Fraudologyへお帰りなさい。
今回のエピソードでは、ヘイリー・ウィンダムをお迎えして、一見するとコンプライアンスのアップデートのように聞こえるかもしれないものの、長い間見られなかったほど重要な不正対策の転換点となり得るテーマ――FinCEN による改訂版 314(b) 不正ガイダンスについてお話しします。
何年もの間、不正対策チーム、AMLチーム、そして金融機関は、より良い情報共有の必要性について議論してきました。不正は一つの機関の中だけで起こるものではないことを、私たちは皆理解しています。詐欺ネットワークは、銀行、フィンテック、決済プラットフォーム、マネーミュール口座、そしてあらゆる顧客接点をまたいで動き回ります。一つの機関が全体像を把握したときには、すでに資金は失われているかもしれません。
FinCEN の新しいガイダンスにより、第 314(b) 条に基づく情報共有には、従来のマネーロンダリングやテロ資金供与活動だけでなく、疑わしい不正行為も含めることができることが明確になりました。これにより、参加する金融機関は、不正の兆候、サイバー関連の不正データ、口座活動、その他のシグナルを共有し、詐欺が拡大する前に食い止めるための、より明確な道筋を得ることができます。
この議論の本質は、それが実務上どのような意味を持つのかという点にあります。ガイダンスは、それをどのように業務に落とし込むかをチームが理解していて初めて役に立つものです。ここでのチャンスは、単に「もっと情報共有できます」と言うことではありません。金融機関、不正対策チーム、AMLチーム、コンプライアンス責任者、そして同じ問題の異なる側面を見ている調査担当者の間で、より優れたリアルタイムの連携体制を構築することこそが、真の機会なのです。
このエピソードでお届けする内容：
- なぜFinCENの314(b)詐欺ガイダンスの更新が、不正対策チーム、AMLチーム、そして金融機関にとって重要なのか。
- 疑わしい不正が複数の金融機関間で行われている場合に、314(b) に基づく情報共有がどのように迅速な連携を支援できるか。
- なぜセクション314(b)のセーフハーバーが重要なのか、そしてそれが何を解決し、何を解決しないのか。
- 金融機関同士で不正に関する情報を共有することで、詐欺行為、不正送金用口座（ミュール口座）、アカウント乗っ取り、サイバー関連の不正データへの対処にどのように役立つか。
- なぜSARの機密保持と314(b)の取り扱いには、依然として細心の注意が必要なのか。
- 金融機関は、314(b) に関する登録要件および参加要件について、どのような点を考慮すべきか。
- なぜこのガイダンスが、不正防止とAML/CFTに関する情報共有との間にある業務上のギャップを埋めるのに役立つのか。
このエピソードは次のような方におすすめです：
- 不正防止、マネーロンダリング対策（AML）、調査、コンプライアンス、または金融犯罪対策業務に携わっている。
- 詐欺行為が、あなたのチームの対応よりも速いペースで複数の機関をまたいで広がっていくのを目撃したことがある。
- 314(b) に基づく不正情報の共有が、どのようにリアルタイムでの連携を支援できるのか理解したい。
- 不正の兆候、マネーミュール口座に関する情報共有、そしてマネーミュール検知を、複数の金融機関間で連携させようとしている。
- FinCEN の不正行為に関するガイダンスについて、単なる法務やコンプライアンスの議論に終始させずに、もっと分かりやすく考えられる方法が必要です。
エピソードの概要と主なポイント
FinCEN の 314(b) 不正行為に関するガイダンスは、金融機関にとって連携しやすい明確な余地を与えている
このエピソードの最大のポイントは、FinCEN が改訂した 314(b) 詐欺ガイダンスによって、疑わしい不正に関する情報共有について、金融機関にとって必要とされていた明確性がもたらされたということです。
詐欺師たちは互いに協力し合っています。詐欺ネットワークも協力し合っています。マネーミュールの組織も協力し合っています。しかし、彼らを食い止めようとする金融機関は、多くの場合、不確実性や社内のリスク懸念、プライバシーに関する疑問、あるいは誤った情報を共有してしまうことで規制上のリスクが生じるのではないかという恐れによって、行動が制限されています。
314条(b)のセーフハーバーは何年も前から存在していますが、多くの金融機関は歴史的に、まずAML（マネーロンダリング対策）のためのツールとして扱ってきました。今回の改訂により、マネーロンダリング、テロ資金供与、その他の特定された違法行為が関係する可能性がある場合には、不正行為も情報共有の議論の対象になり得ることが、より明確になりました。
リアルタイムの情報共有による不正対策ワークフローこそが真のチャンスである
ここで最も重要なのは「リアルタイム」であるという点です。詐欺は、四半期ごとのワーキンググループや、時間のかかるエスカレーション、事後のケーススタディを待ってはくれません。詐欺スキームは素早く動きます。マネーミュール口座も素早く動きます。ソーシャルエンジニアリングも素早く進行します。アカウント乗っ取りも同様に急速に進みます。そして、一度お金がある金融機関から出て別の金融機関へと動き始めると、資金を取り戻せる時間的な猶予は分刻みで小さくなっていきます。
ある金融機関が不審なパターンを検知し、別の金融機関が資金移動の次のステップを目撃しているような場合、両者のチームには、そのシグナルを迅速かつ適切に比較できる手段が必要です。そこには、口座識別子、取引パターン、デバイス情報、IPアドレス、行動指標、受取人の詳細、その他の不正の兆候などが含まれる可能性があり、そうした情報によって、各機関は自分たちが見ているものが単発の活動なのか、より大きなネットワークの一部なのかを判断することができます。
ここは、不正対策業務とAML/CFTに関する情報共有が、より緊密に連携する必要がある部分でもあります。不正対策チームは、まず顧客に直接見える活動を把握するかもしれません。AMLチームは、資金移動のより広い流れを理解している可能性があります。コンプライアンスチームは、何を共有できるのか、どのように記録すべきか、そして誰が関与すべきかといったルールを理解している場合があります。
314(b) に基づく不正情報の共有の力は、単に法的な許可にあるわけではありません。その真価は、その後に続く業務設計にあります。
セクション314(b)のセーフハーバーは、ガバナンスの必要性をなくすものではありません
この議論で最も重要な点の一つは、314(b) の不正行為に関するセーフハーバーが「誰とでも何でも共有してよい」という意味ではないということです。仕組みはそのようになっていません。
金融機関は依然として、314(b) に関するコンプライアンス要件、登録要件、および参加要件を理解しておく必要があります。方針（ポリシー）が必要です。管理体制（コントロール）が必要です。文書化も必要です。機関内部の誰が、どのような状況で、どの参加金融機関と、どのような目的で情報を共有することを許可されているのかを把握しておく必要があります。
チームがSARの機密保持や314(b)への対応を行う際には、これは特に重要です。金融機関は、SARの存在を明らかにしたり、保護されているSAR関連情報を開示したりしないよう、細心の注意を払う必要があります。だからといって、チームが連携できないという意味ではありません。正しい方法で連携する必要があるということです。
プロセスが厳しすぎると、チームはそれを使わなくなります。逆にプロセスが緩すぎると、金融機関は新たなリスクを生み出してしまいます。重要なのは、チームが不用意にならずに素早く動ける、実践的な枠組みを整えることです。
金融機関同士で不正に関する情報を共有することで、個々の取引だけでなく、その背後にあるネットワークも明らかにすることができます
不正対策チームは、しばしば「1人の顧客」「1つの口座」「1件の取引」あるいは「1つの事象」だけを個別に見ることを余儀なくされています。しかし、現代の不正はそのような単純な形で行われることはほとんどありません。同じデバイス、マネーミュール、電話番号、IPアドレス、メールパターン、架空（シンセティック）ID、あるいは入金先口座が、複数の金融機関にまたがって利用されていても、そのつながりに誰も気づかない場合があるのです。
個々の金融機関が目にするのは、不審なログインが1件、新しい怪しい受取人が1件、通常とは異なる振込が1件、あるいは被害報告が1件だけかもしれません。しかし、複数の機関が情報を突き合わせることで、より大きなパターンが見えてくる可能性があります。これは特に、マネーミュールの検知、アカウント乗っ取りに関する情報共有、サイバー関連の不正データの共有、そしてスピードと分断を悪用する詐欺ネットワークの把握において顕著です。
