Tag Archive for: Fraud

Posts

WBA Committee Chair Spotlight: Kim Nesbitt

Kim Nesbitt

For bankers looking to stay informed on financial crimes and fraud trends, involvement and collaboration are more important than ever. As vice president of bank operations at First National Bank of River Falls and chair of the WBA Financial Crimes Committee, Kim Nesbitt understands firsthand the value of building industry connections and sharing knowledge to combat emerging risks.

Nesbitt’s involvement with the WBA began with a simple goal: learning from peers and expanding her professional network.

“I joined the Financial Crimes Committee in 2022 to network and learn,” she says. “The knowledge I’ve gained and the relationships I’ve built have been incredibly valuable and continue to be a tremendous resource.”

Those connections have become increasingly important as the banking industry faces a rapidly changing fraud landscape.

According to Nesbitt, one issue every banker should keep top of mind is the speed at which fraud is evolving. While fraud has always been a part of banking, advances in technology and artificial intelligence are creating new opportunities for criminals and making scams more difficult to detect.

“We’re seeing more sophisticated scams, social engineering, account takeovers, and impersonation attempts that can be very convincing to both customers and employees,” she explains.

What makes today’s threats particularly challenging is that fraud is no longer just a financial concern. It has become an operational risk and a customer trust issue as well. Banks must continually evaluate how to strengthen controls and leverage technology to identify suspicious activity earlier, while also maintaining a positive customer experience.

“The challenge is finding that balance between making banking easy for our customers while making it difficult for fraudsters,” Nesbitt says.
Outside of her leadership role in banking, Nesbitt’s first experience in the workforce was far from financial services.

“My very first job was working at Dairy Queen,” she shares.

And while banking has proven to be a rewarding career path, Nesbitt says she has always been intrigued by another profession.
“If I hadn’t gone into banking, I’d love to be in the medical field, probably as an OB nurse.”

When she’s not thinking about fraud prevention and bank operations, Nesbitt points to a local favorite as one of Wisconsin’s hidden gems: First National Bank of River Falls Field.

“The atmosphere at the stadium is one of the great places to catch an amateur, college, high school, or youth baseball or softball game,” she says.

For fellow bankers looking for entertainment that also highlights the real-world consequences of fraud, Nesbitt recommends the action thriller The Beekeeper.

“While it’s an action movie, the story centers around financial fraud and the devastating impact scams can have on people,” she notes. “It reinforces how important fraud prevention, customer education, and protecting vulnerable customers have become in our industry.”

Whether she’s collaborating with committee members, monitoring emerging fraud trends, or helping her institution navigate an increasingly complex risk environment, Nesbitt remains focused on one of banking’s most important responsibilities: protecting customers.

Her advice serves as a reminder that while fraud tactics may continue to evolve, strong industry partnerships, ongoing education, and a commitment to customer protection remain some of the most effective tools banks have in their arsenal.

/by

The Long Tail of Paycheck Protection Program

By Jeff Otteson, vice president of sales at Midwest Bankers Insurance Services, a WBA subsidiary

Jeff Otteson

Why Bank Customers Are Being Targeted Again

The Paycheck Protection Program (PPP) may have ended, but the information it generated continues to create opportunities for fraudsters.

Businesses that received PPP loans are now being targeted through highly personalized bank-impersonation schemes. Using publicly available PPP loan information, criminals can identify a business, its loan amount and, in many cases, the financial institution associated with the loan. That information gives a fraudster enough credibility to make an unexpected call, text message or email sound legitimate.

This is not simply another generic phishing campaign. It is a targeted social-engineering attack built around real information and a trusted banking relationship.

How the Scam Works

The Small Business Administration maintains a public, loan-level dataset covering disbursed PPP loans. Fraudsters can combine that data with business websites, social media and other public records to develop a convincing profile of a potential victim.

A fraudster may know:

• The business’s legal name and address
• The amount of its PPP loan
• The lender associated with the loan
• The names of owners, executives or accounting employees
• The bank’s treasury-management or fraud-department terminology

The criminal then contacts the business while impersonating an employee of its bank. Caller ID may be spoofed so the call appears to originate from the bank’s actual telephone number. Emails and text messages may use the bank’s name, logo and branding.

The purported reason for the contact can vary. The customer may be told that:

• A suspicious ACH or wire transfer is pending
• Someone attempted to access the company’s online banking account
• A check or electronic payment must be verified
• The account must be frozen to prevent additional fraud
• A security update is required
• The bank needs to confirm the customer’s credentials
• A one-time passcode is needed to stop or reverse a transaction

The fraudster creates urgency and positions himself as the person trying to protect the customer. In reality, the criminal may already possess the customer’s username and password. The call is designed to obtain the final piece needed to defeat multifactor authentication: the customer’s one-time security code.

