#12028 min
FRAUDFORWARD
#121Fraud Controls Are Everywhere. So Where’s the Accountability?
28 min
What’s up fraud fighters, and welcome back to Fraud Forward!
I want to talk about something that might be a little uncomfortable. It isn’t about a new scheme or a criminal using AI to break into a bank. It’s about our own fraud controls, and the gap between having them and knowing they work.
Two stories from the past week made me want to have this conversation. The first is a $350 million penalty against American Express National Bank tied to deficiencies in its BSA and AML program. The second is a guilty plea from a former TD Bank employee who admitted to accepting bribes and helping launder more than $4.8 million. The facts are very different, and neither institution looks like a community bank or credit union with a fraud team of two. Even so, the same questions show up at every size. Does your risk assessment reflect the business you run today? Who reviews the people with the power to override a control? And when someone finds a weakness, who makes sure it gets fixed?
I’m also bringing in what we’ve learned from our financial institution fraud benchmarking research, because it points to a question I keep returning to. What does a mature fraud program actually look like? Let’s get into it.
What you’ll hear in this episode:
- Why the American Express enforcement action is a lesson in fraud risk assessment, and what happens when an assessment focuses on a narrow part of a much larger business
- Why the roughly $13 billion in suspected activity cited by the OCC reflects deficiencies in a BSA and AML program, and why it shouldn’t be repeated as a fraud loss
- How a former TD Bank employee allegedly used legitimate access to unblock restricted cards, and why employee override monitoring deserves more attention than it gets
- What 86 accounts at one commercial address teach us about transaction monitoring and what should happen after an alert fires
- Practical ways smaller teams can use compensating controls when they can’t fully separate duties
- Why documenting a known control weakness is not the same as managing it, and how remediation tracking can quietly stall
- A simple framework that separates control existence vs execution vs effectiveness
- Metrics that show real exposure to leadership, beyond alert counts and cases closed
- Five questions to bring to your fraud team on Monday
You should listen to this episode if you:
- Lead or support a fraud program at a community bank or credit union and have to cover a lot of ground with a small team
- Want to know whether your fraud risk assessment is driving decisions or only documenting them
- Are responsible for managing insider risk or employee access and want practical ways to review overrides
- Need help explaining known control weaknesses to leadership in a way that leads to action
- Are comparing your program against peers and want to know what a mature fraud program looks like
Episode notes
A $350 million penalty and a risk assessment that missed the business
The OCC said American Express National Bank had not tailored its BSA and AML risk assessment to the business it was actually running. The assessment concentrated on a narrow piece, demand deposit accounts, and gave far less attention to the much larger credit and charge card operations. A risk assessment that doesn’t match the business produces controls with blind spots. At a community bank or credit union, the same thing can happen when ACH volume doubles or a new digital account opening process launches and the assessment still spends most of its pages on debit cards. My challenge is to ask when your fraud risk assessment last changed a decision, because that tells you whether it drives your program.
The insider who unblocked the cards
According to the DOJ, a former TD Bank employee used his position to open fraudulent accounts, issue hundreds of debit cards, and lift restrictions on cards the bank had blocked over potential fraud. An override function isn’t a problem on its own, since every institution needs an exception process. What matters is who reviews the override, whether the person who starts it can also approve it, and whether anyone looks for patterns. Insider fraud also includes selling access or looking the other way, and not only stealing, which is why I want teams spending as much effort understanding employee behavior as customer behavior. For smaller institutions that can’t separate every duty, compensating controls such as a second reviewer for high-risk overrides or a weekly exception report can make misuse much easier to notice.
Documenting a weakness is not managing it
Looking back at the 2024 TD Bank enforcement case, roughly 92% of the bank’s transaction volume went unmonitored by its automated transaction monitoring system over several years, according to federal prosecutors. A pattern I recognize from institutions of every size is that a weakness gets identified, logged, rated, and scheduled for discussion, and then sits there. There can be good reasons remediation takes time, and knowingly accepting a risk with oversight is a legitimate decision. Leaving it open because nobody owns it is an accountability problem. I encourage fraud leaders to explain exactly what activity is not being monitored and what a delay could mean, since leadership makes better decisions when the stakes are clear.
