Fraud Prevention for Bank Leaders: Beyond the Loss Number

Nancy Ozawa (00:06): Welcome to Banking Out Loud. I'm Nancy Ozaua. I'm the chief marketing officer at PCBB and one of your hosts. Joining me today is my host, Virginia Robbins, who's the chief solutions officer at PCBB. Virginia, this is gonna be an interesting podcast. I think this is a different type of podcast for us with quantitative data and kind of looking at it in terms of that foundation and exploring the fraud trends around it and what leaders can do to prepare.

Virginia Robbins (00:33): Nancy, it's great to be with you today and really looking forward to this topic.

Nancy Ozawa (00:37): Yes, I am too. So we're gonna jump into the fraud trends and what the latest survey by the Federal Reserve Financial Services highlights. It researched the pressure that both consumer and financial institutions are facing and how fraud is becoming more identity and scam driven and what leaders can do to prepare. So I know a number of you listeners may not be in the fraud department, and that's great. This is not geared for that specific group. It is geared for all of you VPs and SVPs who are preparing for a higher level, uh, leadership role within your institution. So, uh, fraud doesn't happen just in one department, unfortunately. It happens in operations and it happens in lots of other different areas. So it affects product strategy, customer experience, risk governance, financial planning, basically the institution's ability to innovate responsibly. So it's across the board, so it's everyone's responsibility to, um, be aware of some of these trends.

(01:32): And just to set the stage as far as the impact of it, Javelin Strategy and Research estimate that fraud affects 18 million consumers this year, and that costs $27 billion. If you throw in scams, it actually jumps up to 36 million victims. So we're talking about a large number. We're definitely talking about a very big issue here. To get started, I'm pleased to welcome two of our guests today. First is Rob Williams, author of the 2026 Financial Institution Risk Officer Survey. Rob has spent 27 years with the Federal Reserve Bank as a product development director and brings his deep expertise in payment systems, organizational governance, and structured decision making. He is now CEO of Opras, a consulting firm that helps organizations make high stake decisions. Welcome, Rob.

Rob Williams (02:23): Thank you, Nancy. And thank you, Virginia, for having us.

Nancy Ozawa (02:27): Absolutely. And we are also joined by Ben Wallach, partner and CEO of Mission Omega, a fraud services firm that helps financial institutions fight fraud and scams through assessment, training, and specialized expertise. Ben is a seasoned financial services executive with 30 years of experience and more than 25 years leading fraud programs. And before that, he was the EVP and chief fraud director at BBT's enterprise fraud program. So both very interesting backgrounds, gonna bring a lot to this particular podcast. So Rob, let's start with the big picture. So we've got a listener on the phone. They're in a community financial institution. Maybe they haven't read the risk officer report. What are some of the most important fraud findings that you think they should know just from the basics? What's that overview picture for them?

Rob Williams (03:18): Yeah, Nancy. Um, so the report that you mentioned was published earlier this year, uh, and it's available to folks out there on frbservices.org. So please feel free to go out there and take a look at it. I think you'll find the information useful. So, um, I think the first thing that I would wanna point out, given our limited time, 18-page reports packed full of information in a very condensed way. It's more like an espresso than a latte. I would, first of all, point out, and I think you've kind of already created this urgency for the audience, what's happening with attempts and losses. I think attempts show fraud pressure where losses show control effectiveness. So if we look at the results of the study, you'll see that across payment channels, financial institutions report significant, uh, attempts and losses. We talk about banks who experienced attempts and banks who experienced losses.

(04:16): What's particularly useful is to compare these attempts to the losses. As I mentioned earlier, attempts show us where pressure's building. So if you, uh, see attempts growing at your institution, that tells you that you're on the board for some of the fraudsters out there. They're checking you out. They're looking for opportunity to, uh, uh, get into your business and to get into your platforms and impact your customers. When you look at the controls themselves, the losses, you have the opportunity to say, "Well, how effective are our controls in terms of mitigating and preventing, um, this impact, uh, to our institution?" So I think it's a super useful tool and way to get, uh, that work done. I think also if you'll look at the various payment types, um, it gives you a sense of where attempts and attack vectors, um, are working themselves out. So like ACH debits, uh, classic red flag for information security.