The FBI has specifically warned about account-takeover schemes involving criminals impersonating financial-institution support personnel. Once the customer provides the requested code, the fraudster may gain access to the account, establish a new device, change contact information or initiate unauthorized ACH and wire transfers.

Why These Calls Are So Convincing

Traditional fraud-awareness training often tells customers to look for spelling mistakes, unfamiliar senders or vague messages. Those warning signs may not be present here.

The caller may correctly identify the customer’s bank, PPP loan and business information. The telephone number appearing on caller ID may match the number printed on the back of the customer’s debit card or listed on the bank’s website. The criminal may even transfer the victim between several supposed departments to create the appearance of a legitimate financial institution.

The use of accurate information does not make the caller legitimate. It only demonstrates that the criminal has done research.

Bank customers should understand that caller ID is not a reliable authentication method. A person who receives an unexpected banking call should hang up and contact the bank through a telephone number the customer independently knows to be correct – not a number provided by the caller or contained in an unsolicited message.

What Banks Should Be Telling Their Customers

Banks should communicate directly with business customers, particularly customers identified in public PPP data. The message should be simple and specific: The bank will never call and ask a customer to disclose a password, authentication token or one-time security code.

Customers should also be reminded that a code generated by multifactor authentication is not merely an identification number. It may authorize access, approve a new device or permit a transaction. Providing that code to another person can be the digital equivalent of handing over a key to the account.

Additional customer guidance should include:

• Never provide usernames, passwords, PINs, tokens or one-time passcodes in response to an incoming call, email or text.
• Do not click an online-banking link contained in an unsolicited message.
• Access online banking through the bank’s official website or mobile application.
• Hang up and call the bank using a known, independently verified telephone number.
• Require dual control for ACH and wire activity.
• Establish transaction and daily exposure limits that reflect the company’s actual needs.
• Review new users, authorized devices and changes to account contact information.
• Enable alerts for password changes, new-device enrollment and outgoing transactions.
• Report suspicious communications immediately, even if no money appears to have left the account.

Prompt reporting can help prevent or limit a loss. Customers should not wait until the next business day if they believe credentials or authentication codes have been disclosed.

Banks Must Also Examine Their Own Procedures

Customer education is only one part of the response. Banks should review how employees handle calls involving compromised credentials, new-device enrollment, changes to telephone numbers or email addresses and requests to add new treasury-management users.

A fraudster who has compromised a customer’s email account may attempt to add a supposed new CFO or controller to the customer’s wire agreement. The request may come from the customer’s legitimate email address, but that does not establish that the request is authorized.

Material changes to authorized users, callback numbers, transaction authority or security procedures should be independently verified with an existing authorized person using previously established contact information. Employees should not rely on the telephone number or contact information contained in the request being verified.

The bank should also confirm that its written wire-transfer agreement clearly identifies:
• Who is authorized to request wires
• The predetermined telephone number to be used for callbacks
• The PIN or passcode the requester must verify during the callback
• The procedures for changing authorized persons or callback information

Having a written agreement is only the beginning. Employees must consistently follow the security procedures contained in it. A callback to a number supplied in the fraudulent request is not an effective callback. Similarly, completing a callback without requiring the agreed-upon PIN or passcode may undermine the protection the procedure was designed to provide.

The Insurance Question Is More Complicated Than It Appears

When an account-takeover loss occurs, the customer, bank and their respective insurers may all examine who was compromised, who authorized the transaction and which security procedures were followed.

Coverage is highly dependent on the specific facts and policy language. A bank’s Financial Institution Bond may distinguish between a direct compromise of the bank’s systems and a loss resulting from a customer voluntarily providing credentials or authentication codes. Computer-fraud, funds-transfer, fraudulent-instruction and social-engineering provisions may contain materially different definitions, exclusions and authentication requirements.

The customer’s cyber or crime policy may also be relevant, particularly when the customer’s employee was deceived into disclosing credentials or approving a fraudulent transaction. However, the existence of insurance should never be assumed to eliminate the potential dispute between the customer and the bank.

Banks should review both their operational procedures and insurance coverage before a loss occurs. That review should address customer credential compromise, account takeover, new-device authorization, fraudulent changes to authorized users and the failure to follow agreed callback or authentication procedures.

The Takeaway for Community Banks

PPP data has created a lasting roadmap that criminals can use to identify businesses and their banking relationships. The immediate scam may target the customer, but the resulting financial loss, customer dispute and reputational damage can quickly reach the bank.

Community banks are particularly well positioned to respond because they know their customers and can communicate with them directly. A timely warning from a trusted relationship manager may be more effective than a general fraud notice posted on a website.

Banks should not treat the end of the PPP lending period as the end of PPP-related risk. The loans may have been forgiven, but the publicly available information remains – and criminals are finding new ways to use it.