What a mature fraud program really looks like
Our financial institution fraud benchmarking work gathered input from 165 credit union and community bank fraud leaders. Many reported formal risk assessments, alert prioritization, and false positive tracking, which is encouraging. I also want to push on it, because having a control isn’t the same as having an effective one. A wire verification step can be completed perfectly and still fail if the callback goes to a number a fraudster just changed. A 98% alert review rate tells you about process completion and says nothing yet about whether detection worked. This is why I want fraud metrics for leadership to show exposure, such as how much activity monitoring covers and how much confirmed fraud was found internally first.
Accountability without a blame hunt
When something goes wrong, attention usually goes to who failed. Individual accountability matters, but I would rather we build programs where people can raise concerns and challenge decisions before a loss occurs. An analyst who raises the same issue three times and sees nothing change will eventually stop speaking up, and leaders are responsible for that environment. When a control depends on several departments, I also ask teams to get specific about fraud control ownership. Who owns the risk, who owns the control, who tests it, who receives the findings, and who makes sure something changes? Those are five separate responsibilities, and they don’t always belong to one person.
Five questions I’d ask my fraud team on Monday
Five practical questions to think through. What are we not monitoring? Who can override our controls, and who reviews those overrides? Which controls have we tested recently? What known weaknesses are still on our list? And what are our fraud losses telling us about our controls? The last one is where fraud loss root cause analysis comes in. Tracing your largest cases back to the controls that should have prevented or detected them shows whether you are an organization that investigates fraud or one that learns from it.
Key takeaways
- A fraud risk assessment is only useful when it reflects the business as it operates today and changes decisions.
- The roughly $13 billion cited in the American Express action describes suspected activity tied to BSA and AML program deficiencies, and it is not a fraud loss figure.
- Employee overrides deserve independent review for patterns, and monitoring that activity is part of sound control design and not an accusation.
- When segregation of duties isn’t possible on a small team, compensating controls such as a second reviewer for high-risk overrides or a weekly exception report can still limit how much one person can do unnoticed.
- An alert is the start of a process, and the outcome depends on what happens after it fires.
- Documenting known control weaknesses does not reduce exposure until someone owns the fix.
- A control can exist and be executed without being effective, so ask what evidence shows it reduces risk.
- Metrics such as monitoring coverage, override frequency, and internal detection rates tell leadership more about exposure than alert volume alone.
- Ownership of a fraud control should cover the risk, the control itself, the testing, the findings, and the follow-through.
- Tracing large losses back to their controls turns fraud investigation into fraud program improvement.
Final takeaway
A risk assessment doesn’t reduce exposure because someone completed it. An alert doesn’t prevent fraud because it fired, and a control isn’t effective just because it exists. My challenge for this week is simple. Pick one control you trust, then ask how you know it works, what evidence would prove you wrong, and who is responsible for acting if it doesn’t. If you can answer all three, you’re already having a stronger conversation about fraud program maturity than most. If you can’t, now you know where to start.
Episode resources & links
Connect with Hailey Windham, CFCS | LinkedIn
Host of the Fraud Forward Podcast
Banking Community Lead at Sardine
Certified Financial Crimes Specialist (CFCS)
2023 Credit Union Rockstar, CU Magazine
Continuous Improvement Award, SAFE Federal Credit Union, 2023
Top 20 Professionals Under 40, The Sumter Item, 2022
Episode transcript
Hailey Windham
00:05
What is up fraud fighters and welcome back to Fraud Forward. If my voice sounds a little scratchy today, blame it on football. It's not a cold. It was a big football weekend for me. So, first my nephew was cleared to come back from his injury in time for his homecoming game. And his team won 41 to 28. But my favorite moment came on defense. He was playing linebacker. He intercepts the ball and my voice has not been the same since. Then there's the rest of the weekend, and I'm not sure how many SEC fans I have listening, but South Carolina went into Ben Hill Griffin Stadium and beat the number 16 Florida Gators 38-19. LaNorris Sellers had a career game. Dylan Stewart came back from suspension and anchored a defense that kept forcing turnovers. And Florida's strong start to the season got derailed. We've had a few rough weeks for Carolina football. So, this was one overdue. And my voice is now paying for it. If you're a Florida fan, I'm so sorry. And also, not really. So, if I sound like I've been yelling at a television, I have. Um, and I'd do it again. Consider the scratchy voice a limited time production feature. Okay. Now, let's talk about why we're really here. I'm flying solo again today and I'm going to ask you something that might make you a little uncomfortable. It isn't about a new scheme or a criminal using AI to break into a bank, right? But it's about our own fraud controls and the gap between having them and knowing that they work. You know, if I walked into your institution tomorrow and asked to see your fraud controls, you'd probably pull up your fraud risk assessment, hopefully. Uh, your transaction monitoring system, your policies and procedures, your alert dashboard. And maybe the board deck from the last quarter with, you know, loss numbers, alert volumes, and investigation stats. All of that matters. But if I asked how, you know, those controls are working, I wouldn't want to hear what the procedures say should happen or what the vendor told you in a demo. So, two stories from the past week made me want to have this conversation. On October 8th, the OCC announced a $350 million penalty against American Express National Bank for deficiencies in his bank secrecy act and anti-money laundering program. 2 Days earlier on October 6th, the Department of Justice announced that a former TD Bank employee pleaded guilty to accepting bribes and helping launder more than $4.8 million. Some of you are thinking those are huge institutions.