ここでも、不正の疑いがある情報の共有によって、金融機関は個別の事後対応から、ネットワーク全体を先回りして検知するアプローチへと移行することができます。現在の課題は、その仕組みを十分に活用できるよう、組織内部の体制を整えることです。
このガイダンスは、不正行為とマネーロンダリング対策（AML）の間にあるギャップを埋めるのに役立つ可能性があります
この分野で私が最も重視していることの一つは、詐欺対策チームとAMLチームが、まったく別個の問題を解いているかのようにバラバラに動かないようにすることです。両者には確かに異なる任務があり、異なる報告義務もあります。しかし、彼らが注視している活動は、ますます密接に結びついてきています。
不正行為によって収益が生まれます。その収益は動き回り、分散され、現金化され、送金され、形を変えられたり、マネーミュール口座を通して流されたりします。もし不正対策チームが被害発生時の事象だけに、AMLチームがその後に現れる不審な取引だけに注目していると、両方のチームが全体像を見落としてしまう可能性があります。
だからこそ、このFinCENによる不正対策ガイダンスは、単なるコンプライアンスを超えて重要なのです。
これは、金融機関が不正防止、AMLに関する不正情報の共有、AML/CFTに関する情報共有、そして調査戦略を結びつける、より明確な理由を与えるものです。また、チームに対して、314(b) を単なる限定的なコンプライアンス手続きとしてではなく、より頻繁に連携すべきチーム同士をつなぐ架け橋として捉える視点も与えます。
不正との闘いは、金融機関ごとの個別防御から、ネットワーク型の協調体制へと移行しつつあります
このエピソード全体を通じた最大のテーマがあるとすれば、それは不正防止がいつまでも金融機関ごとの個別防衛のままではいられないということです。そのモデルは犯罪者に有利に働きます。詐欺ネットワークは、その隙を突いて、金融機関、決済プラットフォーム、フィンテック、銀行、そして消費者の間にあるギャップを悪用できてしまうのです。
314(b) の不正対策に関するガイダンスの改訂が重要なのは、不正対策の担当者がすでに理解していること、すなわち金融機関はしばしばリアルタイムで不審な動きを把握しているものの、被害が広がる前にそうしたシグナルを相互に結び付けるための、より良い手段を必要としているという点を認めているからです。
これは、詐欺対策チームにデータを無謀に扱わせることが目的ではありません。コラボレーションをより使いやすく、よりタイムリーに、そしてより効果的にすることが目的なのです。
この問題を真剣に受け止めている金融機関は、今まさに、実務的でコンプライアンスに適合し、かつ業務上有用な 314(b) 不正情報共有プロセスをどのように構築するかを検討すべきです。つまり、登録や参加方法、ガバナンス、SAR（疑わしい取引の届出）の秘匿性、不正の指標、詐欺・スキャムのエスカレーション経路、そして不正対策部門とマネーロンダリング対策（AML）部門の間の日々のワークフローを見直すことを意味します。
最終的なポイント：
FinCEN による改訂版 314(b) 不正行為ガイダンスは、単なる規制アップデートではありません。これは、金融機関同士の不正関連情報の共有を、より迅速に、より明確に、そしてより有用なものにしていく必要があるというシグナルです。
正直なところ、それはもうとっくに行われるべきことでした。
詐欺師たちはすでに、さまざまなプラットフォームや口座、金融機関、国境を越えて連携しています。金融機関がそれに対抗していくためには、同様に責任ある形で協力できる仕組みが必要です。314(b)条のセーフハーバーは、それを可能にするための有効な手段の一つですが、そのメリットを活かすには、チームがその使い方を正しく理解していることが前提となります。
ですから、もしあなたが不正対策、マネーロンダリング対策（AML）、コンプライアンス、調査、あるいは金融犯罪対策の責任ある立場にいるのであれば、これはただ聞き流して終わりにすべきではないエピソードのひとつです。チームに持ち帰ってください。あなたの金融機関が今日、どのように314(b)を活用しているのかを問いかけてください。不正対策チームが、いつ・どのようにそれを使うべきか理解しているかを確認してください。AMLチームと不正対策チームの足並みがそろっているかを確認してください。詐欺のスピードに対応できるプロセスを持っているかどうかを問い直してください。
なぜなら、このガイダンスには意味があるからです。しかし、その後に各金融機関がそれをどう活用するかは、さらに重要だからです。
つながる：Hailey Windham, CFCS | LinkedIn
- 「Fraud Forward」ポッドキャストのホスト
- Sardineのバンキングコミュニティリード
- 公認金融犯罪スペシャリスト（CFCS）
- 2023年 クレジットユニオン・ロックスター（CU Magazine）
- 継続的改善賞（SAFE連邦信用組合、2023年）
- 40歳未満のプロフェッショナル上位20人（The Sumter Item紙、2022年）
つながるKarisse Hendrick | LinkedIn
- Fraudologyポッドキャストのホスト
- 受賞歴のあるサイバー詐欺対策の専門家
- Eコマース不正防止コンサルタント
- スタートアップアドバイザー、基調講演者、そして
- フォーチュン500企業の商業部門向けコンサルタント
Episode transcript
Karisse Hendrick
00:02
Welcome to Fraudology Podcast where we dive into the science and study of online fraud from the perspective of an e-commerce fraud fighter. I'm Karisse Hendrick. Welcome back to the Fraudology podcast. I am so excited to have Hailey Windham here with me today. It's been a little while since Hailey's been on the podcast. I know we did a joint episode for Fraud Fight Club back in April, but before that I think it was back in 2025. And if you haven't heard Hailey before, she's been on the community banking side and credit union side of fraud prevention for several years and she very recently, as in the end of last year, started a full time position with Sardine. So welcome, Hailey, to the podcast again.
Hailey Windham
00:50
Thank you so much. It's always a pleasure to join you on Fraudology.
Karisse Hendrick
00:53
Yes, you are. I can't remember the first time you came on the podcast, but was it three years ago at least?
Hailey Windham
01:01
Yeah, I think it was three years. And I was just a little small town credit union girl who was inspired by you to create her own internal podcast. And there's been a lot of changes, but you've, you've stirred up a lot of inspiration and motivation in me, so I'm always eternally grateful.
Karisse Hendrick
01:17
