What’s up fraud fighters, and welcome back to Fraud Forward!

I want to talk about something that might be a little uncomfortable. It isn’t about a new scheme or a criminal using AI to break into a bank. It’s about our own fraud controls, and the gap between having them and knowing they work.

Two stories from the past week made me want to have this conversation. The first is a $350 million penalty against American Express National Bank tied to deficiencies in its BSA and AML program. The second is a guilty plea from a former TD Bank employee who admitted to accepting bribes and helping launder more than $4.8 million. The facts are very different, and neither institution looks like a community bank or credit union with a fraud team of two. Even so, the same questions show up at every size. Does your risk assessment reflect the business you run today? Who reviews the people with the power to override a control? And when someone finds a weakness, who makes sure it gets fixed?

I’m also bringing in what we’ve learned from our financial institution fraud benchmarking research, because it points to a question I keep returning to. What does a mature fraud program actually look like? Let’s get into it.

• Why the American Express enforcement action is a lesson in fraud risk assessment, and what happens when an assessment focuses on a narrow part of a much larger business
• Why the roughly $13 billion in suspected activity cited by the OCC reflects deficiencies in a BSA and AML program, and why it shouldn’t be repeated as a fraud loss
• How a former TD Bank employee allegedly used legitimate access to unblock restricted cards, and why employee override monitoring deserves more attention than it gets
• What 86 accounts at one commercial address teach us about transaction monitoring and what should happen after an alert fires
• Practical ways smaller teams can use compensating controls when they can’t fully separate duties
• Why documenting a known control weakness is not the same as managing it, and how remediation tracking can quietly stall
• A simple framework that separates control existence vs execution vs effectiveness
• Metrics that show real exposure to leadership, beyond alert counts and cases closed
• Five questions to bring to your fraud team on Monday

• Lead or support a fraud program at a community bank or credit union and have to cover a lot of ground with a small team
• Want to know whether your fraud risk assessment is driving decisions or only documenting them
• Are responsible for managing insider risk or employee access and want practical ways to review overrides
• Need help explaining known control weaknesses to leadership in a way that leads to action
• Are comparing your program against peers and want to know what a mature fraud program looks like