Hailey Windham
02:32
You know, we have like 12 people on our fraud team or maybe two. But the problems in these cases show up at every size. Controls that don't match the actual risk, overrides, nobody scrutinizes, warning sides, you know, signs sitting in the data that never turned into action, and nobody asking the right questions until after seeing something goes wrong. So today we'll go through both those cases, talk about where accountability begins, and then get to some things you can take back to your own program. I'll also bring in our financial, you know, institution fraud benchmarking work. Because it raises a question I keep coming back to. What does a mature fraud program actually look like? And guys, that fraud benchmarking report releases this week. Oh my god, I'm so excited. Like, cue the the confetti and the party balloons. I am just over the moon, so excited about this benchmarking. And I can't wait for you guys to dive in. So, but for now, let's just get into these stories. Okay, so we're gonna start with the American Express. On October 8th, 2026, the OCC announced a $350 million civil money penalty and a cease and desist order against American Express National Bank. The Federal Reserve announced a related action involving American Express entities. So, the $350 million got the headlines, but the number that I want to focus on is 13 billion. According to the OCC, failures in the bank's suspicious activity monitoring and reporting meant roughly $13 billion in suspected trade-based money laundering activity wasn't timely identified, evaluated, and sufficiently reported over about a decade. To be clear, that's the amount of suspected activity tied to the reporting failures. It isn't a fraud loss figure. So please don't repeat it as one. You know, the regulator also cited problems with resources, staff expertise, internal controls, independent testing, and training. But the finding that stuck with me is that the bank hadn't tailored its BSA and AML risk assessment to the business it was actually running. The assessment concentrated on a relatively narrow piece of the business. You know, demand deposit accounts and gave too little attention to the much larger credit and charge card operations. The risk assessment didn't reflect what the exposure was. That's why I keep teaching on fraud risk assessment. It it it isn't a document that you pull out once a year, update the dates on it, nudge a few ratings on. And you know, and then shove it, right? It's supposed to tell you where you're exposed and where your resources should go. And you can't manage a risk that you haven't taken the time to understand. At a community bank or credit union, it plays out like this. You have a strong debit card fraud program. You've spent years tuning the rules. You have a good platform and your team knows card patterns, cold. You know, meanwhile, your a volume has doubled.
