Fraud Detection & Investigation for Banks

Fraud guides

Each guide covers one rail in full: how the fraud works, its types and red flags, the rules and deadlines, and how banks catch it.

Check fraud Washed, counterfeit and forged checks, mail theft, and the deadlines that decide who takes the loss.
ACH fraud Unauthorized debits, account takeover and BEC-driven credits, and the Nacha return windows.
Wire fraud and BEC Business email compromise, payment diversion and why a wire is so hard to get back.
Debit card fraud Card-not-present fraud, skimming and BIN attacks, and the Regulation E dispute clock.

How is each payment rail attacked?

Checks are stolen, altered and copied. ACH debits are pulled with stolen account numbers, while ACH credits and wires are redirected by someone posing as a party the payer trusts, or sent from a taken-over account. Debit cards are used, or just their numbers, without the customer's authority.

Rail	How it's attacked	Key rules	The clock that matters
Checks	Mail theft, then washing, alteration or counterfeit copies; forged signatures and endorsements; kiting; mule deposits.⁠[2]	UCC Articles 3 and 4; Regulation CC (12 CFR 229).⁠[3]⁠[4]⁠[5]	The paying bank's midnight deadline: return the item before midnight of the banking day after receipt.⁠[4]
ACH	Unauthorized debits, account takeover, business email compromise, payroll diversion, account-holder scams.⁠[6]	Nacha Operating Rules, with fraud monitoring required of every bank and credit union since June 2026; Regulation E for consumers.⁠[7]⁠[8]	2 banking days to return a business's unauthorized debit (R29); 60 calendar days for a consumer's, with a signed WSUD.⁠[9]
Wires	Business email compromise and vendor invoice fraud, executive impersonation, real estate closing fraud, account takeover.⁠[10]⁠[11]	UCC Article 4A, which reaches Fedwire through Regulation J.⁠[12]⁠[13]	Hours. The beneficiary's bank usually accepts a wire on receipt, and FinCEN has had more success recovering wires reported to law enforcement within 72 hours.⁠[12]⁠[14]
Debit cards	Card-not-present fraud, skimming and shimming, BIN attacks, lost and stolen cards, wallet provisioning after account takeover, first-party fraud.⁠[15]	Regulation E for consumer accounts; card network rules for chargebacks.⁠[8]	10 business days to investigate a dispute (20 for new accounts), or up to 45 days, 90 for some transactions, with provisional credit.⁠[8]

Simplified. Each guide gives the exceptions and the pinpoint citations.

Who usually bears the loss?

Each rail follows its own law, but the first question is usually the same: what was faked, and did the customer authorize the payment? A customer tricked into paying a fake vendor generally bears the loss whether it paid by wire or by ACH, because it authorized the payment.⁠[12]⁠[6]

Checks: it depends on what was faked. For an altered check, the paying bank can generally recover under the presentment warranty, pushing the loss toward the bank of first deposit; a forged endorsement generally does the same. A forged drawer's signature generally stays with the paying bank.⁠[3]⁠[4]
ACH: the ODFI warrants that every entry it sends is authorized, so an unauthorized debit's loss generally runs back to the ODFI and its Originator.⁠[9] A credit sent by a deceived account holder was authorized under False Pretenses, so that loss generally stays with the sender.⁠[6]⁠[12]
Wires: a customer tricked into sending a wire, as in BEC, generally bears the loss. If someone else sent it in the customer's name, the bank generally refunds it with interest, unless it followed an agreed, commercially reasonable security procedure in good faith.⁠[12]
Debit cards: Regulation E caps what a consumer owes for unauthorized transfers, at $50 when a lost or stolen card is reported within two business days; the issuer carries the rest unless it can charge the transaction back to the merchant's bank under card network rules.⁠[8] At large issuers in 2023, merchants absorbed 49.9% of debit fraud losses, issuers 28.3% and cardholders 21.8%.⁠[15]

Fraud statistics

The numbers below come from three kinds of count: suspicious activity reports, surveys of institutions, and the losses victims report to the FBI.