Oh, well, I just love getting to see your growth. It's been so exciting to me. And you had, you were the host of the Banking on Fraudology podcast and now it's called Fraud Forward. And really the vision for that podcast is similar to Fraudology, but specifically for banks. Let's go ahead and start with what you've been up to. I mean, I kind of gave a little bit of a overview of what you've been up to since you were last on the podcast. But how is it being at Sardine going from the banking side to the vendor side?
Hailey Windham
01:50
Well, it's been a whirlwind, but in the best way possible. Honestly, from the banking practitioner side, I was afraid to come over on this side, you know, afraid of that, thought of, you know, she's a sellout or, you know, she's gone over to the dark side and now we don't want to talk to her. But it hasn't been like that at all. And mainly one of the main reasons why I joined Sardine was because of that I was told, you know, and since then it's been true. But I was told that we don't want you to try to sell anything. We just want you to keep doing what you're doing. We want to help give you, help you at scale, right? Instead of helping one credit union, help multiple. And making sure that we can get the information out. So I'll say, you know, my role is the community lead for banking. And so I have been focused on, you know, building the resources that are actually useful for fraud practitioners and not just vendors. So it's not just a, hey, this is what's going on in the industry. Let me sell you something. It's, hey, this is what's going on in the industry. Here's how you can make it operational, here's some practical takeaways for you. And just leading with knowledge and information first. Versus over, you know, fear tactics, trying to make you think, oh, the next best technology is the answer. So, you know, obviously the podcast got a facelift, so it's now called Fraud Forward, just a rebranding. But I think the message is pretty clear that fraud isn't static. Right. It evolves constantly. And, you know, the goal was simple. Still have those practitioner led conversations that help move the industry forward. So we've had guests from financial institutions, fintechs, law enforcement, even had consumer advocacy organizations. And I think the one thing that I'm really proud of is that we've been able to balance those strategic conversations with operational reality. So, you know, if someone listens to an episode, I want them to walk away with something they can use tomorrow morning at work. I think that that's very important for any conversation I have. At least that's recorded and other people can hear.
Karisse Hendrick
03:47
Well, and you and I are so aligned in so many of those things as far as, you know, giving back to the industry. I know that you are currently working on promoting a benchmarking survey for credit unions and community banks. You know, right now they're responding to it. You don't have all of the data gathered yet, but you're getting there. And I think, you know, to my knowledge, there's never been anything like that before. Just like there hadn't been anything like my fraudology benchmarking study for merchants back in, I think it was 2023 now. It was very unique because it asked the questions that merchants wanted to know, not that vendors wanted to know about merchants. And I think that's exactly your goal with the banking survey. And I'm really excited for you to get those results and for them to help people move the needle forward within their organization, to share it with their leadership, to say, hey, we're over here, this is where everyone else is, or, hey, we're actually doing really good. You should give me a raise. Using it for practicality, I think is really exciting when that gets to happen 100%.