Hailey Windham
05:18
You launched digital account opening. You raised transaction limits. And you added new ways for members to move money. And your risk assessment still spends most of its pages on debit cards. At that point, you're assessing the risk you were comfortable with two years ago. Not the risk that you have today. So, who's responsible for noticing that your risk profile changed? The fraud team, the BSA officer, digital banking, enterprise risk, the people who approve new products, the board? You know, I think responsibility is shared, but shared can't mean that nobody is ultimately accountable. Somebody has to own it. One caveat, the American Express action was about BSA and AMO compliance, which is different from consumer fraud prevention. The operational lenses carry over though. If the risk assessment doesn't match the business, the controls built on it will have blind spots. If resources aren't there, well-designed controls fail in operation. If independent testing never challenges whether controls work, you end up with false confidence. And if nobody connects those dots, the exposure can sit for years. So, my first challenge, when was the last time your fraud risk assessment changed a decision? Did it move a transaction limit, change a detection rule, justify another investigator, push back on a product launch, or get a risk escalated to leadership? If you can't point to anything, it's worth asking whether the assessment is driving your program or just documenting it. And that's going to bring us to our second story, where the controls weren't just insufficient. According to federal prosecutors, an employee was working around them. So, we're going to talk about the insider who unblocked the cards. On October 6, the Department of Justice announced that a former TD Bank employee pleaded guilty to conspiring to launder money and to accepting bribes as a bank employee. According to the DOJ, between April of 2022 and November of 2023, he used his position to help move about $4.8 million out of the United States to Colombia. Prosecutors said he opened fraudulent accounts, issued hundreds of debit cards to co-conspirators, and unblock debit cards the bank had restricted over potential fraud. The bank restricted those cards for a reason, and an employee was able to lift the restriction. So, an override function isn't a a problem itself. There are good reasons for employees to lift restrictions, and no institution runs without an exception process. What matters is what happens when that authority gets used. Who reviews the override? What justification is required? Can the person who starts it also approve it? Does anyone look for patterns? Can one person exercise that authority again and again without drawing additional scrutiny? One detail from the DOJ announcement was that this employee opened 86 customer accounts using the same commercial address in Miami. And those accounts were used to launder more than $3 million. I don't have the bank's internal monitoring record, so I can't tell you which alerts fired or who saw them. And that's a distinction that I think really matters.
Hailey Windham
08:22
But as an investigator, 86 accounts at one commercial address raises an obvious question about whether we look for that. And what happens when we find it. Maybe you have a rule for multiple accounts at the same address. Does it separate a residential address from a commercial mailbox location? Does it catch unusual account opening velocity? Can someone review the relationship between those accounts? An alert isn't a control outcome. It's the start of a process and the outcome depends on what happens next. That applies across the whole life cycle. So, account opening, identity verification, account maintenance, transaction monitoring, card management, employee access, exception handling, and investigations. If each team owns its piece and nobody looks at how the pieces connect, things slip through. The other number, according to prosecutors, was that he received more than $8,000 in bribes. While more than 4.8 million move through the scheme. I think about that when we talk about insider risk. We tend to picture an employee stealing from the institution. Insider risk also includes someone selling access, using legitimate credentials to make illegitimate activity possible, approving the exception, or looking the other way. We put a lot of energy into telling legitimate customer activity apart from fraud. How much do we spend analyzing the behavior of our own employees, though? I'm not suggesting we assume that anyone is dishonest. We shouldn't. But access creates risk and access nobody monitors creates opportunity. So, when did you last review employee overrides? Not a random sample to confirm someone wrote down a reason, but a look for patterns. Which employees do the most overrides? Do certain people keep overriding the same restrictions? Are exceptions clustered around particular customers or accounts? Does someone independently review the unusual ones? And if an analyst spot suspicious employee behavior, do they know where to escalate it? That's a partnership across fraud, information security, internal audit, HR, compliance, and leadership.
Hailey Windham
10:26
One department can't own all of the insider risk, but somebody has to own the process that makes sure it gets handled. For smaller institutions, that's hard. You may have one person overseeing fraud, BSA, and investigations. And limited ability to separate duties. I get it. I live there. You don't necessarily need a new department, though. Identify the activities that carry the most risk and put compensating controls around them where segregation of duties isn't possible. That could be a second person reviewing high-risk overrides, a weekly exception report, or a comparison of account restriction changes against employee access logs. The goal is to make it hard for someone to repeatedly misuse authority without being noticed. And to make sure someone acts when the behavior looks suspicious. So, moving on. You know, the this guilty plea took me back to the major TD uh bank enforcement case from October 2024. Because the lessons there are too important to skip. In 2024, TD Bank pleaded to violations involving its anti-money laundering program and other offenses. And the combined government resolutions exceeded $3 billion in penalties. According to the Department of Justice, the bank failed to update its transaction monitoring program to address those known deficiencies, emerging risk, and new products and services. Federal prosecutors say roughly 92% of the bank's total transaction volume went unmonitored by its automated transaction monitoring system between January 2018 and April 2024. That's approximately $18.3 trillion in activity. The DOJ also described a long-standing practice of keeping costs flat while risk in the business changed. And authorities documented concerns that have been identified but not adequately addressed. That last part happens at institutions of every size. Somebody recognizes a problem, an analyst raises it or it comes out of an audit, your risk assessment, a vendor or your BSA officer. It gets documented, you know, added to like a tracking spreadsheet and even given a risk rating. A meeting is scheduled. And and an action item is created. Six months later, guess what?
