

This shift improved control without adding unnecessary friction. Early-stage sign-ups became more qualified, improving the overall quality of the subscriber base. With a higher-quality subscriber base, downstream conversion and retention improved, making revenue more predictable.

Establishing trust at scale

There’s an 84% chance that an identity has already appeared across transactions, businesses, payouts, or card issuing on our global platform. Download the full report here.

As fraud and scams proliferate, a New Hampshire credit union has benefited from circulating a checklist designed to alert customers and employees of signs of possible scams. 

Service Credit Union, a $6 billion-asset credit union based in Portsmouth, New Hampshire, aims to bolster awareness of suspicious activity targeting members, said Stephanie McNamara, an assistant vice president and loss mitigation operations lead at the credit union. 

Posted in branch locations and given to employees, the alert lists red flags, such as a customer being told they’ve won a prize or must pay a fee, or to keep a transaction secret and refrain from telling a financial institution about it, McNamara said in March during a webinar hosted by the National Credit Union Administration and the Federal Deposit Insurance Corp.

“These are the things we’re hearing from victims of successful scams, who we talk to down the line,” she said. 

She noted the benefit of arming staff – and young employees, in particular – with that information, she said. 

“The member doesn't realize they're being scammed, so you have to know it before they do,” McNamara said.

The credit union is among the many financial institutions bolstering staff and customer education of fraud and scams as schemes grow more sophisticated and losses mount. Young employees, who might be in their first job, may not be comfortable questioning a customer on the topic. The checklist has “helped them feel more confident in what to ask someone,” McNamara said. 

The fraud alert checklist was introduced in October 2025 as a handout for staff to use, and displayed on screens in branches shortly thereafter, a Service Credit Union spokesperson said. 

The credit union has about 50 branches across New England and Germany. “Even though we do see a lot of turnover in the branches, some of the more tenured members have been around and seen a lot of examples of fraud,” McNamara said. 

Online account takeovers, done via social engineering, and check fraud are the two biggest types of fraud and scams Service encounters, she said. Staff unsure about a large check are encouraged to put an extended hold on it, or ask more detailed questions when they notice something out of the ordinary for a member.

Communication among the credit union’s fraud investigators and between fraud investigators and both back-office and front-line staff is also crucial to thwarting scam attempts, McNamara said.

“As these risks for consumers escalate, financial institutions should prioritize strong internal controls, heightened oversight, and educate their members, customers, employees about common fraud schemes,” Matthew J. Biliouris, director of NCUA’s consumer financial protection office, said during the webinar.

The Consumer Federation of America estimates Americans are losing about $119 billion each year to online scams, according to a new report. Bank and credit union executives have called for a national strategy and more coordination to combat the snowballing fraud problem. President Donald Trump in March signed an executive order intended to confront cybercrime and fraud schemes.

Financial fraud has become one of the world’s “most severe and rapidly evolving transnational crimes,” and “AI-enhanced” fraud is 4.5 times more profitable than traditional methods, according to an Interpol report.

Christina Tetreault, deputy commissioner at California’s Department of Financial Protection and Innovation, said fraud has been on the rise the last five years, “but the real game-changer appears to be AI in terms of its ability to allow fraudsters to escape detection, to elude defenses that would have previously worked, and also to trick consumers.” 

Investment fraud and impostor schemes are prevalent, and artificial intelligence is helping scammers imitate people more easily, Tetreault said March 11 during a Banking Dive and Payments Dive virtual event. 

She pointed to a scam in which the state’s enforcement team took action against a company soliciting investment by using an AI-generated CEO to appeal to investors. Many scams and frauds are being perpetrated by “vast scam compounds” outside the U.S., Tetreault said.

When Service Credit Union encounters a fraud ring, the financial institution will post banners on its website and email members to let them know what’s going on. But getting through to everyone can be “a tough nut to crack,” McNamara said. 