Hailey Windham
04:57
So this is actually the project that I'm most excited about. And one of the things that whenever, you know, Sardine asked Hailey, what's one thing you want to do? And I was like, I really want a benchmarking report. And so this is another promise they've kept to me. And so again, we launched this. It's the industry's first practitioner built fraud benchmarking survey. And specifically for community banks and credit unions, we're focusing on 10 billion and under. The goal is to finally answer questions like how many alerts should an investigator handle, you know, efficiently? What does normal staffing look like? How much are institutions actually losing to scams? And you know, early data from the benchmarking, it's confirming what we've already known and felt that they're being asked to do more with less. I will say though, I have to give a shout out to my credit unions right now because 80% of my respondents have been credit unions. So I need my community banks to step it up. But again, you know, fraud teams, I don't think that they've lacked benchmarks necessarily. There are some that are available that are industry, but it's from my experience they were really vendor led versus practitioner led. So it was, hey, here's our, here's our current benchmarking on fraud. And it's like, okay, who'd you poll for this? Like, I follow you guys and you didn't poll me for this information, so where did it come from? You know, that was just one of the things that always bugged me. And then I'll never forget reading one of the industry benchmarks that said, okay, ACH fraud, here's how much they lost. And I was like, is there not a breakdown of, you know, EFT, you know, transferred external transfers that we sent out or member to member internal transfers? Like there's not a breakdown of what is actually happening, like online versus origination with ACH. We just categorized it into one that's not helpful. So I wanted to make sure that I brought some of those, you know, again, just practice practitioner insights into this benchmark so that we could actually take it back and again, use that information tomorrow to help our programs. And so far, the responses, again, I'd love to have a few more before we close it out officially, but I'm really excited to see the insights we have so far and really look forward to posting that, that full benchmark report that'll come out soon.
Karisse Hendrick
07:08
I remember years ago when I was working for a nonprofit organization, a trade association for e-commerce merchants and fraud. One of my friends that was working at Twitter at the time said, Karisse, your job is to help me do my job better. And that has stuck with me. And even though I don't work for that nonprofit or that, you know, trade association anymore, that's still how I think through things, right? With MFA, coming up with the podcast with those type of things. And I think that's the lens that you look through too, is how can I help my people do their job better.
Hailey Windham
07:42
I love that you mentioned that, that it also leads me to the other two things that I built since starting at Sardine. You know, one thing that I think now that I'm really diving into content is that some people like to, you know, receive it a different way. You know, either through video, podcast, or audio. Or maybe it's reading things or just quick little sound bites. So I've kind of embraced all of it, trying to see, you know, what, what's best received, but also just trying to give back to the industry in the way that they want to receive it. So I also have a newsletter out now. It's called the Monday Fraud Fix. So again, this just kind of helps practitioners start their week informed. So I cover, you know, regulatory updates, industry trends, of course, podcast highlights, and any actionable insights that I find. Again, I just wanted something that was short enough to read with a cup of coffee, but substantive enough to matter. And then on Fridays, I now have five minutes of Fraud, which is just a short form content series. I try to keep it under five minutes, but you guys know me, I talk a lot. So sometimes 5 minutes and 50 seconds, sometimes. I got a message from my boss the other day and he said, he circled it, it said five minutes of fraud, but it was 10min and 51 seconds. And I was like, look, I got on a rant, okay? I couldn't help it. But you know, during that five minutes or less, wink, wink, can't hint, you know, I'll try to break down a, you know, major fraud trend. Again, just a regulatory update or a scam I'm seeing, you know, the fraud world moves quickly and not everyone has time for that hour long podcast. So why not give, just it something in short form? You know, fraud fighters are busy. Sometimes you only have five minutes. Again, I try to, I try to meet that goal of five minutes, but sometimes I just get too excited. But I, I want those short minutes to count for those, so again, just those other two things that, that I felt were ways to give back. And Sardine has fully embraced that and it's given me the platform to do it.
Karisse Hendrick
09:39
I love that. Yeah, I, I know that people like short form, but I just can't do short form. I have to do long form conversations. So I'm like, that's what you get. But, you know, the transcripts are actually about to all be released online for Fraudology, as well as synopsises of every single episode. I think we're at. I think this one is 407. I actually like completely blazed past the 400 mark and didn't even take time to celebrate it. I didn't notice till it was like 403 and I was like, whoops. Oh, I didn't realize I was close to that.
Hailey Windham
10:13
Never too late to celebrate what you've done, Karisse. Truly.
Karisse Hendrick
10:16
Yeah, I suppose I'm not good at celebrating myself. I'm very. I love celebrating other people and their success, but that's just not my. It's not something I think about. But so tell me, what you know, because you are so dialed in to community banks and credit unions. What are some of the things that they're worried about? What are they, what are they working on? What are they worried about? Is it external fraud threats? Is it internal, you know, fraud operations? Is it justifying their job to senior leadership? Like, what are their concerns right now?
Hailey Windham
10:50
So I'll tell you, the concerns kind of stayed the same from whenever I was a practitioner. I know that I focused heavily on how in the world do I even get them to understand that fraud is important? But because fraud and scams are just at an all time high, the scams and social engineering aspect is like the number one issue for fraud people right now. And it's because executives are finally paying attention. You know, the industry has gotten better at detecting stolen credentials and account takeover. But scams are different because the customer is often, you know, authorizing that transaction themselves. So, you know, fraud teams are asking how, how do we detect scams? How do we educate customers and who ultimately bears the loss? Because there's the struggle of, and I faced this whenever I was the practitioner, it's, you know, here I have this, this member that came in. They received a call from someone impersonating our organization and eventually had them log on with these codes or said, hey, what's this code that we're about to send to you? We just want to authenticate to you. But in reality, that was part of the MFA. It was part of them trying to make sure, hey, here's the code was a one time password we've sent out. And then the fraudsters use that information from that phone call and now they've, you know, accessed the account. But that person was tricked or social engineered because they were impersonating the financial institution from the mirrored phone number. So it looks like it was a legitimate one, but that person gave access by giving over the code. So who bears that loss and how do we justify those answers? And then how do we make sure that we are consistently applying it across the board? Because that's where we really mess up in regards to Reg E. If you don't apply it consistently, that's where you have trouble. And so trying to make sure that happy medium or trying to understand how we interpret the regulation is really a big issue. And which again just early insights from that benchmarking survey did find that scams were overwhelmingly identified as a top threat for community banks and credit unions. The other thing that I think is top of mind is the AI opportunity and risk. Community bankers are excited about the potential of AI, but they're also pretty cautious. You know, they're asking how do we deploy AI responsibly, what governance is needed and how do we explain AI decisions to regulators making sure that they are, you know, fully intertwined with whoever their vendor is or their solution provider. And again, most institutions, they don't want AI replacing the humans, but they do want AI augmenting investigators. So, you know, how can we use it to help us to, you know, a lot of times we are fraud fighters of one. I need help. So let me, let me automate a few things. And I think that the overall theme that we always see of course is the doing more with less. You know, because teams are dealing with the growing fraud losses, the faster payments, staffing shortages, budget constraints. Many fraud teams are at or beyond capacity while expectations continue to rise. So fraud isn't growing linear anymore, it's growing exponentially while our resources aren't.