63% of banks and credit unions saw check fraud attempts in the prior 12 months, and 31% had losses, in a 2026 Federal Reserve Financial Services survey of 403 institutions.⁠[16]
More than eight times as many ACH-fraud SARs were filed by banks, thrifts and credit unions in 2024 as in 2014, and the count rose every year in between.⁠[1]
$3.05 billion in business email compromise losses was reported to the FBI in 2025, from 24,768 complaints. 86% of the payment methods BEC victims reported were wire transfers or ACH.⁠[17]
75% of institutions in the same Federal Reserve survey saw debit card fraud attempts, the most of any payment type, and 56% had debit card losses, also the highest share.⁠[16]
298,382 SARs on credit or debit card fraud were filed by banks, thrifts and credit unions in 2024, second only to checks.⁠[1]

A SAR counts a report, not a loss, and FinCEN's card category combines credit and debit cards. IC3 figures count losses that victims reported to the FBI, not all losses.

How AI coworkers help

Socratix AI coworkers take on the gathering. For every flagged check or ACH entry, they pull the evidence from each system, compare the payment with the customer's own history, and hand your analysts a recommendation with the reasoning laid out; for wires and card claims, they can do the same. Your team still makes every call — it just stops spending the day assembling the picture.

Every rail runs on a clock, and none of them waits while the evidence is gathered. Your team can't add analysts that fast. AI coworkers do the gathering on checks and ACH — every item, around the clock — and can do the same on wires and cards, so the people you have spend their time on the decision.

GatherPulls the item and the customer's history (past payments, usual payees and amounts, logins and devices, prior alerts and claims) from the systems that hold them, into one case.
AssessCompares the payment with the customer's own history, checks it against your policies and the patterns of fraud on its rail, and watches the clocks.
RecommendRelease, return, hold or escalate — with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
LearnLearns from each decision — your policies, your risk appetite, your analysts' judgment — and every step is logged for the examiner.

Case studies

Fraud FAQ

What's the difference between check, ACH and wire fraud?

The rail, and the law that comes with it. Check fraud attacks a paper or image check, by washing, counterfeiting or forgery, under UCC Articles 3 and 4 and Regulation CC. ACH fraud pulls an unauthorized debit or pushes a credit to the wrong account under Nacha's rules, with return windows of two banking days for a business and 60 days for a consumer. Wire fraud, most often BEC, runs under UCC Article 4A, and a wire is hard to get back once the beneficiary's bank accepts it.⁠[3]⁠[4]⁠[5]⁠[9]⁠[12]

Which payment type do fraudsters target most?

Debit cards, by the share of institutions hit. In Federal Reserve Financial Services' 2026 survey, 75% of banks and credit unions saw debit card fraud attempts and 63% saw check fraud attempts, and respondents put debit at about 40% of their payments-fraud losses. Counted in suspicious activity reports, check fraud leads: 521,036 SARs in 2024, with card fraud second.⁠[16]⁠[1]

Can a bank get a fraudulent payment back?

Sometimes, if it moves inside the rail's window. A paying bank can return a bad check before its midnight deadline, and an unauthorized ACH debit can be returned within two banking days for a business or 60 days for a consumer. A wire is generally final once the beneficiary's bank accepts it, so recovery depends on getting the money frozen: in 2025 the FBI's IC3 Recovery Asset Team froze $679 million of $1.16 billion in attempted theft. A debit card issuer may be able to charge a transaction back to the merchant's bank under card network rules.⁠[4]⁠[9]⁠[12]⁠[17]

How can a small fraud team review every alert?

By taking the gathering off its desk. Deciding is quick once the picture is complete; the slow part is pulling the evidence for each flagged item from the several systems that hold it. Assemble that automatically for every item and the same team can review everything instead of a sample. At First Community Bank and Trust, Socratix evaluates every check, auto-clears 97.5% and sends the rest to analysts, who make the call.⁠[18]

Does payment fraud require a SAR?

Often, whatever the rail. Under the banking agencies' SAR rules, a bank must report a known or suspected federal crime against or through it at $5,000 or more when a suspect can be identified, or $25,000 or more regardless of a suspect; FinCEN's rule covers suspicious transactions of $5,000 or more. The SAR is due 30 calendar days after first detecting facts that may support it, or up to 60 if no suspect has been identified. The SAR filing guide covers the narrative and continuing activity.

31 CFR 1020.320 · 12 CFR 21.11⁠[19]

Sources

This guide is general information, not legal advice.

Fraud detection and investigation.