Hailey Windham
12:36
That same risk, it still is on the list. There can be legitimate reasons. Remediation takes time. It could be budget, technology limits, competing regulatory priorities, system dependencies. I've worked in financial institutions, and I know you can't fix everything at once. But knowingly accepting a risk with appropriate oversight is a risk management decision. Leaving a known weakness open because nobody took ownership is an accountability problem. So documenting a problem isn't managing it. You can have a beautiful issue tracking system. Color-coded findings, owners and deadlines, and an impressive board report. And if the weakness is still there, so is the exposure. Fraud doesn't run on your quarterly review schedule. The fraudster doesn't care that your remediation project is in next year's budget or the risk committee didn't meet until November. So fraud leaders need to get better at explaining what an unresolved weakness means. You know, we need to upgrade our monitoring. That quote doesn't tell leadership much. Tell them what activity isn't being monitored. Which losses or suspicious patterns could go undetected. How many transactions fall outside of current coverage. What temporary controls could reduce the exposure. And what happens if the weakness stays open. Ownership gets a lot more real when everyone understands what they're deciding. So, that brings me to something I've been working on for a while, and that's our financial institution fraud benchmarking report. Again, let me just go. Unfortunately, my voice took away that really impressive, giddy scream that I wanted to have for you. But this all started with a question that I kept hearing from fraud leaders, especially at credit unions and community banks. How do we know how we're doing compared to our peers? That's harder to answer than it should be. Institutions track different metrics, define losses differently, organize teams differently, invest in different technology, and calculate prevented losses in different ways. When leadership ask how your program compares to other to another institution your size, many fraud leaders don't have a reliable answer.
Hailey Windham
14:44
And that's a big part of why we build this research. We gathered input from 165 credit union and community bank fraud leaders. The early findings showed widespread use of proactive or mixed detection strategies. Formal fraud risk assessments were common for these 165 leaders. And so were risk-based alert prioritization and tracking of false positives. On the surface, that is encouraging, but I want to push on it a little. Having a formal risk assessment doesn't make a program mature. Having a detection platform with hundreds of rules doesn't mean the controls are effective. Tracking false positives doesn't mean you use that information to improve operations. I find it helps to separate three things. Control existence, control execution, and control effectiveness. Existence means you've established a control. Like a rule that flags suspicious check deposits, dual approval on certain transactions, identity verification at account opening, or additional review before a suspicious wire goes out. Execution means the process actually happens. The rule runs, the approval is completed, the verification takes place, the wire is reviewed. Effectiveness asks whether the control reduces the risk it was designed to address and what evidence supports that. Take a wire example. You require additional verification before certain high-risk wires are released. You have the procedure. You've trained the staff and the records show the verification step was completed. On paper, that looks good. But what if the employee called a phone number that an account takeover fraudster had just changed? What if the customer is being coached through the verification questions? The procedure is followed perfectly and the control still isn't separating legitimate wires from the fraudulent ones. The control exists and is executed, but it isn't effective. The same goes for detection rules. Say your debit card system generated 10,000 alerts last month and your team reviewed 9,800. A 98% review rate sounds impressive. But what if most of your fraud losses came from the activity that never generated an alert. Or the alerts that mattered were reviewed after the money was gone? That 98% tells you about process completion. It doesn't tell you whether detection or prevention worked.