/by

Warning: Misleading Marketing Campaign Targeting Bank Customers

WBA has been alerted to a recent marketing campaign spreading misinformation designed to create fear and distrust toward banks — a scam closely resembling the one that circulated in late summer 2023. The email falsely claims that banks are “secretly preparing for the Digital Dollar” and uses alarmist language suggesting that customers have only “days to protect their hard-earned savings.” Additionally, the email contains links that may be malicious.

The malicious email appears with the subject line: “[EXPOSED] 72 hours before these banks flip the Digital Dollar switch?” and the body of the email reads:

“Do you have any savings in any US banks on this list?! Because we have bad news…These Banks are secretly preparing for the Digital Dollar to go live. This controversial rollout will give the government complete control over your money, This means they can track every purchase, And control how you spend your money, If your bank is on this list, you may only have days to protect your hard earned savings, before the Digital dollar is rolled out!”

The email states it is sent on behalf of American Alternative Assets from California and is sent by FIT, LLC, listed as owner and operator of World Financial Time (WFT).

The referenced list in the email includes banks that have voluntarily elected to participate in the Federal Reserve’s FedNow® Service, an instant payment system developed by the Federal Reserve to enable safe and efficient real-time payments.

WBA believes this deceptive email is intended to scare and mislead consumers. Its contents falsely imply that banks participating in the FedNow Service are putting customer deposits at risk. In reality, the email appears to deliberately confuse the FedNow Service—a secure payment infrastructure—with digital currency, which are entirely separate concepts.

Banks are encouraged to ensure that customer service staff are aware of this misleading email and are prepared to respond to customer inquiries. Staff should share accurate information about the FedNow Service and reassure customers of its safety. The Federal Reserve provides several resources that clearly explain the service, including an FAQ that explicitly confirms the FedNow Service is not replacing cash and is not a form of digital currency.

View FedNow Services FAQ

/by
Executive Letter Thumbnail

Executive Letter: Cybersecurity Awareness Starts with Education

From the Desk of Rose Oswald PoelsBy Rose Oswald Poels

October is Cybersecurity Awareness Month — an annual reminder that protecting our customers is an ongoing and ever-evolving effort.

Bankers continue to see a range of scams targeting both customers and financial institutions — and these scams are no longer confined to clumsily-written emails and suspicious links. Bad actors use a mix of increasingly sophisticated techniques that weaponize social engineering and artificial intelligence to make phishing attempts appear legitimate to even the most cautious customer. Wisconsin bankers are seeing a rise in tactics such as:

  • AI Impersonations: Scammers use AI-generated voices that sound friendly and familiar, or emails that convincingly mimic a trusted institution.

  • Spoofing: Bad actors disguise a phone number, email address, or website to appear as though it is coming from their community bank or a government agency.

  • Phishing: Criminals send emails or texts that trick recipients into revealing sensitive information or clicking malicious links.

  • Brushing Scams: Consumers receive unsolicited packages as a part of fake transactions designed to boost a seller’s online credibility or steal personal information.

  • Romance Scams or Catfishing: Bad actors build emotional connections with victims online using stolen photos to gain their trust, then manipulate them into sending money or sharing personal information.

  • Cryptocurrency Scams: Criminals pose as investment advisors or romantic partners to convince victims to transfer funds into digital wallets. These transactions are nearly impossible to reverse.

  • Gift Card Scams: Scammers pressure victims into purchasing gift cards as “payment” for supposed fees or emergencies. Once the numbers are shared, the funds are instantly drained and nearly untraceable.

  • Synthetic Identity Fraud: Fraudsters combine real and fake personal data to create entirely new identities to open fraudulent accounts or apply for loans.

Education remains our best defense. WBA offers a library of consumer-facing resources designed to help Wisconsin banks communicate types of fraud and prevention tips to customers. Our latest “Don’t Be Spoofed” piece, along with additional cybersecurity safety resources like “Building Your Online Security” and “Don’t Get Spooked by Scams” are available for download on our website. These materials are ready to share on your websites, or easy to print to share in-branch with your customers.

Cybersecurity Awareness Month is the perfect opportunity to review internal protocols with your staff, refresh training, and speak directly with your customers. After all: Trust is at the heart of a successful banking relationship.

/by

As Fraud Evolves, Wisconsin Banks Respond

By Katie Reiser

In the July/August issue of Wisconsin Banker, we shared information from presenters at the WBA’s first Fraud Summit held in June. We now turn to Scott Birrenkott, WBA director – legal, and three members of WBA’s Financial Crimes Committee for their fraud fighting insights.
As much as the fraud landscape evolves, some things never change. While criminals now employ artificial intelligence and deepfakes to trick their victims, long-standing schemes like check fraud remain stubbornly persistent. Particularly concerning is the rise of bank impersonation/spoofing which WBA President and CEO Rose Oswald Poels recently addressed in an Executive Letter and a press release which was picked up by many media outlets.