“You can put a lot out there, but not every member is going to visit your website or call in, so how do you engage people that are not necessarily wanting to read an email from their bank or credit union?” she said.

Beating back fraud is a constant battle: McNamara noted the credit union has a two-way texting alert system, so it can ask a customer if they did, in fact, make a certain transaction flagged as suspicious, and the member can respond “yes” or “no.” But fraudsters now mimic those text messages, too, she said.

The credit union tries to inform members without tipping off fraudsters, she said. “We might say, ‘You’ll never receive a text from the credit union that doesn’t come from a five-digit number,’ but we won’t actually say what the number is,” she said. 

To stay on top of the evolving threat landscape, McNamara encouraged bank and credit union employees to “be a sponge” and seek out the latest industry information on fraud and scams from trade groups, regulators and others. 

The FDIC’s Money Smart program has a curriculum that teaches front-line bank staff about types of scams and aims to bolster their confidence so they can question customers who might be victims. The AARP’s BankSafe Initiative also offers training designed to help bank employees identify signs of financial exploitation of older adults.

Additionally, “vendors often offer fraud-related education. Sometimes it's a sales pitch, too, but there's usually some good intel that you can pull out from that,” McNamara said.

President Donald Trump signed an executive order in March intended to confront cybercrime and fraud schemes, the day after a House subcommittee hearing detailed a “staggering” fraud problem and how to better address it. 

Trump’s order called for a comprehensive review to identify “operational, technical, diplomatic, and regulatory tools” that could be improved to combat transnational criminal organizations that perpetrate cybercrime and fraud. 

The edict also requires the submission of an action plan labeling the criminal organizations engaging in scams and cybercrime and solutions to take down their operations. Trump also wants the attorney general to prioritize prosecutions of cyber-enabled fraud and scams and offer a recommendation on establishing a program that would return seized funds to victims; and prodded the secretaries of State and Homeland Security to get involved in addressing the issue, too. 

The Consumer Bankers Association applauded Trump’s order, saying it “has long called on policymakers to address the issue through a whole-of-government strategy that works across industries to protect consumers and their hard-earned money.”  

Trump’s action “will enhance interagency coordination, pursue the criminal networks behind these attacks, and prioritize prosecution of cyber-enabled fraud,” the trade group said.

Trump’s order was issued after a House Financial Services subcommittee hearing featured bank and credit union executives emphasizing the need for better coordination among lenders, law enforcement and government to address the snowballing fraud problem. 

Industry executives also voiced support for proposed legislation geared toward combating fraud and scams. The Transaction Risk Analytics and Collaborative Exchange Act, for example, would create a framework allowing banks, payment networks, fintechs and other financial institutions to share fraud-related information in a secure way.

Rep. Andy Barr, R-KY, the chair of the financial institutions subcommittee, said the scope of the fraud problem is “staggering,” with cybercrime losses jumping 33% in 2024, to $16.6 billion. Fraudsters are becoming more sophisticated, taking advantage of artificial intelligence and social media networks to perpetrate scams, as banks and credit unions devote substantial resources to fight back, he said.

Still, Barr cited “serious structural challenges” to confronting the issue, including an outdated legal framework that inhibits bank information-sharing, checking-account money availability rules written in a different era, and a lack of coordination between federal and local law enforcement.

Barr also said financial regulators “often lack robust understanding” of AI and machine learning, preventing the establishment of “clear guardrails” for lenders.

Gay Dempsey, the CEO of Fayetteville, Tennessee-based Bank of Lincoln County, told the subcommittee her bank has seen a significant rise in check fraud, as well as impostor scams, enabled by social media platforms and bitcoin ATMs. 

The $225 million-asset lender is investing considerable time and resources in consumer education and staff training to spot fraud and report suspicious activity, since fraud losses exceed the bank’s loan losses, she said. 

Scams in which victims are told to deposit money in bitcoin ATMs are “rampant,” Dempsey said, noting that it’s a challenge to get a customer to accept they’ve been the victim of a romance scam.