(05:12): If you have an internal staff member that's selling bank account numbers out to fraudsters, um, uh, tool of choice could be ACH debits. Um, fraud wires or ACH credits, another great example. It tells you how effective your business banking applications may be in terms of credentials. Um, how are people getting in and sending, uh, these wires or the pressure from, uh, scammers in terms of, um, business email compromise. Uh, checks, great, uh, red flag for localized mail, uh, theft. Um, and then also friendly fraud and what that says about your account holders and their, um, understanding of the bank laws and their understanding of how they might be able to manipulate some of those rules to get around that. And if they're willing to do that, what other choices might they be making?

Nancy Ozawa (06:03): Just for some listeners who might not be familiar with some of the terms friendly fraud, do you wanna help define that for some that might be outside of the fraud department?

Rob Williams (06:11): I will try to give you a good definition there, Nancy. I look at that as, uh, either one, family members who are using the card or some payment method of their siblings or their parents. And also, um, yes, it was me, but I don't wanna pay for this, so I'll claim that I didn't, um, you know, that I didn't buy that. Um, and once they kind of see those... I think once they kinda see the banking system as a way to sort of, you know, profit, um, that can be, um, habitual, uh, for lack of a better description. Does that help, Nancy?

Nancy Ozawa (06:44): It does. And I, I think I would add in one other group is a lot of times people think it has to be a family member to c - be considered friendly, but it could be a roommate. So in college, uh, young adults who are rooming with other adults, that's where the friendly fraud connect with someone.

Ben Wallach (06:58): Yeah, Nancy, it does, it doesn't mean they're on your Christmas card list, right? It just means that they're close enough to you to gain access to information to where, you know, they can perpetrate fraud on your accounts. Absolutely.

Nancy Ozawa (07:11): Exactly. Exactly. Now, Rob, in the, the, this particular report, I know there was a number of payment types that you looked at, but I was intrigued that debit card was the one that was getting the highest attempts and the highest losses across all. Do you have any thoughts on why that is?

Rob Williams (07:27): Yeah, Nancy, I think that's expected probably by most bankers. Uh, debit by its very nature was designed to absorb losses. Um, they priced in loss and fraud and risk into, uh, card products. Uh, a lot of the other products, check, ACH, um, they never, like, those products never priced in risk. So the, the, the impact of a loss in, um, ACH can be, you know, much harder to the bank. It might go directly to the bottom line, whereas in debit, they may have the revenue to absorb the loss. If your losses are greater than your revenue, that's certainly a challenge.

Ben Wallach (08:04): Yeah, Nancy, I would just add, um, what we're looking at is where the cash out occurred, right? Where the, where the fraud loss occurred. We're not looking at the, the holistic picture of everywhere that the fraudster touched the institution. You know, for example, this, a lot of the fraud could start by checking the IVR to see if it's an active account before they do anything, check balances to see how much they can do if they do anything. Um, so there's a lot of activity. Think of, think of fraudsters as super users, right? They're super customers. They are using every touchpoint in the institution to commit the fraud, but what we're looking at in, in Rob's report is where did the cash out occur, if that makes sense.

Nancy Ozawa (08:45): It does.

Rob Williams (08:45): Yeah, I think you're teasing out a, an important topic there, Ben, because when we, when we compare these attempts to losses, um, I think it would be very easy for a bank to say, "Hey, look at this ratio of attempts that's going up, but our losses are coming down. We must have a great program. Um, we can rest easy. We can take some funds out of, uh, fraud management. Maybe we don't need that cost center as much anymore. Maybe we've, maybe we finally beat those guys." And that's a d - can be deceptive because, uh, sometimes that rise in attempts, uh, to Ben's point, are all those methods by which they're testing your system to figure out where they can really hit a payday. So sometimes that's not the time to say, "Oh, we got this," and, uh, you know, put your feet up.

Ben Wallach (09:32): It's so important to have a strong analytics function so you can dissect this data and really understand what is inside of the data, um, and not, not let the data mislead you, because a lot of times executives will look at the data and go, "Oh, we're great. Let's not invest anymore in the fraud program," when in reality, you need to invest more right now than ever before, no matter what your loss figures show.