“Check fraud is one the biggest challenges right now,” said attorney Birrenkott, who also serves as staff liaison for the association’s Financial Crimes Committee. “Additionally, banks are not only battling check fraud, but also electronic payments fraud and new accounts fraud.”

For banks, the challenge is twofold: fighting fraud while continuing to serve customers and build trust. “Fraud targets both consumers and businesses,” Birrenkott added. “Criminals spoof individuals, create fictitious people or companies, or compromise existing accounts. Prevention is ideal, but it’s difficult — banks have to think about both prevention and how they’ll respond once fraud occurs.”

New Faces of Fraud and Classic Scams
Emerging schemes increasingly leverage technology to appear more legitimate. AI-driven voice spoofing, deep-fake impersonations, and business email compromise are giving fraudsters powerful new tools.
Mike Christensen, deposit compliance and operations officer at Farmers Savings Bank in Mineral Point, said a common trend is what he calls “shock and awe” tactics. “Fraudsters will text or call reporting fake transaction alerts, bank embezzlement, or even criminal investigations to get the victim’s attention.

The criminals work together as a team — one poses as law enforcement, another as a bank representative, another as a government agency. The victim, eager to help resolve the issue, often ends up handing over money or gift cards.”

At Fortifi Bank, Chief Risk Officer Theresa Weckwerth has seen a rise in imposter scams. “Criminals are calling and texting clients while pretending to be from trusted organizations, including their bank’s fraud department or law enforcement, in an effort to obtain credentials to the client’s online banking.”

But, despite all the new technology, some scams endure.

“The most common type of fraud we continue to encounter is check fraud — specifically altered checks intercepted from the mail,” said Jennifer Haydon, CAMS, vice president and compliance officer at American National Bank Fox Cities. “These checks are legitimate, but they’ve been washed or changed after being issued. We also see business email compromise involving ACH rerouting or demographic changes intended to facilitate fraud, and a recent increase in check kiting, driven in part by increasing costs and financial pressures on individuals.”

Christensen said fraudsters are refining old tactics. “Whereas they used to work alone, they now work in groups. After hours of talking to multiple ‘experts’ from supposed government agencies, victims feel overwhelmed and confused — which makes them more likely to hand over sensitive information or money.”

Building a Fraud-Savvy Workforce
Bank employees remain the first line of defense. Ongoing training and empowerment are essential.

“Education is paramount,” said Haydon. “Fraud can occur across many platforms, so it’s essential that staff are trained to recognize the warning signs. Teaching employees to ask questions, dig deeper, and investigate unusual requests is often all it takes to uncover a fraudulent attempt.”

Christensen noted that training must be both formal and ongoing. “Each year, we hold in-person fraud training using real examples of recent attempts. Throughout the year, we supplement that with online meetings focused on different fraud scenarios. I’m very proud of our staff for following procedures and knowing how to handle red flag situations to protect our customers and the bank.”

Birrenkott agreed that frontline empowerment is key: “If a teller notices a customer acting strangely, withdrawing unusually large sums, or presenting a suspicious check, they should have the confidence, tools, and authority to respond — whether that means asking questions, involving a manager, or refusing the transaction. Once the bank accepts a fraudulent check, it becomes much harder to address the situation.”

Birrenkott suggests sharing real-world examples of fraud attempts and ensuring that employees know the bank’s policies for refusing a suspicious check or escalating concerns, stating “Quick huddles, regular updates, and strong communication channels help keep everyone alert.”

Tools, Tech, and Teamwork
Alongside training, banks rely on a mix of technology and collaboration. Fraud monitoring software, transaction alerts, and law enforcement partnerships are crucial. Just as important is industry-wide cooperation to share intelligence and trends before they spread.

Four WBA member banks, AbbyBank, Forward Bank, Northwestern Bank, and Prevail Bank have come together to educate their communities on avoiding common forms of fraud. Since last summer they have been educating their customers and community members through fraud alerts shared with local media.

Many member banks work with local law enforcement to spread the word about fraud by hosting educational sessions that are open to the public on a variety of fraud-related topics. Those partnerships help underscore the gravity of today’s fraud landscape.

It’s now increasingly common to see warning messages on the homepages of banks’ websites. For example, the First Business Bank website shares this message in a prominent spot: Your Security Is Our Top Priority — First Business Bank will never request sensitive information like account numbers, online banking IDs, tax ID or Social Security numbers, passwords, or Personal Identification Numbers (PINs) via unsolicited calls, emails, or texts. Please regard such requests as highly suspicious. For tips on preventing fraud, visit our Security Center.

