Banking fraud teams can't stop account takeovers
11 posts across 3 communities in the last 90 days; 82% from r/Banking.
“We leaned on the same idea and moved the check to the sensitive action itself, payout change, new payee, device enrolment, with a factor a lifted session cannot reproduce. A relayed SMS code it can. A live liveness check or a fido2 tap it cannot. still enrolment patterns still…”
“You keep claiming that identity theft has occured when there is zero evidence of that. You might want to educate yourself on what identity theft actually is and what fraud is. By educating yourself people will be more inclined to believe what you have to say and value your…”
“Meaning they can flood every bank and credit union to find your accounts. Your upvotes indicate that this community finds the idea of flooding institutions to chase me down to be pleasing. It seems with r / Banking I have stumbled into enemy territory. [re: What is the best way…”
Fraud teams report a surge in account takeovers that bypass existing controls, leaving accounts vulnerable despite standard security measures. The issue is exacerbated by automated systems flagging legitimate actions as suspicious, causing unnecessary disruptions.
SOURCES (26)
“You keep claiming that identity theft has occured when there is zero evidence of that. You might want to educate yourself on what identity theft actually is and what fraud is. By educating yourself people will be more inclined to believe what you have to…”
“Meaning they can flood every bank and credit union to find your accounts. Your upvotes indicate that this community finds the idea of flooding institutions to chase me down to be pleasing. It seems with r / Banking I have stumbled into enemy territory. [re: What is the best way to hide bank accounts while paying a predatory lender, without running afoul of SAR laws or lockouts from layering?]”
“Is this normal? Sadly, yes it's normal for USA banks in an age of rampant check fraud... and coming soon AI-impersonation account takeover. (Most modern banks have given up on voice recognition, SSNs and mother's maiden name as personal identifiers and now use authenticator apps that generate time-generated random digits for access.) [re: Deposit question for larger cashiers check]”
“I agree, this is just traditional card fraud. If criminals had actually gotten in YOUR banking credentials or a wide scale attack, the results are far different. There is a misconception with card fraud that upon occurrence it is due to negligence of the bank. The truth is that these compromises often happen at the merchant's end due to poor PCI compliance, or other transactional handling.”
“Their point makes sense, because people generally don't perform crimes where it's easy to get caught and lose what you took. It's a completely different type of crime.”
“Hi there, so I am going through this right now with my business account, and the bank has denied my claims even wtih the CFPB and IC3 report and everything and still nothing. - I have a full rundown of what happened if you have some time to read, and see if you can give me some advice. This seems to be something so new that I dont see this type of fraud on any websites like FBI - but basically they got in and did digitial bill pay to payees with apple credit cards that are overseen by goldman sa”
“how is it a glitch? people aren't being tricked. they are willing participants in an attempt and dont realize they are part of the losing side and not the winning side. theres no reason person B ever needs to participate in something like this and thats why they're not seen as a victim”
“A valid login doesn't always mean the account is safe. The activity after login, especially payout and account-detail changes, deserves just as much attention.”
“That is just false, many of the big banks have been forced to settle chases that would have found them guilty for fraud. Chase has settled and/or plead guilty several times over the last 15 years for fraud. Granted most of their fraud was big global financial stuff instead of against their users but they still knowingly broke the law. It was not an oversight. They did all of it to make more money. Welsfargo got caught big time 6 years ago defrauding their customers. Why the bank was allowed to e”
“Yes they do all the time. Look up how many times welsfargo has settled cases in just the last 15 years. They got caught signing up their users for services they never asked for, opening accounts they never authorized, and so much more. BoA, chase, all the big banks have pushed shady practices down on its emplpyees by giving them unattainable metrics. Then when it all comes to ligjt they just settle with the government to avoid prosecution and avoid having to admit guilt. They pay a fee that soun”
“I got a scam call today from someone claiming to be with a bank's fraud department. The caller immediately tried to create a sense of panic, saying that multiple people were attempting to open bank accounts using my wife's personal information. He then asked whether I had recently tried to open accounts with JPMorgan Chase, Wells Fargo, or Bank of America. During the conversation, I mentioned that my wife only had a Bank of America account. The caller then said he would have his supervis”
“We leaned on the same idea and moved the check to the sensitive action itself, payout change, new payee, device enrolment, with a factor a lifted session cannot reproduce. A relayed SMS code it can. A live liveness check or a fido2 tap it cannot. still enrolment patterns still gets past velocity rules where the customer is talked into registering the attacker's own device such that it reads as a legitimate new phone rather than a takeover. That needs friction on the environment and contact c”
“Of course, more accounts do mean a larger attack surface. Each card is another merchant storing your details, another portal with login credentials, and another potential breach point. Statistically, more exposure points means higher odds that at least one gets compromised at some point. That said, having many cards doesn't necessarily mean more damage when something does go wrong. Credit cards have strong fraud protections and zero liability policies, so a compromised card number is usually”
“Were you able to recover any funds for your customers or do they just lose everything?”
“Weve had several cases where our members gave them remote access to their devices :/”
“Assume anyone who attempts to contact you is a scammer trying to steal your money and do not click on anything or talk to them or give them any information. If you can afford it, have at least two separate devices. One device is only used for important bank accounts and the email accounts associated with those important accounts. The other device should not ever be used to log in to any important account whatsoever. The email account on that device should be one that you never use for anything i”
“So the victims are still falling for scams. This isn't just happening out of the blue with no involvement from the victim.”
“I had a situation that was a lower level tactic used. Somehow someone added an additional “iPhone” to an account with the same phone number and the bank allowed two iPhones with the same number use the same debit card simultaneously. A second digital card was established by the bank, without shutting down the first. The fraudsters waited a month before draining the account using the counterfeit digital wallet. I still don’t understand how the bank allowed two “iPhones” with the same phone number”
“Post-login behavioral signals are the actual gap here: flag high-velocity profile edits, payee additions on first session from a recognized device, and rapid fund movement before any cooling period. We got burned by the same pattern and tightened around those post auth events specifically. On the social engineering pre-cursor, I've seen doppel come up for catching the external impersonation layer that primes victims before they hand over session credentials, though the immediate fix stays be”
“Login MFA is the wrong place to spend against this because by the time the sessions get lifted its already satisfied. Re-auth on the action holds, a phishing-resistant factor at payout change or new payee, since a replayed session can't produce that the way it relays an sms code. The one caveat is the other pattern in here, customers talked into enrolling the attackers device, which carries a real factor, it needs friction on the enrollment and contact change events themselves.”
“It was just the nature of the transactions, while it wasn't, it was checking all the boxes of a fraud account. Fraud usually starts with smaller amounts and then it escalates.”
“Well, I didn't post about it for engagement in particular. More for awareness: If folks are aware of the specifics of these attacks, they may be more sensitive if someone tries it on them.”
“We as humans know this was very likely parents with good intentions. The algorithm saw a compromised young adult being a money mule.”