Virginia Robbins (09:55): And, and Ben, and Rob, what you both touched on is you, analytics are great, but you also have to look at this holistically. You may have an issue in one product that you've solved, but if you're not looking at all of your products, you may be missing something else that's going on as your fraudsters looking at your institution, or quite frankly, could also be probing your customers to see how to get into your institution. So, um, this is an ever vigilant type of, uh, world we live in these days.

Rob Williams (10:26): Yeah, I think that's a great point, Virginia. You need to be able to kind of diagnose where the real, uh, red flags are, where the real hotspots are to be able to anticipate what the next move is. Um, if you're not trying to anticipate the next move, if you're just trying to stop the, you know, plug the dam, that's not a very good strategy.

Ben Wallach (10:46): A lot of that goes back to what is their intention? And that takes a very strong analytics function to actually dissect what, what is the fraudster's intention? Um, going back to the IVR example, and this applies largely to digital as well, the fraudsters spend a great deal of time in the IVR and in the digital channel. They may not move as much money in those channels, but they spend a great deal of time doing their research and those channels. So if you actually move your analytics upfront to the front end of their research, then you're gonna really curtail a lot of their, uh, losses on the back end.

Nancy Ozawa (11:21): A lot of people might focus on this by the different payment types that are being impacted, but there's some common trends. When I was reading through the report, it was interesting that really we're starting to talk about how they're abusing credentials or identity manipulating the customer and being able to use that to get into multiple, uh, different types of payment, uh, types and get the fraud to occur successfully for them. How do you, uh, help an institution look at it?

Ben Wallach (11:46): Well, that, first of all, I think it's a, it's a great illustration of our need for fraud prevention actually looking forward into the future where things are moving and progressing. When we started tokenizing transactions, we pushed them to the identity layer and the authentication layer, and that's where we pushed a lot of risk, and we weren't ready for it as an industry. So I think really looking at things from a preventative perspective and, and assessing your products and services before they roll out or before updates roll out to them, it's, it's so very important. And that makes you have to detect less and mitigate less, and that, and that helps you have to resolve less. So just having more of a preventative mindset helps in that regard because the identity and authentication issues we face today is a great example of us not being ready and us pushing the fraud to another area that we were not ready for.

Rob Williams (12:36): Because, uh, transactions are moving to digital platforms, the fraud is also moving to digital platforms. So the trend that we see, um, is that the fraudsters are figuring out how do we use, manipulate, um, drive these digital and identity platforms to, um, you know, to do our business or to, um, to defraud consumers or account holders or financial institutions. Um, so that's really where the battle itself is. I think account takeover is a, a key area, hot area. Credentials is the key of that. Our ability to secure our access. Another is our, um, authentication, like impersonation. Do we know who this person is? And I think that's true on the scam side as well as, uh, in the financial institution itself as we're trying to authenticate users coming into our platform. You know, I think two years ago, the regulators took, uh, attention off of, uh, reputation risk for financial institutions.

(13:42): A couple of the hotspots were people, uh, saying they're from your bank, so, uh, uh, imposters, banking imposters. I'm, I'm from your bank. Oh, and I need your, you know, your user ID, or whatever it may be. Um, that was a key area of, um, focus that came out of this research. And I, I think there is a progression there where they, uh, begin to study your clientele through social media, um, try to take over your name through social media as a financial institution. And so there are things like that that are going on in the market, that common things like there's vendors like Meltwater that allow you to see like, "Oh, our name is spiking in the, in, on social media for some reason. Um, why is that?" Um, so I think that's a great area where f - all financial institutions need to stay on top of even, um, if the regulators aren't making it as big of a focus.

(14:36): And the fact that, uh, I think the other key thing is even papers going digital now, what used to be a payment instrument, uh, check, um, now is 80 to 90% deposited as a digital image. So fraudsters don't need to make that check in paper even. Um, just take an image, uh, that you can buy online and, you know, replicate it, change the data. And that's why I think the security of data is so critical, account numbers, et cetera, and I think this reflects some of the attempts. Um, you know, what's the availability of the data, card number versus bank account number, and then what's the source and market for that data? Like, um, can I go out on the dark web and buy your information? And do you have an internal staff member who's selling that information? Things of like that kind of lend themselves together to see what type of fraud events are coming out.