Protecting Customers While Ensuring a Smooth Banking Experience
Banks are also investing heavily in customer education. “The best approach is to get ahead of it,” said Haydon. “The more we talk about fraud, the less effective it becomes. Awareness helps customers recognize red flags before they’re deceived — sparing them the financial loss or shame that often follows.”

Christensen emphasized the importance of customizable tools: “We offer free, real-time alerts, one-time passcodes, the option to add Trusted Contacts, and comprehensive debit card controls. That way customers can choose the level of security that works best for them.”

Weckwerth said Fortifi Bank integrates fraud education into daily client conversations. “When we ask questions, we remind clients that we want to protect them from fraud. We also provide custom-created materials, fraud brochures distributed at the teller line and drive-up lanes, and free community presentations to raise awareness about common fraud trends.”

Tap Into Reliable Resources
•  WBA has many consumer resources available at www.wisbank.com including content created by WBA in addition to resources from federal agencies.
•  ABA’s BanksNeverAskThat Campaign includes tips on how to avoid phishing in emails, calls, and text messages, how to videos, a game, a quiz, and downloadable resources. ABA also has social media posts for banks to use. Registration is free for banks regardless of ABA membership status. Registered banks will receive a link to access the social medial campaign materials. The ABA Fraud Contact Directory is another valuable tool.
•  ICBA’s Check Fraud resources include guides for banks responding to instances of check fraud claims and an information piece for customers to help them protect against check fraud. ICBA’s Solutions Directory lists service providers in payments, compliance, and security.
•  Visit WBA’s online Best Practices Library to access tools and sample affidavits shared by the Financial Crimes Committee. WBA’s Negotiable Instruments Manual is another helpful resource.
•  WBA partners with Community Bankers Webinar Network and OnCourse Learning who offer fraud webinars.

A Shared Responsibility
Fraud prevention is a joint effort between banks, customers, regulators, and communities.

“Vigilance and awareness are key,” Birrenkott said. “Everyone in the bank — not just risk or security officers — should know the signs of fraud and how to act.”

“Fraudsters are constantly adapting, and with AI making schemes more sophisticated, banks can’t treat fraud prevention as an occasional task,” Birrenkott added. “It requires constant vigilance and engagement — every day.”

/by
,

Wisconsin Bankers Association Warns of Rise in Bank Spoofing Occurring in Wisconsin — Bank Customers Must Be Vigilant Against Financial Fraud

The Wisconsin Bankers Association (WBA) is warning Wisconsinites of increased bank fraud and encourages citizens to continue their efforts to spot scams by criminals seeking to obtain bank account or personal information. With greater frequency, Wisconsin banks see a variety of fraud activity targeting consumers, including recent attempts by bad actors to defraud customers through calls impersonating the bank. Many instances include “phone number spoofing” which makes the call appear as if it were from the bank itself. If a call seems suspicious, hang up and contact the bank directly using a verified number.

“Banks across Wisconsin go to great lengths to help protect customers by investing in anti-fraud tools and account security. Wisconsin bankers, law enforcement, and other state agencies do a good job on educating Wisconsin residents on the importance of protecting personal data and banking account information,” said Rose Oswald Poels, WBA President and CEO. “However, criminals are sophisticated in their spoofing of bank names on Caller ID and creating fake websites or text messages with bank logos to mislead customers into providing account access information or transferring money. Bank customers must be vigilant to protect bank account and personal information from criminals.”

The Wisconsin Bankers Association offers the following tips to help protect customers against scams or financial exploitation:

  1. Watch for these red flags of phishing in emails, calls, and text messages:
    • They ask you to open a link you were not expecting
    • They use urgent or fear-inducing language
    • They send an attachment
    • They request personal information like PINs, passwords, or social security numbers
    • They pressure you to log into, or send money with, payment apps
  2. Write safer checks:
    • Use permanent gel pens when you write a check
    • Avoid blank spaces so criminals can’t fill them in instead
    • Withhold personal information on your checks
    • Take your mail directly to a U.S. Post Office location; do not use your mailbox at home or a free-standing blue drop box to send mail
    • Attentively monitor your account activity on your online banking platform
    • Regularly review your paid checks on your online banking platform, including ensuring the endorsement is correct and reflects the intended payee and amount
    • Switch to your bank’s payment app or online bill pay instead of writing a check
    • Follow up with payees to confirm they received and deposited your check

The best defense against scams is to stay informed. More information about how to spot scams and bank spoofing may be found at: https://www.banksneveraskthat.com/.

/by
Executive Letter Thumbnail
, ,

Executive Letter: Fraudsters’ Impersonation of Wisconsin Banks on the Rise – Resources to Protect Your Community

From the Desk of Rose Oswald PoelsBy Rose Oswald Poels

I continue to hear from members across the state about attempts by bad actors to defraud customers through calls impersonating the bank. Many instances include “phone number spoofing” which makes the call appear to come from the bank itself. I encourage members to continue warning customers about fraudulent activity — reminding them to hang up if a call seems suspicious and to contact their bank directly using a verified number if they receive these calls.