Karisse Hendrick
13:59
Yeah, I think that's something that no matter what side of fraud you're on, whether it's merchant side, banking side, smaller bank, bigger bank, all those things, I think those are challenges that we all face, right, that fraud is growing exponentially and at scale and we don't have new resources, we still have duct tape and bailing wire. We still have to figure it out. No, those are really good insights and things that I think other types of fraud fighters can really relate to. Sometimes we get distracted by the shiny things but at the end of the day, the things that really are creating systemic pain points are, you know, the same old, same old things that we just don't fix or haven't found a way yet.
Hailey Windham
14:43
Very true. I also think that at least from the community banker, credit union side, one thing that I just, I don't know how we get beyond it other than we've got to start pushing back on these core providers, but we are stuck in these legacy cores that won't really integrate well with other solutions that we need and we feel like we can't leave them. Right. We've, we've been with these cores 20, 30 years and it's like, man, it's so scary getting out of that comfort zone. But we have to, in order to, to stay afloat and to stay in front of this fraud problem, we've got to try to be in that proactive, you know, innovative side of the, of the world and where we could be versus being stuck. So that's just another call out that I feel I would be remiss if I didn't mention that the legacy core issue is on the infrastructure. I mean, we've got to get that part figured out so that we can have layered controls and bring in more solutions that can help us augment some of these things.
Karisse Hendrick
15:41
Yeah, e-commerce companies don't necessarily have legacy cores in the same way that banking does, but they do have legacy systems that just aren't detecting the fraud of today as much as they used to. They're not able to see behavior biometrics and device intelligence and the signals that they need to be able to identify things like card testing and enumeration or account takeovers, you know, more sophisticated account takeovers and things like that. So that we can relate to you as well for sure. So one of the things that came out actually as recently as yesterday from when we were recording, but last week from when people are going to listen, is that it was pretty big. I mean, I remember seeing multiple posts about it just, you know, being like, oh my gosh, I can't believe this happened. That FinCEN came out, you know, so that's in the US came out with updated guidance that seems to have kind of reinvigorated and excited people in banking fraud. Can you explain what the updated guidance was and kind of what, why it's such a big deal?
Hailey Windham
16:51
Absolutely. I actually just did a quick little blurb about it in my newsletter and I titled it a little louder for the people in the back. You know, so it happened on June 12, which was my mom's birthday, by the way, Benson dropped. I figured that was important for everyone to know because my mom thinks it's important, but so on June 12, Benson dropped a new fact sheet clarifying how 314(b) actually works. And I mean, I'm here to say I want more fraud fighters to know that this exists, if they don't already, and that they can and should use it. So it wasn't just like a minor tweak. It expands on and replaces the 2020 guidance and directly addresses three things that practitioners have been asking about for years, which are whether real time information sharing is permissible, under what circumstances fraud related information can be shared and how to actually use it. So, you know, I've sat in enough rooms and I've heard enough calls to know that 314(b) information sharing is wildly underutilized. And it's not because people don't care, but because there's been a real confusion about what's actually permissible. There's always just been this fear of being burned by the regulators for sharing information when maybe it wasn't the right circumstance. And I mean, Vincent hurt us, right? So they finally provided that clarity that we've been asking for. And so it's section 314(b) of the USA Patriot Act. It lets financial institutions share information with each other under a liability safe harbor to identify and report potential money laundering and terrorist activity. And now it includes fraud. So the updated fact sheet is something the industry has needed truly for a long time. Practitioners have been asking for that clearer language, clearer permission, and clearer protection. And so what we got clarified are four different things that I want to highlight. And one is that fraud is explicitly now in the scope. So information sharing can cover activity tied to specified unlawful activities, which includes fraud against individuals, organizations or governments, and computer fraud. So you don't need a confirmed money laundering case to share. You just need a reasonable basis to believe that activity may involve money laundering or terrorist activity, which is huge for us. Right? Because again, we've had those scenarios where it's like, man, I just want to call my next door neighbor bank and say, hey, this is what's going on. I know they're 314(b) compliant, but my compliance officer is telling me, hey, they don't share that unless it is for sure following money laundering or has this or that, you know, qualifications. The other thing that this new guidance addresses is now we don't need certainty to, to participate. So this is one that I think that the institutions definitely have to internalize so you don't have to have it all figured out before you pick up the phone. Reasonable suspicion is enough. Sharing early, even on incomplete information is the point. Right. Because how else are we going to get in front of it? The third thing is that real time information sharing is permissible. So this is not just written, not just formal verbal. We can use video surveillance footage, IP addresses, you know, attempted transaction. These are things that are happening in real time that we can utilize in our information sharing to determine, hey, this is kind of suspicion enough, reasonable suspicion enough. All of it is fair game under the safe harbor as long as you've registered and are using the information appropriately. And then the fourth thing is that non bank entities can form associations too, which is huge. Right? Compliance service providers and industry groups can now organize 314(b) associations, meaning that financial institutions don't have to go at it alone. I think that the point of this all is that, you know, fraud doesn't stop at one institution. It moves across your network. Your neighboring credit union, the community bank across the street, any merchant name insert here, you know, they share tactics, they test and they pivot and it's time that we do the same. So the 314(b) now gives us a legal framework to collaborate in real time. And the updated guidance, at least for me, it, it removes the excuses.