(15:26): And what Virginia was talking about earlier is being able to diagnose that by saying, "Here's the kind of fraud and how it fits into a payment channel." The front has evolved, but the back, it's a cost center. You're not gonna invest unless you have to. So that's a real struggle for the industry.

Ben Wallach (15:40): Yeah. And, and we only get investments where there are losses. This goes back to if institutions just measure losses and they just react to, to losses, then they're only gonna be in that reactionary mode of operation, right? So, and that goes back to, you know, if you're not monitoring every click of your digital channel, you're not gonna know if somebody is in the account online taking images of real checks, signatures, account sequencing, dollar sequence, all those things, who you pay, when you pay, all those kind of things. They're - Yeah. They're in your, in your online check register and all the images are there and you can print them perfect these days. Um, but you, you've gotta have an investment to put monitoring capabilities around that.

Nancy Ozawa (16:24): I think the mindset that somebody once said that stuck with me is this is the fraudster's career path. They invest and train very seriously to be successful, just like we all invest in our careers to be successful. They are doing this as well in that same mindset, and they're getting better and better at it as well. We just gotta be better and better beyond that.

Rob Williams (16:46): Yeah, the bank's loss is the fraudster's game. So the banking industry needs to think of that loss, not as a, um, just a loss or money disappearing into the vapor, but it's an investment in the, um, fraudsters enterprise. Any other thoughts on that, Ben?

Ben Wallach (17:04): Yeah, I mean, if you just take Nancy's recent loss numbers and you look at those numbers over the, you know, the life of my, uh, career, that's anywhere from 500 billion to a trillion dollars in losses. And not saying that all went to one entity, one organization, but if a small percentage of that went to one organization, that's a well-funded, well-disciplined organization now that's coming back for more, you know? So if, if we let an accounting term like loss drive our strategy on fraud, then we're never gonna win. We're always gonna be behind, right? So that's, that's kinda where I brought that premise up where we need to make sure we're thinking about fraud more strategically. It's having conversations at the board level, C-suite level, all those, the discussions so that it's a strategic decision, "Hey, we want these outcomes to happen," instead of them being afterthoughts.

(17:55): You know, I was a fraud leader in the banks for, for 25 years, and I worked at a lot of large banks. We had one conversation each year about what expectations were in the company about fraud, and it was what's the fraud loss appetite? And then the next day, I'd go back to my office and I'd have emails about this client experience issue, this risk issue, this is... So I'd get a thousand emails from other people in the company about outcomes that they were concerned about, but we only talked about strategized around one, and that was what's our loss appetite? If we don't have a paradigm shift, uh, within every institution around that, we're, we're never gonna get anywhere, you know? And I think we are going through a cycle right now. If you look back 100 years, banks go through a pretty consistent cycle of they work on growth and then they focus on trust, and they focus on growth, and they focus on trust.

(18:44): And that's a pretty replicated cycle over the past 100 years. Right now, we're cycling into trust. And if we're gonna win at that, then we're gonna have to get fraud leadership at the C-suite and the board conversations so that this paradigm can change. Otherwise, the fraudsters are gonna continue to be the happiest customers.

Virginia Robbins (19:03): So, so, Nancy, let's follow through on this though. It, uh, and this great wealth transfer that we're talking about. There's one that we're talking about, you know, boomers retiring. This is another one that's been going on about fraudsters using AI and becoming more sophisticated, being more incented. So, I'm in my institution. I wanna talk to my managers. I'm concerned that we're only looking after the horse has left the barn. We're not spending enough time and energy thinking about, you know, how should we build the barn? How should we staff the barn? What should be in the barn? How do I help sell this to my senior management?

Ben Wallach (19:39): I think the senior management's probably having all the conversations about the outcomes that they want to manage to. So, I think it's then helping them translate that into fraud management terms. Okay, if you, if you want the client experience to be this, and you want the risk discipline to be this, and you want the, the, the loss to be this and the overhead to be this, then here's the environment that we have to build to make sure that we are looking at fraud the right way. And you can, you can tell a mature fraud discipline if they've got people focused on prevention. Those are the people that are eyes up, looking forward, looking at what's over the horizon, both from a new product and services perspective and a new fraud threat perspective, but they're constantly looking forward. They don't get caught up in the day-to-day fraud trends and the tactical things they're constantly looking forward.