Hailey Windham
17:00
This matters when we talk to leadership because fraud teams tend to report what's easiest to count. Alerts generated, cases closed, cases per investigator, fraud losses, false positive rates, those have value. We also need metrics that show exposure. How much of our transaction activity does fraud monitoring actually cover? How often are controls overridden? What share of confirmed fraud did we detect internally before a customer reported it? How long did it take us to identify the activity and how long to act? How much money had moved by the time we responded? How often do we find the same control weakness across multiple cases? And when we change a control, can we show whether the change produced a better result? That's the maturity conversation I want fraud teams to have. Not how many tools you own, how many policies are in the manual, or how many alerts you cleared last month. But how well your controls address your risk and how you know. Okay. Now, accountability, which is where this conversation can go sideways, right? When something goes wrong at a financial institution, attention goes to who failed. Who approved it, who missed the alert, who should have caught it. Individual accountability matters, and employees who intentionally abuse their authority should be held accountable. But I don't want the takeaway to be that we need someone to blame every time controls fail. I'd rather we build programs where people can identify weaknesses, raise concerns, and challenge decisions before something goes wrong. Picture the analyst who notices a certain type of fraud keeps slipping through. They've raised it three times, documented the patterns, and recommended a rule change or an added review step. And nothing happens. Eventually, they stop bringing it up. Usually, that's not because they stopped caring. They just learned that pointing out problems doesn't change anything. That's a dangerous place for a fraud program to be. And leaders, myself included, are responsible for the environment we create. Do we want our teams to tell us when something isn't working? Or do we want to hear that the numbers look good? Do we reward people for finding control gaps or make them feel like they're creating extra work? When an investigator questions an established procedure, do we listen or say that's how we've always done it? And you know, you've heard that. I have a strong view here. A mature fraud program challenges its own controls because fraudsters do it every day. They test transaction amounts, timing, account restrictions, and verification procedures. They look for inconsistencies between channels and learn which barriers are hard to get around and which are easy to manipulate.
Hailey Windham
19:38
We should be just as curious about our defenses through structured authorized testing, you know, scenario reviews, control validation, data analysis, post incident investigations, and conversations with the people doing the work. There's another accountability problem when a control depends on several departments. Digital banking owns the system configuration, operations owns the transaction procedure, and the fraud team watches alerts. IT owns access permissions and compliance own certain reporting. Everyone does their job, but who owns the end-to-end risk? Who makes sure a change in one department doesn't open a gap in another? And who can escalate when it can't be resolved at the operational level? So get specific about ownership. Not just who manages the tool, but who owns the risk, who owns the control, who tests it, who receives the findings, and who makes sure something changes when the control isn't effective. Those are five different responsibilities, and they don't always belong to the same person. If your organization can't answer those questions, I would start there. [Ad Break (20:43): Frauders, if you're anything like me, your list of things to read keeps growing. Your time to read them though, probably not so much. That's why I write the Monday fraud fix. It's the newsletter companion to Fraud Forward. So, every Monday I'm sharing fraud trends that made me pause, what I'm reading, conversations happening in our community, and the fraud fighters that I think you should know. I also bring my take. You know, what it means for the people doing this work, and the questions we need to be asking. Every now and again, I might leave you a little Scooby snack to start your week. You know, I just can't help myself. You can find the Monday fraud fix on Substack. Or tap the link in the episode show notes and subscribe. I'll see you in your inbox, fraud fighters.] Hailey (21:23): So, here are five questions that I'd ask my fraud team on Monday. What are we not monitoring? It sounds obvious, I know. But we spend our time evaluating the alerts our systems generate. And much less on the activity that never gets evaluated at all. Are there gaps by transaction type? Are certain products excluded? Do some rules only run at certain hours? Is monitoring consistent across all channels? What happens when we launch a product or raise a limit?
Hailey Windham
21:52
When did we last reconcile actual transaction activity based on our monitoring coverage? I'd rather learn about a blind spot today, than in a post-loss investigation. Okay. Question two. Who can override our controls and who reviews those overrides? This comes straight from the TD Bank employee case. Look at account restrictions, card blocks, transaction limits, identity verification exceptions, account maintenance, and high-risk approvals. For each one, ask whether access is appropriate. Exceptions are documented and unusual patterns are independently reviewed. That means looking at how permissions are used, not just who has them. If one employee handles a disproportionate share of overrides, that doesn't mean something suspicious is going on. Maybe they're your most experienced person. It's still a reason though to understand the activity. Monitoring employee activity isn't an accusation. It's part of sound internal control design. Question three, which controls have we tested recently? I mean tested, not reviewed. When you change a fraud rule, did you validate what it catches and what it misses? Can you run historical transactions through the logic to find gaps? When you update account opening, do you check it against known fraud patterns? When you add an approval requirement, do you test whether it can be bypassed or completed without a real verification? Smaller institutions may not have a testing team. Start with your highest risk control. Define what success looks like. Review a sample of relevant activity. Document what you find. Make changes and test again. You don't need a massive project to build control validation into your program. Question four. What known weaknesses are still sitting on your list? This one might be my favorite. Pull out your fraud risk assessment, audit findings, unresolved system issues, enhancement request, and reoccurring investigation problems. I bet you can find at least one item everybody knows needs attention. Who owns it? How long has it been open?