Karisse Hendrick
21:07
Hmm, that's great. Is it real? Is it collaboration through like picking up the phone and calling another financial institution? Or, and, or is it collaboration through technology like you know, sharing negative lists, things like that, like on a bigger scale?
Hailey Windham
21:26
Yep. So before it was definitely through the technology we could do that. We could, I remember working through different case management solutions where we could go into the 314(b) section and if we had a joint customer or member that maybe was also a member at a neighboring fi, if they participated through this one case management system, we could communicate through there and that, that case management could let us know, hey, there's a potential that you guys have the same person committing fraud against you. And we would be notified of whenever if say bank A closed an investigation and they closed it for fraud, that's whenever all the other banks, Bank B and C would then get a notification, hey, you've got someone that matches this, that they just had a case that was closed for fraud. Do you want to initiate an information sharing request? But now it says that we can share in real time, meaning we don't necessarily have to wait. We could, we could definitely call and we could say, hey, and one thing that I think about this is like the check 21 systems that we use or the. I can't remember exactly, but whenever we're onboarding and we're trying to look to see, hey, does this person have, you know, financial institutions or whatever? And we can see that one was closed. We don't know the reason they were closed, but we could call. So I'm thinking of all these elder people now who've had their accounts closed because they were participating in investment scams. And the FI did all they could, but now the only option was to close them out. Well, then they go to the next bank. Now the next bank can say, hey, this is a great customer. What happened? Why'd they close? And now it's, you know, we can get that information in real time to know, hey, there was a potential scam and. Or a scam going on, potential fraud. We don't need to, you know, be careful going forward.
Karisse Hendrick
23:11
Is that an acceptable reason for closing an account? So if bank A tells bank B, hey, we just closed this account for John Smith due to fraud, and bank B says, oh, John Smith opened an account last week. Now we want to close the account because bank A told us that his account there was fraud. Are you. Does this guidance give you the ability to cancel if you were bank B to cancel John Smith's account? Or is it more, hey, you have to flag it and then really, you know, scrutinize the behavior and see what it's doing and then close for your own reasons?
Hailey Windham
23:50
Yeah, so those are different things. So the 314(b) is only giving us the ability to share information where we couldn't before.
Karisse Hendrick
23:57
Okay.
Hailey Windham
23:57
The guide. And so that comes on your own. So the financial institutions or a bank is different from a credit union. The bank can close an account for any reason that they want. It's at their discretion. But the credit unions, they operate in a different capacity. Every member is a member of that cooperative. So they can't necessarily close the account, but they can limit convenient services. So convenient services could be debit card transactions, wires, ach, credits and debits. You know, anything that is not necessarily cash in and cash out could be considered a convenient service that the credit union could use. And again, that information sharing is just to let another FI know, hey, we had fraud here. So it just is a way for us to be on high alert for potential suspicious activity.
Karisse Hendrick
24:43
Yeah, because I can see if you used that to close an account based on another financial institution's account or, you know, or what their experience, that that could cause blowback, you know, in the form of lawsuits or in the form of other things where, you know, every financial institution and e-commerce merchant for that matter, have their own criteria of what constitutes fraud. So if you're taking their word for it and you're now shutting down the business, you know, or their access to their accounts because somebody else said that they were done wrong, that would pose more problems than, hey, huge heads up. I think we have this account or this cardholder too. Here's the information I've pulled, but then also here's the information I've pulled and here's what you can maybe not act on, but ingest and then flag. So, you know, hey, if we start to see suspicious activity on this account, that's there's just one more piece of data saying, well, Bank ABC already closed them down for fraud and hopefully you can mitigate your losses.
Hailey Windham
25:51
Yep. It's just another piece of data that can help us act in real time to again, just be more proactive and preventative versus reactive and you know, trying to recoup money or mitigate losses that way.
Karisse Hendrick
26:02
Interesting. So how do you think this is going to change things? I mean, how do you think this is going to impact the industry?
Hailey Windham
26:09
Again? I think that the updated guidance just removes the excuses we had before. So basically it was internally we had fraud fighters who wanted to share the information with other fraud fighters in the industry by, you know, either reaching out or by saying, hey, this is fraud. And now I see that there is other money going to another financial institution like we need to let them know. But in the past it was, hey, this isn't necessarily money laundering, so we can't share this information. It had to meet those criteria. Now we've got it where fraud is a part of that criteria. And again that just reasonable suspicion is now enough, so we can now share that information, whether it's early or even incomplete, as long as we have reasonable suspicion that it is fraud.
Karisse Hendrick
26:55
Interesting. And then as far as, you know, you had mentioned the organizations, you know, trade associations, outside organizations can, can now have these consortiums of sort. Do you think that we'll start seeing some of those pop up as well?
Hailey Windham
27:10
I think so. I think that we, we definitely already have, have some, you know, one in particular that I can think of off the top of my head obviously being Sonar and Sardine. A piece of Sardine is Sonar where there is that consortium data where we can share. So they are 314(b) compliant. I know that there are others that exist. But as you know, when we look externally, if we need to be able to share. And we're looking for a vendor that we can again, either receive more data from other FIs that say, hey, yeah, this is following patterns of fraud. We've got to have those vendors that have, that are 314(b) compliant. So I, I'm, I'm interested to see if there are more that pop up, but I do know that already exist.