(20:27): Then you've got a detection discipline that's constantly focused on, "I've got to detect and mitigate the fraud that's coming through the pipeline today, and I've got to focus on that." And then you've got a resolution team that's very focused on, "Okay, this fraud was or wasn't detected, but it obviously wasn't mitigated to the point where it didn't make it to me, so I got to resolve it," right? They're very focused. And you've got those three disciplines that are very focused, and then you'll be able to manage to all the outcomes that are important. But I, I, I have a feeling all the outcomes are being discussed today. It's just having somebody that's seen this from 100,000 foot altitude that knows how to have the right conversations for them to say, "Okay, if these are the outcomes you want, this is how we get there."

Virginia Robbins (21:08): So when we think about some of these other larger pictures items, um, Ben, you know, you're a seasoned anti-fraud practitioner. What are the first sort of warning signs that you would advise, um, a, a middle manager in a bank to be looking for? We've touched on some of them in terms of trust. Uh, Rob, you've talked on some in terms of account opening and other protections and managing that, but are there other major trends that we should be looking for and having our, our listeners focus in on?

Ben Wallach (21:40): If the customers are reporting fraud to the institution more than the institution's reporting fraud to the customers, then that's a sign of a major issue inside their, their fraud management discipline. Um, and so that's, that's one thing that they can see very easily, right?

Virginia Robbins (21:56): It's really, really painful when you have a prime customer, uh, uh, whether they're profitable or they've been with your bank since the day you opened, or they're a leader in the community and they're affected by fraud. Um, that's a really hard decision for the institution. So when we approach that, are there other ways that we can think about that issue and/or think about data around that issue that might help us inform our decision as to whether or not we retain this customer or we don't retain this customer?

Ben Wallach (22:28): Yeah, there's, there's certain things I kind of liken it to our driver's license, right? If we were constantly running into other people, running stop signs, things like that, then, you know, w- we would eventually lose our driver's license, right? Because we have the point system on our license. But we have, a lot of times in institutions, they let clients go through process after process of knowing that, okay, they, maybe they don't need to be online. Maybe their, their online hygiene isn't where we need it to be, and we're actually putting them at risk by allowing them to, to bank online or to use their mobile device. And so I think we've got to start looking at things, um, outside the current paradigm that we've built from a, a product and channel and all these things, the way we think about fraud, again, because we think of it as where they cash out.

(23:13): We think about it as loss reports. So we kind of, we close ourselves in and our way of thinking. So I think we got to bring it back out and look at their banking relationship and how the fraudsters are actually coming at them today and, and look at our customers differently and what they're facing in the real world.

Rob Williams (23:31): Risk can also be, like, if we take product development and flip it, um, a lot of times we think of product development as an, an additive feature, like I'm gonna give people more features. I think too, when you're dealing with an account like that, can we take away features? Is there a way to recreate a product that reduces the risk? If you, you don't have to totally cut them off, but maybe you find ways to manage and control their weak spots, um, without necessarily completely isolating them or completely, you know, pushing them out.

Ben Wallach (24:02): Exactly. Just to look at it generationally, does a baby boomer want, need the same things as a Gen Z, millennial kind of thing, right? So if one customer's never gonna write checks and they're always gonna be digital, then why even give them the ability to write checks? In fact, if everything in their world is tokenized, why even give them the account routing number? Because then you're removing risk from them and their day-to-day lives because we're giving them a DDA account that has the same risk bookprint as every other DDA account that we generate.

Virginia Robbins (24:35): So we've wandered now into product development and product though and the rest of that. So I love, I love where we're headed here because the concept here is actually not only segment your customer and design the products to match your customer by their business, but also their risk profile.

Ben Wallach (24:53): Well, I think if I look back in time, if we're in that, that growth cycle and I look back in time over a lot of growth, what we had to do was we had to reduce our product types over time to make it easier for all the M&A activity. And so we went from 20 DDA accounts to three because it made it easy to go, I just bought, you know, bank A, bought bank B, and they've got three DDAs, we've got three, so that just makes it easy, right? So let's all collapse our, our products. So I can remember that going all the way back to my technology days before I even got into, uh, fraud management. So, so fast-forward to today, we're, we're coming out of that growth cycle, we're moving into the trust cycle again. What do we have to do? What do we have to rethink?