Members should consider issuing a warning about bank impersonation — whether a website notice, a printed handout provided during branch transactions, or a message included in periodic statements. For banks with call centers and other voice messaging, information on fraud can be included as part of the recorded phone greeting. Members and their customers can also file a complaint about spoofing with the FCC.

The following resources are available to you and your team to create messaging to remind customers of various ways to protect themselves from scams:
• WBA-created consumer content which can be included in newsletters, take aways, or as electronic delivery regarding how customers can best protect against various scams.

• ABA’s BanksNeverAskThat Campaign which includes tips of how to avoid phishing in emails, calls, and text messages, videos of how to stop scam attempts, a game, a quiz, and downloadable resources.

ABA also has social media posts for banks to use. Registration is free for all banks regardless of ABA membership status. Once registered, the bank will receive a link to access the social medial campaign materials.

• ICBA’s Check Fraud Resources include guides for banks needing to respond to instances of check fraud claims and an information piece for customers to help them protect against check fraud.

I encourage members to remain proactive with communications that warn customers about bank spoofing. It is imperative that Wisconsin banks continue efforts to educate customers — especially our seniors and young adults — on how to spot scams, prevent check fraud, and to remember the types of questions banks will never ask. I will continue to share statistics and information with supervisory and enforcement agencies as we look for ways to combat against fraudulent activity and protect Wisconsinites from exploitation.

/by
,

Inside the Fight Against Fraud: Highlights From WBA’s First Fraud Summit

By Katie Reiser

As fraud becomes more prevalent and complex, many Wisconsin bankers voiced the need for more practical insights and support. In response, the Wisconsin Bankers Association (WBA) hosted its first Fraud Summit on June 3, 2025. The one-day event brought bankers together to dig into today’s biggest fraud threats and how to fight back — from cyberattacks and scams to regulatory changes and prevention tactics. The summit was created based on direct input from members who said they needed more resources to stay ahead of fraud trends. Strong turnout and engaged discussion underscored how relevant the event was, and based on early and enthusiastic feedback, WBA is exploring hosting another Fraud Summit in the future.

Bankers Reflect on Takeaways and Impact
Two attendees from Wolf River Community Bank shared their feedback from the Summit. Diane Moen-Ross, electronic banking supervisor, said, “I found the Fraud Summit to be both entertaining and insightful. I had a few things make me really think about my day-to-day habits and look at things differently from a security level for the bank after hearing from the speakers. I found the information they shared to be helpful in protecting the bank and looking out
or our customers.” She added, “I also enjoyed the humor they put into their presentations.”

Her colleague Kyra Baeten, BSA & risk analyst, offered this take, “The summit was amazing, and I was truly in my element! It exceeded my expectations in every way. The presenters were raw, real, and incredibly insightful, which went beyond just surface level discussions. It pushed me to think beyond my current ‘fraud box’ and how to better protect myself, my institution, and the communities we serve.” She summarized her experience, “I left feeling inspired, energized, and already looking forward to next year’s Summit!”

SHAZAM’s Kern: How Froud Follows Shifting Payment Trends
In the opening session, “Where Payments Go, Fraud Will Follow,” Diana Kern, AAP, senior financial solutions consultant at SHAZAM, explored how changing consumer payment habits are driving new fraud risks. For the first time, cash is no longer the most common method for purchases under $25, according to the Federal Reserve’s 2024 Diary of Consumer Payment Choice. Card payments now lead the way, and nearly half of person-to-person payments are made through mobile apps.

Kern walked attendees through how debit transactions have evolved — from magnetic stripe to chip and contactless cards, from physical cards to digital wallets, and from card-present to card-not-present (CNP) scenarios. These changes have big implications. In 2024, 98% of debit card fraud reported by SHAZAM clients occurred in CNP environments.

She pointed to BIN attacks, account probing, and fraud targeting specific merchant codes (like digital goods and money transfer services) as key issues. While chip technology has helped reduce counterfeit fraud, fallback transactions using magnetic stripes remain vulnerable.

Kern stressed the value of layered fraud defenses, such as real-time blocking, cardholder alerts, and well-calibrated decline rules. She also noted that data breaches — even those unrelated to payments — can give scammers the fuel they need to launch convincing social engineering attacks.

ABA’s Smith: Social Engineering, Check Fraud, and AI Threats
Patrick Smith, senior vice president of fraud operations with the American Bankers Association (ABA), gave an overview of current fraud challenges, including social engineering, check fraud, and emerging risks tied to artificial intelligence.
Smith made it clear that while banks are doing more than any other sector to protect consumers, they can’t do it alone. Responsibility must also be shared by telecom companies, social media platforms, and lawmakers.

