Front End Ops Lending Licensing Certifications Events All Courses More

Bank Fraud Prevention FAQs

What is bank fraud?

Bank fraud is the use of deception, misrepresentation, unauthorized activity, or other unlawful conduct to obtain money, property, services, or other benefits from a financial institution, its customers, or other parties.

What are common types of bank fraud?

Common types include:

• Check fraud
• Wire fraud
• ACH fraud
• Identity theft
• Account takeover
• Payment fraud
• Loan fraud
• Deposit fraud
• Business email compromise (BEC)
• Forgery and counterfeit instruments
• Elder financial exploitation

What are common warning signs of fraud?

Warning signs may include unusual transaction activity, unexpected changes to account information, urgent payment requests, requests to bypass established procedures, inconsistent customer information, suspicious emails or communications, or transactions that do not fit the customer's normal activity.

What is check fraud?

Check fraud involves the unauthorized creation, alteration, theft, or use of checks. Examples include forged checks, altered payee or amount information, counterfeit checks, and check washing.

What is ACH fraud?

ACH fraud involves unauthorized or fraudulent Automated Clearing House transactions, which may include unauthorized debits, account takeovers, or fraudulent payment instructions.

What is wire fraud?

Wire fraud involves using electronic communications or other deceptive means to induce an individual or organization to send funds through a wire transfer.

What is identity theft?

Identity theft occurs when someone uses another person's identifying information without authorization, often to obtain financial products, access accounts, conduct transactions, or commit other fraudulent activity.

What is check kiting, and how is it detected?

Kiting exploits the timing of check processing by writing checks between accounts at different institutions so that balances appear funded when they are not. Detection signals can include frequent large deposits and withdrawals between related accounts, deposits closely matched by same-day withdrawals, and activity in which the ledger balance remains high while the collected balance stays low. Banks may use specialized monitoring and reporting tools to identify potential kiting.

Why is check fraud increasing when check volume is falling?

Checks that remain in use can include relatively high-value business and government payments, and stolen checks can be altered or otherwise misused. Controls such as positive pay and payee-match services can help commercial customers detect and prevent certain types of check fraud.

How can employees help prevent fraud?

Employees should follow established authentication, verification, approval, and transaction-processing procedures; protect credentials and sensitive information; remain alert to unusual activity; and promptly escalate suspected fraud.

How should wire transfer requests be verified?

Employees should follow the bank's established authentication and callback procedures. Requests involving new beneficiaries, changes to payment instructions, unusual amounts, or urgent circumstances should receive appropriate verification before funds are released.

What should employees do if a customer requests a change to payment instructions?

Employees should follow established verification procedures and should not rely solely on email or other potentially compromised communications. Changes should be independently authenticated through approved channels.

What is business email compromise?

Business email compromise (BEC) is a scheme in which an attacker impersonates an executive, vendor, attorney, or other trusted party to induce a payment or change to payment instructions. BEC often relies on social engineering rather than malware. Out-of-band verification using a previously established and trusted contact method is an important control.

How should staff handle a request to change a vendor's payment instructions?

Treat the request as high risk by default. Verify it through a callback to a previously established number rather than a number supplied in the request, follow applicable dual-approval requirements, document the verification, and use the institution's established procedures before making the change.

What does elder financial exploitation look like at the teller line?

Warning signs can include a customer who appears coached or is accompanied by someone answering for them, unusual urgency or secrecy, a sudden change in transaction patterns, new joint account holders or beneficiaries, large withdrawals inconsistent with account history, wire requests to unfamiliar destinations, or stories involving lotteries, romance scams, relatives in trouble, or government agencies demanding payment.

What can an employee actually do when they suspect elder exploitation?

Employees should follow the institution's procedures, involve a supervisor or appropriate internal personnel, and escalate the matter as required. Where permitted, employees may also need to follow applicable reporting procedures for suspected financial exploitation. Employees should avoid confronting or accusing the customer or another individual and should prioritize the customer's safety and the institution's established escalation process.

What are the most common account takeover methods?

Common methods include credential phishing, SIM swapping, social engineering of call-center personnel to reset credentials, and malware designed to capture authentication information or online banking sessions. Banks therefore need controls across login, call-center, branch, and other customer-service channels.

What internal controls actually prevent employee fraud?

Important controls include segregation of duties, dual control over cash and negotiable instruments, mandatory vacation or job rotation for sensitive positions, transaction review by someone other than the person performing the transaction, restricted and monitored system access, and exception reporting reviewed by an independent party.

What are red flags of internal fraud?

Potential warning signs include an employee who resists taking time off or transferring roles, unusual interest in areas outside their duties, transactions involving accounts of relatives or acquaintances, frequent overrides or corrections, unexplained changes in lifestyle, and customer complaints that cluster around one employee. Behavioral and supervisory controls can be important components of an internal-fraud program.

What is dual control, and where should it apply?

Dual control requires two authorized individuals to complete a transaction or access an asset so that no individual acts alone. Depending on the bank's risk assessment and procedures, it may apply to vault and ATM cash, safe deposit access, official checks and other negotiable instruments, wire release, and system entitlement changes. Banks should ensure that dual-control requirements are consistently followed in practice.

Who bears the loss when a customer is defrauded?

It depends on the payment method and the facts. Consumer electronic fund transfers may be subject to Regulation E protections and liability limits when applicable requirements and reporting timeframes are met. Wires initiated by an authorized customer, even when induced by a scam, may be treated differently from unauthorized transfers. Check disputes are generally governed by applicable law, including UCC provisions, and the specific facts and circumstances matter.

What are the Reg E error resolution timeframes?

For applicable consumer electronic fund transfer errors, the consumer generally must notify the institution within 60 days after the statement containing the alleged error was sent. The institution generally has 10 business days to investigate, subject to applicable rules regarding provisional credit and extended investigation periods. Institutions should follow the specific requirements applicable to the transaction and error type.

What should an employee do the moment they suspect fraud in progress?

Employees should not confront or accuse the customer or another individual. They should follow the institution's escalation procedures, involve a supervisor or designated fraud personnel, preserve relevant documentation and surveillance references, and avoid disclosing confidential investigative information. When funds have recently been transferred, prompt escalation can be important because recovery options may depend on timing.

Does filing a SAR satisfy the bank's fraud obligations?

No. A Suspicious Activity Report is a regulatory reporting mechanism, not a loss-recovery action or customer remedy. Depending on the circumstances, the institution may also need to address potential customer claims, attempt to recover funds, investigate the incident, correct control weaknesses, and consider appropriate law-enforcement or regulatory notifications.

How can customers protect themselves from fraud?

Customers should use strong, unique passwords, enable multifactor authentication when available, protect account credentials, review account activity regularly, avoid clicking suspicious links, and independently verify unexpected payment or account-change requests.

Why is employee training important for fraud prevention?

Employees are an important line of defense against fraud. Regular training helps employees recognize emerging fraud schemes, follow authentication and verification procedures, protect sensitive information, and escalate suspicious activity appropriately.

How does the bank respond to suspected fraud?

Depending on the circumstances, the bank may investigate the activity, restrict or secure accounts, contact affected customers, attempt to prevent or recover funds, coordinate with internal security or fraud teams, make appropriate reports, and take other measures consistent with applicable law and bank procedures.

What should employees do if they suspect another employee may be involved in fraud?

Employees should promptly report the concern through the bank's established confidential reporting or escalation channels. They should not confront the individual or conduct their own investigation unless specifically authorized to do so.