“We’ve literally pulled up Facebook and showed them the photo, and they’ve told us, ‘Oh, they told us you were going to do that.’ We’ve shown them FBI reports, we do everything that we can from our end when we identify those to stop it and to inform them,” Dempsey said. 

Kate McKune, general counsel at Louisville, Kentucky-based Park Community Credit Union, said her credit union often runs up against “law enforcement’s limitations in terms of resources,” or it seems they can’t help unless losses are large enough. 

“Oftentimes, no amount of security investment or intervention can fully compensate for a consumer’s decision to trust a scammer,” McKune said.

Patrick McDade, senior vice president for fraud and technology risk management at Jacksonville, Florida-based EverBank, noted impersonation scams ensnaring consumers and small businesses are “especially dangerous” because they erode customer trust. 

The lack of coordination among banks and federal agencies stands in contrast to the fraudsters, who coordinate among themselves and don’t respect boundaries that law enforcement or other agencies do, witnesses said.

“We’ve had experience with banks where we call and they won’t give us any information just because of fear of sharing information, even though it should fall under the current [regulations] now, that they’re able to share with us and they don’t,” Dempsey said. 

Banks can’t face the problem alone, and because fraud activity often originates outside the financial sector, a national strategy to combat scams is essential, McDade said. 

Witnesses also recommended revising suspicious activity report policies to allow for “a fraud signal report.” 

Once a lender is aware of fraud, a report would enable “a concise way to get the metadata associated with that fraud reported to law enforcement, and if all the banks did that in the same fashion, they could immediately cross-reference that essential data and see the patterns and actually reach out and warn other banks that they might have fraudulent accounts,” McDade said. “Or even go upstream to the telecoms and the social media accounts and let them know, we’re seeing fraud on this phone number, or on this account, please take it down.”

As fraud losses mount, the subcommittee’s Democrats also blasted the Trump administration for sidelining the Consumer Financial Protection Bureau and said Congress should restore the agency’s authority to supervise payment apps and digital wallets.

The Federal Deposit Insurance Corp., in conjunction with the Office of the Comptroller of the Currency and the National Credit Union Administration, issued a proposal in April that would direct financial institutions to put more attention and resources toward higher-risk customers and activities, rather than those categorized as lower-risk.

The overhaul of the anti-money laundering/countering the financing of terrorism framework would align each agency’s regulations with changes proposed by the Financial Crimes Enforcement Network. That agency would get an enhanced role in the AML/CFT supervision and enforcement process under the inter-agency proposal. 

Also, the FDIC issued a proposed rule to implement provisions of the Genius Act, crafting a framework for FDIC-supervised payment stablecoin issuers featuring requirements related to reserve assets, redemptions of outstanding stablecoins, capital, permissible activities and risk management standards. 

With the 2020 passage of the Anti-Money Laundering Act, FinCEN and the banking agencies were directed to “modernize and strengthen” AML/CFT regulations “to encourage more effective outcomes” for banks, regulators, law enforcement and national security agencies, the FDIC said. AML regulations hadn’t been updated since the Bank Secrecy Act was enacted in the 1970s.

This week’s joint rules rewrite “seeks to avoid penalizing banks for ‘foot faults’ or approaching exams as ‘box checking’ exercises, and instead focuses on better aligning regulation with risk and avoiding having to wait until a massive failure to take action,” FDIC Chair Travis Hill said in a statement. 

Under the proposal, only “significant or systemic failures” to implement a program would prompt an enforcement action or a significant supervisory action related to AML/CFT, the FDIC said. 

“Banks currently devote enormous resources to complying with BSA requirements, while it is unclear to what extent much of that effort actually helps further law enforcement or national security efforts,” Hill said. “Meanwhile, the risk of large fines due to BSA violations incentivizes banks to ‘debank’ customers by denying or closing accounts.”

