Banks are dealing with more fraud in which customers authorize payments after being manipulated by criminals. ThreatMark’s Fraud Readiness Benchmark 2026 describes a banking environment where social engineering, reimbursement requirements and growing case volumes are changing fraud operations.
Social engineering moves the risk into the customer interaction
Fifty-five percent of institutions surveyed said social engineering is involved in most of their fraud. Criminals may pose as bank employees or other trusted people to persuade customers to send money.
A customer may use legitimate credentials and approve the transaction themselves. Controls designed to detect stolen credentials, suspicious devices or account takeover may therefore see what appears to be a legitimate customer completing a normal transaction.
Fraud teams are paying more attention to behavior during banking sessions. They are looking for signs that a customer may be under pressure or following another person’s instructions before money leaves the account.
Behavioral intelligence moves into fraud programs
Behavioral intelligence is one technology used to identify these signs. It can establish patterns in how a customer interacts with a banking service and detect changes during a session. Signals may include unusual hesitation, repeated steps or an uncharacteristically large transfer to a new payee.
Eighty-three percent of respondents rated behavioral intelligence as effective for detecting social engineering. Adoption remains limited. Eighteen percent said the technology was already in use, while more institutions are planning deployments.
Behavioral intelligence can add context to other fraud controls by identifying unusual interaction patterns. A payment may pass standard technical checks while the customer’s behavior shows signs that warrant further scrutiny.
Reimbursement rules add pressure
Authorized push payment fraud is becoming a regulatory issue. In these cases, a victim is manipulated into authorizing a transfer to a criminal. The payment originates from the legitimate account holder, which can complicate detection and recovery.
In North America, 69% of respondents expect regulation requiring reimbursement for authorized push payment fraud within two years. Thirty-one percent said their institutions are prepared for such a requirement at present.
Reimbursement requirements can move more of the financial cost of scams to banks and payment providers. They create work around claims, investigations, customer communication and recovery. Detecting fraud earlier can stop some transactions before those processes are needed.
AI takes on more investigation work
Fraud teams are using AI to process cases after alerts are generated. Investigations can require analysts to gather information from several systems, trace transactions, review communications and build a timeline of events.
Ninety-one percent of institutions agreed that AI can significantly shorten fraud investigation times. Applications include connecting related alerts, compiling account activity into a timeline and prioritizing cases by risk.
AI can help teams manage case volumes and direct analysts to cases that require human judgment. Faster investigations can provide more time to freeze funds or coordinate recovery after fraud is detected. Automation can also reduce the routine investigative work required for each case.
Fraud and cybersecurity work is converging
Fraud and cybersecurity teams deal with many of the same threats, including phishing, malware, credential theft and account takeover. Many fraud professionals now have cybersecurity responsibilities, bringing fraud and cyber threat information into more closely connected workflows. The report found that 81% of fraud professionals surveyed also carry cybersecurity responsibilities.
Banks are also working with outside providers and fraud intelligence-sharing networks. Shared information can help institutions identify scam campaigns, suspicious accounts and attack patterns that appear across multiple organizations. Data privacy and compliance requirements remain part of these efforts.
A key challenge is detecting fraud earlier in the payment process. Social engineering can leave familiar technical signals intact because the legitimate customer is operating the account. Behavioral signals offer another way to identify possible manipulation during the interaction.
This puts more focus on what customers do during a session, whether their behavior differs from established patterns and whether the bank needs to intervene before a payment is completed.