(25:33): We may need to think of our products differently now by generation, by use case, by what does this customer actually need and how can we change their risk exposure and just give them what they need so that we're not giving every client the same risk exposure?

Rob Williams (25:49): I think that this is particularly relevant in light of what's happening with, um, instant and faster payments in the industry as instant is really an evolution of the banking back office, uh, is really what it is. It gives you a chance to have that, um, that upfront audit - authentication or authorization that debit provides in credit push. That's really the, you know, the key component of that innovation. But in order for that to work, everybody's systems kind of have to be always hot and always online versus, um, kind of the, you know, the good funds model that the banking industry's operated on for the last, who, who knows, 80 years, maybe more. So I think that this, that's what makes this topic super critical, is especially like products like credit push are an obvious opportunity for account takeover. Uh, they rely very much on the strength of your digital credential and security.

(26:48): And I think also w - as you're bringing the risk person to the table in a product conversation, having been a product guy most of my career, we tried to keep the risk people to arm's length because we didn't want them to sabotaging our work to some degree. That was the, at least the way we kind of thought about it. And you, sometimes you didn't know, like, well, what card were they gonna play in the meeting? I think that that's a critical kind of, um, cultural change that financial institutions have to develop, um, to recognize that kind of we're all working together versus this is a chess match of, you know, see if I can figure this out before the other guy, you know, blocks me on this. And I think there are ways you could roll out products, um, to do that effectively. Does that make sense?

Virginia Robbins (27:41): It does a great deal. And, and when we think about it, the other side of this coin is educating our customers. You know, we can design great products, we can line them up to the niche, but if our customers don't understand why we've designed this product and we don't market it effectively, um, then other challenges happen. So are there any good tools or areas that you've seen in terms of customer education?

Ben Wallach (28:05): I think for me, the, the first place it starts is making sure that there's a shared responsibility, because the first thing that the customer has to think in their mind is, "I have a reason for digesting all this education that the institution's sending my way, right? So, so we've got to do a little bit of reprogramming there because our, our zero liability campaign worked so well for decades. And if you look up the definition of liability, it is responsibility. So think about that. I have zero responsibility, yet you keep throwing all this training at me. I don't understand. If I have no responsibility, why do you constantly send me this training because I'm not reading it? I don't need it. I'm not responsible." So we gotta do a little bit of retraining on the shared responsibility. We're on calls with them and they're just like, "So what are you gonna do about it?" Right?

(28:57): Because they have zero responsibility because we told them that they did. So I think we've gotta re-baseline with every customer that, that shared responsibility. And it is a scary world we operate in, and no doubt we don't wanna scare our customers too bad, but we gotta give them enough insight to, to know exactly what they're dealing with out there, because the pendulum has smooth, moved from the banks being the main focus of the target to the customers. Now you fast-forward to the digital world and somebody gets into their account and they know it. If they log in, they know it. If they do a transaction, they know it. So that's, that's very different for the customer. So we gotta level set expectations.

Rob Williams (29:36): Yeah, I think you're

Ben Wallach (29:37): Right,

Rob Williams (29:37): Ben. I think

Ben Wallach (29:37): The

Rob Williams (29:38): Other aspect of that is customers value that knowledge when it's immediate and relevant to what I'm seeing today. If, if you send me an email that's 500 words explaining to me everything I need to know to ensure that my account stays safe, I'm probably not gonna read it. But if it's a relevant pop-up alert, it says, "Oh wow, this bank is Paying attention. This bank cares about my concern. Um, and if it's framed that way, then I think you can turn that, this risk, this challenge into like a, you know, a, um, benefit for the organization and a positive impact to your reputation with your customers.

Virginia Robbins (30:21): Rob, I love what you said about keeping it short because, you know, a lot of times people are looking at things on their phone too, so I've got to be able to read it quickly and, and, um, concisely. One of the things we've talked about here is we've talked about product development. We've talked about that fraud is really wealth transfer. We've, we've hit on a lot of different topics here. If I'm sitting in the middle management and I'm thinking now, I've got all these additional things to do, how do I process all this work and the fact that it, it feels like it's limiting my ability to innovate in my institution? Uh, can you help me explain to my managers why I need to take a little bit more time now to work through a product and to work through a product launch?