The proposal would also expand FinCEN’s role in the supervision and enforcement process by creating a new consultation framework for certain agency actions, the FDIC said. FinCEN would be able to review and provide feedback to the banking agencies before they issue certain AML/CFT-related enforcement and supervisory actions, which “will promote consistent approaches” to supervision, according to the notice in the Federal Register.  

Regulators would still have the necessary tools to take action “if, for example, a bank is accepting duffel bags full of cash from drug cartels or funding terrorists overseas,” Hill said.

Comments on the proposal are due 60 days after it’s published in the Federal Register.

The 191-page proposed rule implementing Genius Act standards – the FDIC’s second thus far – would also set requirements related to custodial and safekeeping services, and clarify that tokenized deposits remain deposits under the Federal Deposit Insurance Act. 

The proposal would also establish that deposits held as reserves backing a payment stablecoin would not be insured on a pass-through basis.

Hill said the agency genuinely welcomes “robust feedback” on key aspects of the proposal. 

“I recognize there will be many other questions related to tokenized deposits from market participants beyond the clarification in the proposal, and so I encourage comments on what types of additional clarity or guidance would be useful for the FDIC to consider providing,” Hill said in a statement. 

The proposed rule aligns largely with the OCC’s proposal related to stablecoin issuer regulation, put forth in February, he noted. The Genius Act labeled the OCC as the “primary Federal payment stablecoin regulator” for many potential issuers.

Comments on the FDIC proposal are due 60 days after publication in the Federal Register.

The Federal Reserve, the Federal Communications Commission and the U.S. Treasury Department are forming a public-private roundtable to solicit feedback on how to combat payments fraud, Michelle Bowman, the Fed’s vice chair for supervision, said in a speech in May.

The roundtable will discuss financial firms’ fraud-prevention efforts, the effectiveness of their data-sharing practices and possible cross-sector or government solutions, Bowman said, speaking at a housing finance conference in Washington.

The Federal Reserve Board has reviewed more than 250 comments received in June 2025 in response to a request for information from the Fed, the Federal Deposit Insurance Corp. and the Office of the Comptroller of the Currency. The Fed will use those comments to shape its approach to mitigating payments fraud, Bowman said.

In her speech, Bowman expressed support for strong partnerships between states and federal agencies to address the ever-evolving threat of payment fraud. The Fed plans to enlist banks, other regulatory agencies, law enforcement, consumer advocates and policymakers in its fight, she said. 

“We must examine whether our regulations address modern fraud and are positioned for the threats consumers will face in the future,” Bowman said. “And we must ensure the financial system serves everyone safely and securely. The criminals are sophisticated, organized, and relentless. Our approach must be equally robust.”

One key step Bowman identified during her speech is the lack of a common vocabulary to describe payment fraud forms. 

While some classification models label scams, for example, “online shopping fraud,” others are called “impostor scams.” Having shared terminology for types, scams and prevention tools could help gauge the severity of the problem, Bowman explained during her remarks.

The FDIC, the Fed and the OCC have previously collaborated to handle payment fraud. Last year, the agencies proposed a series of steps to mitigate payment fraud, particularly check fraud. At that time, Bowman also said she would collaborate with state and federal regulators and law enforcement. 

The Fed isn’t the only one raising the alarm on rising payments. 

The U.S. could learn from other countries as to how to curtail fraudulent payments, Donna Turner, a consultant with Risk Insight Solutions and a former COO of Early Warning Solutions, the bank-owned parent of Zelle and Paze, said during a March panel hosted by Payments Dive and Banking Dive. 

Coordination between banks, social media and telecommunications companies could also help identify threat actors as they use AI tools, Paul Benda, executive vice president of risk, fraud and cybersecurity for the American Bankers Association, said during the panel.

JPMorgan Chase is investing $14 million in seven initiatives aimed at preventing fraud and scams, the bank said in May.

The philanthropic investment by the largest U.S. lender comes amid an uptick in multiple types of scams, including social media scams and impostor scams, according to the Federal Trade Commission. In all, fraud and scams cost as much as $158 billion annually, according to the FTC.