Karisse Hendrick
27:50
Okay, I see. I was thinking more, I guess of like trade associations or things like that where they might have an email list or might have, you know, something like where you could upload a Google spreadsheet of your top 20 biggest offenders or, or having roundtable calls where, you know, hey, has anybody dealt with Bob Smith at 1:23 Main, you know, Charleston, South Carolina? Oh yeah, me too. You know, that type of thing. I guess that's what I was picturing.
Hailey Windham
28:18
Yeah.
Karisse Hendrick
28:19
But it's good that, you know, vendors like Sardine are 314(b) compliant so that they can just do it for you so the banks don't have to worry about integrating with each other one by one by one. Because that would be, it would take forever and it just wouldn't be sustainable. It wouldn't be scalable.
Hailey Windham
28:39
Yeah, so I pulled up that, that piece of it. So it does state who is eligible to participate in this information sharing and associations consisting of the financial institutions listed above. So. Yeah, you're exactly right. So if we think, you know, ACFE, we think the ACFCs, the IECECI, which I know the IFCI already does information sharing for the 314(a), which is with law enforcement. So being able to expand that with the 314(b) is really cool. As well as any of the other associations, maybe even the Knoble. That's one that would be really cool to start seeing some information sharing coming from. So. Absolutely. I think it opens it up.
Karisse Hendrick
29:20
That's exciting. And I get why everyone was freaking out about it yesterday.
Hailey Windham
29:24
Yeah. Because it's, it was like finally.
Karisse Hendrick
29:26
Yeah, yeah. It kind of came out of the blue and you know, it's six years later and a lot has happened in the world of fraud in the last six years and, and you know, there's just so much going on that it's important that the government catch up.
Hailey Windham
29:40
You know, I think that you just made another valid point. I think that, you know, there are some nonprofits that we are familiar with as well that I hope that they become more involved in these association type things so that they could share that information too. I think that'd be one of those things that would just be phenomenal. The one in particular I'm thinking about, of course, is Operation Shamrock, where they are constantly receiving information on accounts, you know, that are, have either, you know, facilitated the money movement or participated in it in some way. And it'd be great to get some information coming back from organizations like that. So I think that's great. You know, if we could get them involved in some of these associations to then share, that'd be really cool.
Karisse Hendrick
30:20
Yeah, that's a good idea. I hadn't actually thought of that, but yeah, it'd be great to get them involved because, you know, they're seeing it on the ground from the victim before it's hit law enforcement or bank, you know, their bank or anything else like that.
Hailey Windham
30:36
Yeah, I just think about, like the way that they are already communicating and like some of these crypto platforms that are already communicating with law enforcement to say, hey, here's, here's a wallet that was used. Can we get an investigator on it? Imagine being able to do that as well. For the financial institutions with the information sharing. It's a phenomenal approach.
Karisse Hendrick
30:55
Yeah, no, that's. That would be great.
Hailey Windham
30:57
Yeah.
Karisse Hendrick
30:57
Well, that's exciting that they're moving forward. I know that there's been some forward movement from the Department of Justice on, you know, trying to prosecute some of these cases. I know that Google just filed lawsuits against, I believe it was Chinese nationals that owned a phishing platform called Outsider that was responsible for. Let me look at my notes because it was a crazy number, but it was responsible for the theft of over 3.87 million credit cards. And it was like over $1.9 billion in losses. And it was this one channel on Telegram that provides all the phishing resources you need. Right. Like to create a fake website or if you need hundreds of phone lines or, you know, whatever you need, they can provide it. And while law enforcement isn't going after them, Google is. So, you know, that's a start too. But you know, I was, as I was saying the Department of Justice has been cracking down more on fraud situations and these large scale operations. And I think the combination of that along with FinCEN saying, okay, fraud's bad enough. Now where we need to clarify this 314(b) and say you guys are good to communicate these things. And in Europe they have GDPR and one of their exceptions is for fraud as well. You know, hey, you need to keep things, you know, very private. But if it, when it comes to fraud, you, you can pursue that. So, you know, you can share Information as well is really what, you know, they say gdpr, you can, you can also cancel accounts due to GDPR due to fraud under GDPR as well. So it's, it's nice to see some of these governments catching up. I mean, I think that there's a long way that we can go, but it's nice to see, you know, them catching up and maybe listening to the industry too, who's just been saying the same thing over and over again.
Hailey Windham
32:55
Absolutely. I would like to give a bit of clarification on the onboarding piece that I was mentioning earlier. Yeah, I feel like I maybe missed a piece of like the conditional aspect of that. So I'll give kind of a scenario for it. If you think about like a community bank is onboarding a new business customer and they notice, you know, know, multiple identities that are tied to maybe the same device, suspicious IP addresses, connections to the known mule activity, and that the fraud indicators are kind of suggesting that it's maybe synthetic identity or account abuse. The bank could potentially contact another FI under 314(b) and ask, you know, we are evaluating whether to establish an account relationship with XYZ llc. Have you observed activity involving this entity that may relate to fraud, money laundering or other specified unlawful activity? And the, the reason why is to, it's especially relevant because the 314(b) explicitly allows sharing information to determine whether to establish or maintain an account or engage in a transaction. You know, FinCEN has long recognized this use case and the 2026 guidance further clarifies that suspected fraud falls under this scope. But again, there are the four conditions. One is that both institutions must be registered for 314(b). So you simply, you can't just simply call any bank, right? You need to verify that they're registered participants. There also has to be that reasonable basis for suspicion. So this is not intended for like routine due diligence or tell me if this customer is good. There should be fraud, AML or illicit activity indicators.
Karisse Hendrick
34:36
Okay?