He noted that social engineering scams have become harder to detect. Many now mimic trusted environments, build rapport with victims, and create a sense of urgency — making them highly effective. Check fraud, meanwhile, continues to grow despite a downturn in check use, now accounting for 66% of payment fraud. Mail theft and counterfeit or altered checks are key drivers.

AI is making an already complex fraud landscape even more challenging. Smith cited examples like deepfakes (providing a chilling example of how easy it is to clone voices), spoofed identity checks, and realistic fake IDs, all of which make scams faster to perpetuate and more convincing. He urged banks to continue building robust defenses by ensuring their teams are familiar with current threats and working closely with trusted vendors.

Smith shared that ABA is calling for a national fraud prevention strategy that includes establishing a White House Office of Fraud and Scam Prevention, increasing FCC enforcement regarding customer reported spam texts, and bringing in state and local law enforcement to improve prosecution rates.

Iannarelli: Cyber Vigilance in a High-Risk Environment
Former FBI Special Agent John Iannarelli, Esq., CSP (aka FBI John) gave a candid assessment of the cybersecurity landscape. According to the Identity Theft Resource Center, last year set records for data breaches, with over 15 billion records compromised.

Top threats include identity theft, phishing, ransomware, business email compromise (BEC), Internet of Things (IoT which are the internet-connected devices embedded in everyday objects which are sending and receiving data), and mobile-device related fraud. According to an FBI report, BEC alone cost U.S. businesses $2.4 billion last year, with cases up 270%. Iannarelli referenced the 2024 ransomware attack on Patelco Credit Union as a reminder of the financial and reputational damage such events can cause.

He also flagged the role of AI deepfakes in expanding cyber risk, highlighting a $25 million fraudulent wire transfer driven by a deepfake impersonation. Still, he warned that internal threats remain significant. About 75% of breaches are tied to insiders — often well-meaning but untrained employees.

To help reduce exposure, Iannarelli encouraged banks to focus on staff training, establish strong policies, use multifactor authentication, and maintain a tested incident response plan.

Ayotte: Stop Social Engineering Before It Starts
Michael Ayotte, senior cybersecurity consultant with Wipfli LLP and U.S. Special Forces veteran, focused on the human side of fraud — particularly how scammers manipulate people, not just systems. He explained how criminals often start with publicly available data from sources like obituaries, social media, and bank websites to piece together convincing identities.

Ayotte reminded attendees that identity verification processes should never give away clues. “Never disclose account numbers over the phone,” he said. If a caller can’t be verified, staff should direct them to a branch.

His session also highlighted common phishing tactics: urgency, secrecy, unusual grammar, and lookalike email addresses from company executives. Ayotte recommended physical security protocols too — from screening vendors to checking IDs — and stressed the need for ongoing training and internal testing through simulated phishing and security drills. He shared his own experiences conducting physical security audits for clients that were eye-opening and likely prompted many attendees to review their workplace policies.

His message was clear: it is crucial to empower employees to act on suspicious activity even though their focus is typically on customer service. There needs to be a balance between the two. Policies and technology matter, but awareness and a questioning mindset when something seems off are just as critical.

What’s Next?
WBA plans to follow up with a future article sharing practical tips and takeaways from the Summit, with additional insights from WBA’s Director – Legal, Scott Birrenkott. Birrenkott will share how Wisconsin banks can apply these lessons in the face of shifting fraud risks. Birrenkott
commented, “A lot of great information was shared at the WBA Fraud Summit. It just goes to show the value of gathering and sharing information. WBA will continue to provide updates and resources to help banks tackle the challenge of staying one step ahead of criminals.”

/by
Executive Letter Thumbnail
, ,

Executive Letter: WBA Ramps up Anti-Fraud Efforts Amid Rising Threats

From the Desk of Rose Oswald PoelsBy Rose Oswald Poels

In my conversations with bankers across the state, one issue continues to dominate: fraud. The fraud landscape is evolving at an alarming pace as criminals tap into new technology to exploit customers. WBA remains committed to supporting members with tools and training to stay ahead of these growing threats.

In response to strong member interest, WBA held our first annual Fraud Summit earlier this month in Wisconsin Dells. Feedback from attendees was overwhelmingly positive, with many already expressing interest in future fraud-related events. The program featured practical, in-depth presentations, including:
• Diana Kern (SHAZAM) on debit card fraud defense strategies
• Patrick Smith (American Bankers Association) on today’s fraud trends and prevention tools
• FBI veteran John Iannarelli (“FBI John”) on real-world cyberattack risks
• Michael Ayotte (Wipfli LLP) on social engineering, staff training, and physical security gaps

A full recap will be shared in the next issue of Wisconsin Banker.