Among those receiving funds are The Aspen Institute Financial Security Program, which is piloting real-time transaction blocking to prevent Electronic Benefit Transfer theft with a number of state benefits agencies, and Older Adults Technology Services from AARP, which will deliver in-person and virtual programs to help seniors protect themselves from scams, JPMorgan said.

“By supporting these impactful organizations, we’re investing in innovative solutions and community-driven programs that empower those most at risk to recognize scams, prevent fraud and keep their finances secure,” Mercedeh Mortazavi, the lender’s head of financial health, said in a prepared statement.

“This initiative reflects our commitment to advancing economic opportunity, keeping the American Dream within reach, and building safer, more resilient communities across the country,” Mortazavi said.

Other entities benefiting from JPMorgan’s $14 million investment include the Office of the San Francisco Treasurer & Tax Collector, which will launch its public messaging and scam monitoring initiative StopScamsSF; the Better Business Bureau Institute for Marketplace Trust, which will grow its Scam Tracker tool into a platform that detects and informs users of emerging scam activity with the help of AI; and Stop Scams Alliance, which next month plans to publish a nationwide survey on fraud victimization that gives a more complete picture on its prevalence and impact, the bank said.

Additionally, beneficiaries Prosperity Now will develop an AI platform for community leaders and small businesses to detect and report scams via text message; and finEQUITY will develop a mobile and web platform to connect those previously arrested or incarcerated to financial coaching, resources to help avoid high-interest debt and an AI-powered scam checker to help screen suspicious texts.

"Across the firm, we’re continuously investing in new technologies and better education to protect our customers — and we’re extending that mission into the communities where we live and work,” said Ryan Loftus, JPMorgan’s head of trust and security, in a prepared statement. “By partnering with public, private, and nonprofit organizations, we’re delivering meaningful outcomes today and building a stronger, more resilient financial ecosystem.”

Banks are spending billions on fraud detection and mitigation, and tracking down fraudsters can be difficult — but if lenders can do it, customer retention is their reward.

That’s one of the major takeaways from recent research co-authored by Vamsi Kanuri, marketing professor at the University of Notre Dame’s Mendoza College of Business.

Banks might think the outcome of a fraud investigation doesn’t matter if a customer’s funds have been returned. Yet, “whether that investigation results in finding the perpetrator or not actually does matter quite a bit in terms of customers continuing with banks,” Kanuri said in October 2025.

Customers who experienced fraud that wasn’t resolved with an attribution of blame were about 41% more likely to leave the bank than customers who never experienced fraud, researchers found after reviewing data from a major U.S. bank covering 422,953 customers over five years. 

If customers who experienced fraud were told the bank had found the fraudster, however, those clients were far more likely to stay with the bank than customers who never dealt with fraud, according to the study, co-authored by Professors Sriram Somanchi of Notre Dome and Rahul Telang from Carnegie Mellon University.  

The study, published in Production and Operations Management, demonstrates “the effectiveness of blame attribution on customer behaviors in a financial fraud context,” researchers wrote. 

“When firms are unable to hold an external entity accountable for customer-identified account-based fraudulent transactions, customers retaliate by severing their relationship with the firm, even when the firm credits the entire amount that the customers have lost due to fraud,” the study said.

The study findings embody the “service recovery paradox,” Kanuri said. That’s when customers who’ve experienced a problem that’s dealt with swiftly and sufficiently are more loyal and satisfied than customers who never encountered a problem.

“Our initial hypothesis was that these people should be mad, regardless, and we should see attrition, regardless of what the outcome is,” Kanuri said of customers who experienced fraud. “But it turns out, for these subset of customers, their trust is reinforced by the fact that if something were to happen to their money, the bank has the technological know-how to actually track the perpetrator, and that restores trust for customers, which eventually leads to these people staying longer than those customers that never experienced fraud.”