Hailey Windham
34:36
Fenceland does not require that certainty, but it does require the reasonable basis. The third thing is that the information must be used only for permissible purposes. So, such as identifying illicit activity, whether to establish or maintain an account, and then the supporting of AML compliance. And then the fourth thing was you still cannot disclose sars or reveal that a SAR was filed. So you can't say, you know, we filed a SAR on this customer. But what you can say is we've observed activity consistent with mule behavior and suspicious transfers. So again, I think that I suspect that we'll See more formalized 314(b) on boarding request emerge especially for those suspected synthetic identities, business account fraud mule activities, high risk fintech relationships and any kind of like first party fraud rings. I think historically, right, many FIs were hesitant to make these calls because they viewed 314(b) as strictly AML terrorist financing. But the new June guidance explicitly clarifies that fraud may encourage more proactive collaboration. So I just wanted to make sure that I called that out because I felt like maybe I was a little too broad in that earlier example.
Karisse Hendrick
35:52
Yeah, no, it's interesting. It kind of makes my brain go two different directions. So one of them is, you know, we have something similar in the credit card processing world on the acquirer side, which is called the match list. And whenever a new, but this is more. I mean you had said that it's not to replace, you know, it's not to be in your SOPs, right. It's not supposed to be every single time. But in this case whenever some, an organization or an entity applies for credit card processing, the credit card processors have to go out to the match list and see or it's also called TM math list. I think that you know, to see if they've been shut down for fraud before, you know, they've had their account, their merchant account closed for suspicious reasons or confirmed reasons. The other thing that made me think of was just how, how it will really be helpful to a lot of companies to be able to, you know, validate themselves. Right. Like hey, we're seeing this suspicious behavior. Is it really as suspicious as we think? What does the other bank see from the other perspective getting all of that information? But one of the other things I see is do you think this is going to require more manpower on the financial institution side or can it be done with aging? You know, I mean as far as the manual piece of calling up another bank or sending them an information request or whatever it is. Or are you, are we just talking about using vendors that are 314(b) compliant that would say hey, go to your vendor in these cases, I guess just what's the workload on that like? Or do you know?
Hailey Windham
37:36
Well, I can just say from my personal experience, I think the workload probably going to be about the same for most fraud fighters because we were, we like to skirt the line because we felt like we needed to be proactive in that and Right. Would just face the repercussions from our compliance team. So I'll say that. But I do think, you know, you mentioned agents. I don't think that agents will be the ones responding or requesting the information, but I do think that they will be escalating those for review for the investigators to look at. Like, hey, this one, like, maybe we do onboarding and, you know, we're trying to do the due diligence. And then something just seems odd. It's flagged as, you know, potential synthetic identity, or, hey, this business was just opened and just established. Like, but we do see that there are other financial institutions attached. Something seems kind of odd here. Why are they opening up another account at another FI? You may want to reach out. And so just with all the indicators, again, utilizing behavioral biometrics, too, to say, hey, this device just kind of is doing some funky things. Maybe we just need to reach out and ask the other FI. Hey, we think that something's kind of suspicious going on. Can you confirm? Are we going crazy, or do you see the same thing? And so then it just becomes that collaborative effort that fraud needs anyways in order for us to be effective.
Karisse Hendrick
38:54
That's great. Well, thank you for coming on and explaining that in more detail. I think it will be interesting to people in the financial institutions in case they didn't see the update guidance or maybe they didn't fully understand the fine print. But I also think it's interesting for, you know, online merchants or, you know, other sectors of fraud prevention because we're able to say, hey, you gave banks permission to do this, so, you know, I would like to also have permission to do this. Or, you know, how can we do this in a different way? Now, there are some fraud tools that have consortiums within them. They only will apply to the other merchants that use that same fraud technology. So there's not, you know, but usually merchants, while they're not regulated and they don't have FinCEN over them, their privacy officers or their legal team will say, no, no, no, don't be sharing any of that information, you know, on a phone call or in an email or anything like that. So similar issues on both sides as far as, you know, sharing information. And it's always very frustrating that fraudsters have no hoops they have to go through. They don't have any of these guidelines or, you know, laws or rules or privacy officers or anything else. But it's what we have to do to play by the rules and, you know, that we're given and. And do the best we can.
Hailey Windham
40:20
I agree completely. I'm so excited, though. I think that we're finally. The industry's finally moving in the right direction. Right. We're finally there where everybody is, starting to pay attention now to fraud, which is why I think, you know, I'll call it back out of the benchmarking, I think is just so important. But also just the way that you show up in your organization. I think culture's everything. Making sure that you show up consistently. I'm the fraud person. We've gotta, you know, have this, you know, the way that we conduct business. We wanna be consistent and we wanna make sure that when people reach out, they're gonna get the same Hailey that they get all the time. Otherwise, it's hard to build relationships that way. So I think in fraud, it's super important because you have one time to be too passionate and then you lose the buy-in from executives. So just making sure that you are consistent in your approach to how you have those conversations internally.
Karisse Hendrick
41:15
That's a great note to end on. Well, Hailey, thank you again for joining me on the OG Fraudology podcast.
Hailey Windham
41:23
Always. My favorite podcast.
Karisse Hendrick
41:25
Oh, I always enjoy our conversations whether they're on air or off air. But I will, I think everyone knows how to find you. You're most active on LinkedIn, but I will try to remember because I haven't been good about this the last few guests, but I will try to remember to put a link to your LinkedIn in the show notes. But people can find you just looking up Hailey Windham. I think you're the only one that's in fraud, so you're easy to find.
Hailey Windham
41:50
Okay, good. Yeah. Thank you again so much for having me on and for letting me talk through this. It was a topic that I was already really excited and geeking out about. So when you reached out, I was like, for sure, we can talk about it. So. Always happy to have a conversation.
Karisse Hendrick
42:05
I'm glad I wasn't assigning you a research project like I accidentally did to Frank.
Hailey Windham
42:09
Oh, no. Well, I'm sure he dove into it anyways.
Karisse Hendrick
42:13
He did. Head first, but I felt bad. I thought he already knew about it. So I was like, hey, can we talk about it this? And he was like, sure. And then he tells me I did a whole, I researched it all weekend. And I'm like, oh, no, I thought you knew. Oops. All right, well, I will talk to you again soon. And to everyone else, I will talk to you again next week.
View full transcript