Ben Wallach (31:06): From my perspective, I think it's critical to get the product right when it rolls out and not let the, the fraudsters find the weaknesses in the rollout. If you go all the way back to when we rolled out Zelle, um, we did a, uh, the bank I was at at the time, we did a full fraud risk assessment of the Zelle rollout and the, the results showed what exactly we needed to do and how we needed to fund that and what was gonna happen if we didn't. And it was so clear that the powers that be said, "We gotta fund this. We've got to fund this." So, so we funded it and we implemented the right controls and we did not have the same issues that some people did when they rolled out Zelle. So it was a little bit painful because going back to Rob's earlier point, sometimes it feels like you're trying to stop ideation.

(31:52): Um, and I understand that because, you know, the, the early days of where fraud grew up, fraud grew up as a loss line in a P&L somewhere, right? So we've got to get an invite to the strategy table and we've got to help our product partners ideate. And that's where you can, you can really build the, the best of cloud products and services. When you roll them out tight and they're secure when you roll them out and the fraudsters can't immediately find weaknesses, they're gonna go somewhere else.

Rob Williams (32:18): You don't wanna roll out a payment product and then tell people, "Sorry, you can't use it anymore," or you don't wanna roll out a payment product and take on huge losses. But I, I think you can mitigate that with whether it's special customer groups that you do early rollouts with who are maybe more sophisticated, they're well trusted, they're willing to give you feedback. Um, and do you have groups like that where you're, you know, you're listening to your customer's voice and you're letting them experience things maybe before others get it so you have a little time to learn?

Ben Wallach (32:50): Yeah, I think if, if we also focus on education, and a lot of times we get excited about the aspect of a rollout of new technology, if we think about the education of the customer base and possibly even start with our employees, then that's gonna help because not only does that help them advance the utilization of their, their products and services, and it helps you test the bits and bytes of the new digital, digital capabilities, it also prepares them to resolve problems that clients are gonna run into when they start to move to those products and services. So I think education of our, of our employees and our customers, but mostly our employees first is so important and sometimes missed in that product development lifecycle.

Virginia Robbins (33:31): So in short, shiny objects are great, but make sure you understand them. And two, you know, really know your customer, not in, you know, always in the BSA sense, but also know who can absorb what risk, where your sophisticated customers are, how can your customers help you as you design your products and, and test and roll them out. That's awesome. Thank you.

Ben Wallach (33:51): And sometimes your, your fraud teams will, will know your customers as well as your product teams. I'll give you a prime example. One of the large banks I worked at, I was in, in the wholesale space and I was passing by my, my product partner and we were just catching up, you know, having coffee, "What are you working on? What are you working on?" And he told me, he said, "Oh, I'm, I'm getting ready to, to put the, you know, put the balance on the wire screen for the, for the customer. You know, I think they'll like it." I said, "Oh, well, you should talk to my team because we've just done some, some great analysis on that." And what our analysis showed was legitimate customers looked at balance 0.4% of the time before they create a wire, whereas the fraudsters looked at balance 97% of the time before they created a wire.

(34:34): So we actually had the data, right? The product teams were just, "What's next? What's next?" Right? So nothing against them. They were just trying to think of the next best thing. So sometimes your fraud teams will have rich, rich data that you can use in your product development.

Virginia Robbins (34:48): And for smaller institutions, it's often making sure that the branch staff is talking to the operation staff, which is talking to the sales staff. So again, more conversations within institutions help all of us.

Rob Williams (35:01): So thinking about our enterprise and what early flags we can derive from the other payment channels, I think you have to have a fraud team to be able to do that successfully. You've got to watch for those flags across more than one payment channel. I think it's really easy for us to put the fraud control and the risk management into a single channel. Um, but that's not where you're gonna really derive your, your maximum value.

Ben Wallach (35:24): That's right. And that's where the fraud risk assessment at an enterprise level is so important because if you purely look at, at your losses, then you get into that whole modality of I'm just gonna manage to the losses and therefore I'm reactionary instead of proactive and preventative.

