What the regulators are saying

The OCC’s Spring 2026 Semiannual Risk Perspective makes four points that bear on fraud.

  • It identifies fraud as a key driver of operational losses, under the heading on compliance and operational risks.
  • It highlights impersonation scams, which can be run through text messages and social media, and says banks continue to struggle with them.
  • It calls for a dynamic, adaptive approach to risk management and points to recent FinCEN alerts on evolving fraud typologies.
  • It says artificial intelligence lowers the barriers for attackers and increases the speed, scale and sophistication of attacks, including fraud. It names multifactor authentication and timely patching as ways to reduce the risk.

The report gives no loss figures for fraud, and it does not say how a bank should organize its response. The organizing idea in this article is ours.

Why separate it

Fraud touches the payments team, the fraud analysts, the IT security group, the BSA officer, branch staff and the vendors that process transactions. When each of them holds a piece, three things tend to go missing: nobody can say what fraud costs the bank in total, nobody owns the decision to tighten or loosen a control, and nobody tests whether the pieces work together. Treating fraud as its own operational risk fixes those three gaps without needing a new department.

That approach also fits the way regulators describe the threat. Impersonation scams reach customers outside the bank’s own systems, so controls that only watch the bank’s side leave a gap.

What to do now

  1. Name one owner. Pick a single person accountable for fraud across the bank, with a standing report to management and the board.
  2. Build one loss picture. Pull together losses from checks, cards, ACH, wires, online banking and customer scams, along with the amount recovered. Review it quarterly, even if the first version is rough.
  3. Test the controls, not just the policies. Check that detection tools flag what you expect, that payment approvals and call-back procedures are followed, and that staff can spot a customer being coached through a scam.
  4. Tell customers what to watch for. Short, regular messages about impersonation scams, including by text and social media, do more than a page on the website.
  5. Cover the basics that AI-enabled attacks exploit. Multifactor authentication and timely patching are the two controls the OCC names.
  6. Check your vendors. Ask the vendors that touch payments or customer data how they detect fraud and how fast they tell you about incidents.

Our IT assessment and audit teams help community banks test fraud controls end to end and tie them to a clear picture of risk.