Hailey Windham
23:54
What's the actual exposure? What are we doing in the meantime to reduce the risk? Does leadership understand and accept what remains? What would it take to fix it? Sometimes leadership isn't ignoring the problem. We just haven't explained in a way that makes the consequences clear. Our system needs better monitoring is a technology request. We have a high-risk transaction type with incomplete monitoring coverage and here's what that means for the institution is a risk management conversation. And one that will definitely get the ears of leadership. Finally, question five. What are fraud losses telling us about our controls? We report losses constantly, but how often do we trace them back to the controls that should have prevented or detected them? Take your 10 largest fraud cases from the last quarter or 20, you know, if you have the capacity. For each, ask what happened, what should have detected it, whether a control triggered and what happened next. If nothing triggered, why not? Was did there an employee override? Did a customer action change the outcome? Was there a chance to intervene? And what changed afterwards. Not every loss is a preventable control failure. Sometimes the right controls are in place. People follow the process and a sophisticated scheme still succeeds. Prevention isn't a promise of zero losses. But if the same weakness shows up in several investigations, that's a pattern. And patterns should shape your risk assessment, your controls, and your strategy. That's the difference between an organization that investigates fraud and one that learns from it. Okay, closing it up now. The American Express action and the TD Bank Insider case have very different bags. One centers on serious deficiencies in a BSA and AML program. The other involves an employee who plead guilty to abusing his access and taking bribes while facilitating money laundering. As a fraud practitioner, what I see in both is how much it matters to understand whether your controls address the risk you face and to make sure someone is responsible for acting when they don't. I'm not saying every community bank or credit union should operate like a global institution. Your risk, budgets, and staffing are different. And your control environment should reflect that.
Hailey Windham
26:03
The basic questions though are the same. Do you understand your risk? Are your controls designed to address them? Do they work the way you think they do? And can you demonstrate it? When something isn't working, who is accountable for fixing it? I've said in a few conversations lately that the answer isn't always another piece of technology. Sometimes it's understanding the problem you already have. Fixing a process, changing how information moves between teams, giving an investigator the authority to escalate, or finally addressing the control weakness everyone has known about for 18 months. Sometimes it does involve better technology, but that decision should start with the risk, not the sales pitch. As we get ready to share the financial institution fraud benchmarking report, I hope it starts more of these conversations and that fraud leaders look at the research, see how they compare to peers, and ask what they should do differently. Benchmarking doesn't improve a program on its own. What you do with it does. The same is true of everything we covered today. A risk assessment doesn't reduce exposure because you completed it. An alert doesn't prevent fraud because it fired. An audit finding doesn't fix a weakness because someone documented it. And control isn't effective just because it exists. Here's my challenge for this week. Pick one control in your fraud program that you trust. Ask yourself how you know it's working. What evidence would prove you wrong? And who is responsible for acting if it isn't? If you can answer all three, you're already having a much more meaningful conversation about control effectiveness. If you can't, now you know where to start. I'd also like to hear from you. What's the biggest obstacle your institution faces with fraud controls? Testing, visibility, technology limit, staffing, getting leadership to prioritize a known weakness, or figuring out who owns the problem? If this was useful, share it with another fraud fighter, someone on your team, your BSA officer, an internal auditor, or someone in leadership. And make sure that you're subscribed to Fraud Forward and the Monday Fraud Fix. Keep asking questions, keep challenging the process, and don't confuse having a control with knowing it works. I'm so excited that you guys are here. I apologize again for my terrible voice sounding right now, but you know, when the team wins, team wins. And you got to let them know you appreciate them. So, fraud evolves. So do we. See you later, fraud fighters. Hailey (28:23): Thanks for listening to Fraud Forward.
Hailey Windham
28:25
Remember, every conversation, every connection, and every insight moves our industry one step closer to stronger fraud defenses. If today's episode sparked an idea, share it with your team or tag me on LinkedIn. I love hearing how you're moving fraud forward in your own organization. Until next time, stay curious, stay resilient, keep moving fraud forward.
View full transcript