Nancy Ozawa (35:39): Absolutely. Well, I think we could continue this conversation for a couple more hours. Um, but I want to see if we can start to bucket this up because we've, we've touched on a lot of things. We've touched on the different type of fraud types. We've touched on product development, whether you pull back features or bring risk, uh, closer into the product development cycle. I love the concept of reeducating the customer, um, from zero liability to shared responsibility. But let's see if we can start bucketing this up for our listeners. So if they've been getting all of these great ideas, um, and they're kind of a VP, SVP sitting in the middle of the institution, Ben and Rob, what's the one tip or one action that you would recommend them to do, whether it's to think a different way, it's to try something different, it's to get involved, whatever it is, h- how do they translate this into action for themselves after listening to this conversation?

Ben Wallach (36:37): For, for me, it's get, get your, get yourself educated on, on fraud. What, what are all the threats that are, that are facing the, the financial services industry right now? What are the threats that are coming through tomorrow, right? Become educated and knowledgeable in those things. And then how do those things manifest themselves against your current product and service offering and your future product services offering? Where those intersect is where your fraud risk lies. And when you understand that, then you're gonna be better equipped to deal with all these things that, that you're facing and your, your customers are facing. And luckily we've got this, this cool new tool. I don't know if anybody's heard of it, but it's called AI, right? So you can actually consume a lot of information very quickly. Don't trust it all. It does hallucinate from time to time. I think education is, is the absolute mo- most important thing.

Nancy Ozawa (37:27): That's great. Rob, what would you tell the listeners?

Rob Williams (37:30): What I would say is how do you utilize it? AI is a good example of a way to bring, like, lots of information together and to be able to produce something that you can leverage. Um, kind of to my earlier comment about being a learning institution, how are you capturing, um, what you learned and then how are you leveraging that in a way going forward so that you can see what direction you're headed, you can see what decisions you made, um, you know, failed you, what decisions you made to helped you, and which ones gave you the best return. I would encourage middle managers and senior managers to kind of focus on how are we measuring it, how are we getting it to one place where we can utilize it? Uh, it's one thing to have a lot of information, a lot of data, and then you struggle with, now what do I do with it?

(38:24): I can't tell you how many, um, initiatives I worked on where it was like, okay, let's do this really elaborate survey. We do an elaborate survey. We got all the results in, we got good participation. No, I don't know what to do with it. It just gets put to the side and nobody ever actually learns or leverages anything. So I think that's my key, Nancy, is how do you work on becoming a learning organization so that you can, uh, you know, progress in that process or bring that knowledge in from outside if you don't have it, so.

Nancy Ozawa (38:55): Yeah. Yeah. And to your point, it's, if, if you're gonna do all of that effort, have a goal. State your goal, say, state your success factor, state what you're gonna do with it. We, we use a word charter in our, our practice in marketing and, you know, we know what we're gonna do with it. We know what success looks like when we get there. So that's a really good point, Rob.

Virginia Robbins (39:15): And then, Nancy, your last thing I'd say is share it within your organization. Share this, um, because likely there's others thinking like you, um, but if they don't know what you're working on and how you're working through it, um, you don't help the entire organization.

Nancy Ozawa (39:30): Absolutely. Thank you for putting the icing on the cake just now. It was a, all three of you are great. Well, for our listeners, we, we've covered a lot of ground here and I think there's a lot of key takeaways. What we're hearing is that fraud and product development should be going together. They're not slowing down innovation. You really need to have more education, you need to have more communication within the company, uh, the right controls, the governance and the whole components of that. So that's all for today's conversation on fraud. Rob, Ben, thank you so much for sharing your perspective. Here at PCBB, we're committed to helping community financial institutions understand the trends shaping thinking and approaching change thoughtfully and responsibly. Through banking out loud, our goal is to bring you practical ideas, useful language, and real world perspectives you can bring back to your deans.

(40:19): To make sure you don't miss future episodes, please subscribe to Banking Out Loud on your favorite podcast platform, like iHeartRadio, Apple Podcast, and others, or you can go to our website, pcbb.com and subscribe and you can get an email when we drop our next episode. If there's a topic you would like to, to cover or you're interested in joining us, please contact us at bankingoutloud@pcbb.com. Thanks for listening. Until next time, have a great day.