Federal regulators are stepping up. Recently the federal banking agencies announced they are collaborating to address fraud, particularly check fraud, and are seeking comment on strategies to combat it. The Federal Reserve Board, Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC) are actively involved in this effort. The agencies are focusing on areas like interagency collaboration, consumer and industry education, regulatory adjustments, data sharing, and leveraging technology to reduce fraud.

The June 2025 FDIC Consumer News highlights the increasing threats of bank impersonation and fake bank scams, providing an overview and tips that would be helpful to share with bank customers. In 2024 alone, consumers reported $12.5 billion in fraud losses, with imposter scams — especially bank impersonation scams — among the top threats. Scammers send fake texts or emails that look like urgent bank alerts, then follow up with calls pretending to be from your bank’s fraud department. Their goal: to trick customers into sharing personal details like account numbers or passwords. Victims of these scams typically lose around $3,000 and face identity theft risks. Criminals also set up fake bank websites designed to trick people into sending money or sharing personal information. To appear legitimate, these sites may misuse the FDIC name or display the “Member FDIC” logo without authorization, creating a false sense of trust.

Elderly customers continue to be targeted, so I want to highlight a free training opportunity to help your staff respond. Safeguarding Seniors: A Guide for Financial Institutions is a self-paced, three-hour training developed by the Wisconsin Elder Justice Coalition and UW–Green Bay. It’s designed to help staff recognize and report suspected financial exploitation of older adults.

Despite the decline in check usage, check fraud is on the rise — particularly tied to mail theft. According to FinCEN, check fraud now accounts for about half of fraud-related SARs filed by depository institutions. That’s why we’re sharing the following fraud resources to help:

Directories
• ABA Fraud Contact Directory – Allows ABA members and non-members to submit and search contact information for submitting a fraud or check warranty breach claim.
• ICBA Solutions Directory – Lists service providers in payments, compliance, and security.
• ACH Contact Registry | Nacha – Find ACH/check contacts at other financial institutions.

Education & Training
• Webinar: Check Frauds and Scams
• WBA Resource: Negotiable Instruments Manual (UCC rules on liability for Wisconsin banks)
• ABA Online Training: 30-minute Fraud Prevention course, available through WBA for $55/registrant. Group discounts available.

WBA Best Practices Library
Access sample affidavits and tools shared by the WBA Financial Crimes Committee in the Best Practices Library on the WBA website. To request the password, contact WBA Legal at wbalegal@wisbank.com.

Please reach out if you have questions or need help accessing any of these materials. Together, we can help protect customers, staff, and financial institutions across Wisconsin.

/by
, ,

Association Update: New Fraud Summit in June to Address Evolving Threats

By Daryll Lund

Fraud in the financial services industry is constantly evolving, becoming more sophisticated and harder to detect. As fraud risks continue to grow, Wisconsin banks have made it clear that they need more tools, insights, and strategies to stay ahead. In response to these concerns, the Wisconsin Bankers Association (WBA) is introducing a new, one-day Fraud Summit on June 3, 2025, where banking professionals will gather to tackle fraud — one of the most pressing challenges in the industry. This one-day event will explore the latest fraud trends, emerging threats, and innovative strategies to protect financial institutions and their customers.

This event is the result of direct conversations with our members, who have shared their increasing challenges in protecting customers, accounts, and internal systems from fraud. Through this summit, bankers will hear from industry experts on emerging fraud trends, regulatory developments, and best practices for safeguarding their institutions.

WBA remains committed to providing meaningful education and resources that help banks navigate the complexities of today’s financial landscape. The WBA Fraud Summit is just one way we continue to respond to our member’s needs — ensuring Wisconsin banks have access to the latest knowledge and tools to combat fraud effectively.

Other support for members comes from Midwest Bankers Insurance Services (MBIS). MBIS provides assistance and full review of FI Bond and Cyber Liability applications to confirm and discuss internal controls to prevent fraud. MBIS VP of Sales, Jeff Otteson, recommends that banks work closely with their FI Bond and Cyber Liability broker to thoroughly understand the current vulnerabilities and how they can be eliminated with strong internal controls, best practices, and employee training.

More details on the Fraud Summit, including the agenda and speakers, will be shared with members soon. We look forward to offering this new opportunity to help banks stay ahead in the fight against fraud.

For help strengthening your fraud prevention efforts and assessing fraud risk contact Jeff Otteson, MBIS VP of Sales via email at jeffo@mbisllc.com or call 608.217.5219

Lund is WBA executive vice president – chief of staff and president of EBC and MBIS.

/by
Wisconsin Bankers Association logo

questions@wisbank.com

608-441-1200

4721 S Biltmore Ln.
Madison, WI 53718

Get our Newsletter!
Subscribe