Fraud Controls Are Everywhere. So Where’s the Accountability?

What’s up fraud fighters, and welcome back to Fraud Forward!I want to talk about something that might be a little uncomfortable. It isn’t about a new scheme or a criminal using AI to break into a bank. It’s about our own fraud controls, and the gap between having them and knowing they work. Two stories from the past week made me want to have this conversation. The first is a $350 million penalty against American Express National Bank tied to deficiencies in its BSA and AML program. The second is a guilty plea from a former TD Bank employee who admitted to accepting bribes and helping launder more than $4.8 million. The facts are very different, and neither institution looks like a community bank or credit union with a fraud team of two. Even so, the same questions show up at every size. Does your risk assessment reflect the business you run today? Who reviews the people with the power to override a control? And when someone finds a weakness, who makes sure it gets fixed?I’m also bringing in what we’ve learned from our financial institution fraud benchmarking research, because it points to a question I keep returning to. What does a mature fraud program actually look like? Let’s get into it.What you’ll hear in this episode:Why the American Express enforcement action is a lesson in fraud risk assessment, and what happens when an assessment focuses on a narrow part of a much larger businessWhy the roughly $13 billion in suspected activity cited by the OCC reflects deficiencies in a BSA and AML program, and why it shouldn’t be repeated as a fraud lossHow a former TD Bank employee allegedly used legitimate access to unblock restricted cards, and why employee override monitoring deserves more attention than it getsWhat 86 accounts at one commercial address teach us about transaction monitoring and what should happen after an alert firesPractical ways smaller teams can use compensating controls when they can’t fully separate dutiesWhy documenting a known control weakness is not the same as managing it, and how remediation tracking can quietly stallA simple framework that separates control existence vs execution vs effectivenessMetrics that show real exposure to leadership, beyond alert counts and cases closedFive questions to bring to your fraud team on MondayYou should listen to this episode if you:Lead or support a fraud program at a community bank or credit union and have to cover a lot of ground with a small teamWant to know whether your fraud risk assessment is driving decisions or only documenting themAre responsible for managing insider risk or employee access and want practical ways to review overridesNeed help explaining known control weaknesses to leadership in a way that leads to actionAre comparing your program against peers and want to know what a mature fraud program looks like