The findings underscore the importance of banks’ spending on fraud detection and mitigation, Kanuri said.

Kanuri recalled conversations study authors had with bank leaders, noting “one of the bank execs said, ‘We are spending all this money, what is the [return on investment]? When stakeholders and investors ask these questions, when board members ask these questions, we don’t have answers, but in our gut, we do know that it helps immensely with gaining back trust from the customers.’”

Because the bank that researchers worked with didn’t want to give current customer data due to the sensitive nature of information, the data Kanuri and his colleagues worked with was several years old, but “the context is still relevant,” Kanuri said. 

“This is a recurring problem,” he said. “It doesn't matter which year you look at; there's going to be problems.” 

About half of U.S. adults have had fraudulent charges made with their credit or debit card, Pew Research Center said in July. The FBI says more money is being lost to online scams and cybercriminals than ever, with a record $16.6 billion in losses reported to the agency in 2024. The Federal Trade Commission estimated 2024 fraud losses at $12.5 billion. 

As fraud and scams have become more pervasive, the issue has drawn increased attention and calls for collaborative action from lawmakers, financial services regulators and the industry. Banks intended to spend more on tech, with fraud mitigation being one of their top priorities in 2025, according to American Banker.  

Kanuri and his co-authors also discovered that customers who have more touchpoints with the bank and engage with it more frequently “tend to discount these one-off fraud cases, even when the bank is not able to identify the perpetrator” — which is notable given the low success rate associated with identifying fraudsters, he said. 

Educating customers on technological advances and what banks are doing to safeguard customer accounts seems to offer banks “a cushioning effect,” he said.  

Banks should also explore ways to soften the blow by testing different communication strategies with customers, Kanuri said. Rather than sugarcoat the information, lenders who’ve been unsuccessful in attributing fraud blame should put it plainly that they’ve not been able to find the perpetrator of the fraud. 

“It’s actually the beginning of the service recovery process, because once you do that, there’s going to be an after-effect of how customers perceive of your services,” he said. “So you should be following up with customers and doing everything possible to actually regain their trust.”

A federal judge in June dismissed an investor lawsuit against JPMorgan Chase, Barclays and Fifth Third, which had accused the banks of missing “giant red flags” ahead of subprime auto lender Tricolor’s bankruptcy.

Judge Jed Rakoff of the U.S. District Court for the Southern District of New York did not provide a specific reason for the dismissal, only writing that “an opinion explaining the reason for this ruling will issue in due course.”

Plaintiffs, led by One William Street Capital Management, alleged in February that Tricolor operated “a blatant double-pledging scheme,” where a single auto loan was pledged as collateral for multiple warehouse credit lines with different banks, and the company often continued doing so after that auto loan was sold into a securitization.

Auditors made the banks aware of various issues in 2022 and 2024, plaintiffs alleged, and “the only question that remains is how the Defendants failed to stop it.”

“Rather than risk a massive loss on their warehouse lines and forfeit the millions of dollars of fees and income derived from Tricolor’s fraudulent enterprise, Defendants responded by hiding what they had learned and sticking their heads in the sand to avoid learning more,” investors alleged in the lawsuit.

Barclays and Fifth Third declined to comment to Reuters, and JPMorgan had no ​immediate comment.

Tricolor filed for bankruptcy in September 2025, after which JPMorgan Chase, Fifth Third and Barclays each logged charge-offs well over $100 million.

Tricolor CEO Daniel Chu and COO David Goodgame were both indicted in December for allegedly defrauding creditors and lenders. Both men pleaded not guilty.

Federal financial regulators issued a joint advisory in June encouraging banks and credit unions to “be vigilant against” fraudulent or suspicious activity connected to the employment of immigrants lacking permanent legal status and the associated risks to the financial system. 

In the advisory, FinCEN shared 18 “red flags” designed to help lenders detect and report activity tied to the employment of unlawful workers, and specifically called out the agriculture, construction, domestic service, hospitality or staffing industries.

The advisory, which instructs banks to file suspicious activity reports related to the issue or contact Immigration and Customs Enforcement, follows a May executive order aimed at getting banks to gather more information on their customers’ immigration status. 

The advisory was issued by the Treasury Department’s Financial Crimes Enforcement Network, the Federal Deposit Insurance Corp., the Office of the Comptroller of the Currency and the National Credit Union Administration, in coordination with the Internal Revenue Service. 

“Non-work authorized populations and their employers often rely on access to the U.S. financial system,” the FinCEN advisory said. “In certain instances, the access to financial services and unlawfully obtained wages can be leveraged to facilitate the financing of transnational criminal organizations — several of which have been designated as Foreign Terrorist Organizations — and their global criminal enterprises, including drug trafficking, human trafficking, and other illegal activity in the United States.”

The May executive order directed the Treasury Department, the Consumer Financial Protection Bureau and other federal financial regulators to change Bank Secrecy Act regulations “to strengthen risk-based customer due diligence requirements” for banks, ensuring lenders have the authority to pursue additional customer information including their immigration status.

The executive order “sets in motion a series of regulatory actions that could materially affect compliance obligations under anti-money laundering laws and credit underwriting practices,” Mayer Brown attorneys wrote in a May web post. “It will require financial institutions to devote significant attention and resources” to implementing regulators’ guidance over the coming months.

Comptroller of the Currency Jonathan Gould, in May, called the executive order “a common-sense set of reforms that give us the tools that we need and preserve bank flexibility around how they establish the identities, that is, how they know their customers.”

Banks have an important obligation to know their customer and “the identities of their customer,” Gould said in May, and are held to a regulatory expectation that they’re not helping facilitate financial fraud, money laundering or terrorism finance.

The FinCEN advisory specifically mentions identity theft and payroll fraud as features of schemes undertaken by “complicit employers” in some industries.

“According to ICE, many employers across the agriculture, construction, domestic service, hospitality, and other industries are knowingly — or through willful negligence — facilitating the hiring, concealment, and in some cases, exploitation of unlawful alien labor in their workforce to reduce labor costs and gain an unfair advantage over competitors,” the advisory said.  

FinCEN said red flags indicating such activity include an individual customer’s Social Security number not matching Social Security Administration records; a customer receiving recurring peer-to-peer payments from a small or newly established company in the agriculture, construction, domestic service, hospitality or staffing industries; or a customer cashing a large volume of checks drawn on accounts owned by companies in those industries at a check casher or money transmitter. 

FinCEN also wants banks monitoring its business customers operating in those industries. Red flags of “complicit employers” include a company with a history of worksite compliance violations from ICE; one that has sizable business operations and transactional activity but lacks corresponding payroll activity; or a company issuing recurring and large volumes of checks for less than $1,000 made payable to a large number of people cashing the checks.

If an individual taxpayer identification number is presented in lieu of a Social Security number or valid employment authorization document during the account opening process, banks are “encouraged to assess” whether the ITIN’s use “may be a relevant risk factor,” FinCEN said.

ITINs are used by the IRS for individuals requiring identification for federal taxpayer purposes but who aren’t eligible for a Social Security number. 

Meanwhile, the CFPB filed a statement that “reminds” banks of their Truth in Lending Act obligations in connection with the May executive order, and emphasizes banks’ ability to consider an applicant’s immigration status as it relates to repayment abilities. 

Creditors are required to “assess consumers’ ability to repay before offering mortgages and certain open-end credit products. This statement emphasizes to creditors that these requirements may obligate consideration of a consumer’s immigration status, especially where removal from the United States may disrupt the consumer’s income,” the CFPB said.

If a borrower’s immigration status indicates they could be removed from the U.S., there’s a risk that a bank extending credit wouldn’t be repaid, the bureau said.

“Considering whether information regarding an applicant's immigration status indicates a reasonably expected change in future income is a matter of sound compliance practice,” the CFPB said.