Insights from ProSight’s State of Fraud Prevention Survey and Fraud Alert Network

Drawing on findings from the 2026 ProSight State of Fraud Prevention Survey, Jason Bartolacci, director of ProSight’s Fraud Alert Network, examines why many financial institutions feel they are falling behind fraudsters. The conversation explores AI-enabled fraud, authorized push payment scams, real-time payments, check fraud, and the growing need for industry-wide collaboration to combat emerging threats.

Subscribe to ProSight Podcasts: Apple, Spotify, Amazon Music, YouTube

TRANSCRIPT:

Frank Devlin: This is the ProSight Banking Strategies Podcast. We’re here to inform you on the top trends, challenges, and opportunities in banking today. ProSight is a leading non-lobbying connector of people and information with deep expertise in risk, fraud, compliance, and retail and commercial banking. Our purpose is to empower financial services leaders to strengthen and advance our industry through training and insights, as well as tools and resources like this podcast.

Hello and welcome to this ProSight Banking Strategies Podcast. I’m Frank Devlin, a senior editor at ProSight. In the 2026 ProSight State of Fraud Prevention Survey, 85% of respondents said the fraud threat landscape is evolving faster than they can respond. That’s a remarkable finding at a time when organizations are investing more than ever in fraud prevention. Criminals are operating at digital speed, leveraging artificial intelligence, exploiting real-time payment systems, and increasingly turning to manipulation of customers rather than technical compromise. At the same time, old-school check fraud is surging. Today, we’ll dive into what these complex survey findings mean for financial institutions, discuss why fraud has become a challenge that no organization can solve alone, and look ahead at the threats and opportunities that could define the fraud landscape through 2027.

Joining us is Jason Bartolacci, director of the ProSight Fraud Alert Network and a certified fraud examiner with over 20 years of experience in fraud risk management, cyber threat intelligence, and financial crimes investigations. Welcome, Jason.

Jason Bartolacci: Great to be here with you, Frank.

Devlin: Thanks for coming. Really appreciate it. So let’s start with the big picture. The survey found, as I noted, that 85% of respondents believe the fraud threat environment is changing faster than they can respond. Why might it feel like the industry is losing ground despite growing investments in fraud prevention? And the survey noted that everyone’s budget is going up, and some are going up more than 10% here.

Bartolacci: So there’s a lot going off with fraud right now. I think we’re seeing year-over-year increases with fraud losses, and fraud rates are climbing. I think there’s a lot of reasons for that. Probably first is the fraud threat actors, the criminals, they’re easily adaptable, so they’re sharing information, they’re learning how to commit fraud. They’re able to do this at scale. They’re not really restricted by any of the same restrictions that banks and credit unions and other financial institutions have in place, such as regulations or compliance, when they’re combating fraud. You’ve got a whole ecosystem of fraud threat actors that communicate on platforms like Telegram who are sharing their insights and their know-how with other groups. And really the payout is pretty big. So if you look at some of the fraud numbers that are out there with how much each bank is losing or each credit union is losing in terms of fraud, the numbers are pretty high. So all that creates a threat landscape that makes it hard for banks to keep up.

Devlin: You mentioned Telegram, and then so then there are also other places in the dark web and internet, and that’s kind of new technology. But at the same time, check fraud in the survey was identified as both the largest loss exposure and the fastest growing type of fraud for many institutions. Why is this decades, and I think, as you’ve mentioned, in the past, centuries-old fraud schemes still causing so much damage in this digital-first world?

Bartolacci: This is a great topic. This always fascinates me why check fraud is still such an issue. But a couple things. So banks have fortified their digital defenses. It’s pretty tough to hack into a bank. Check fraud’s old-school and it’s easy. So that barrier to entry for the fraudsters with check fraud is pretty low.

The second thing that’s going on is platforms like Telegram will share exactly how to commit check fraud. They sell check images. They sell physical checks that can be mailed to fraud threat actors, so you can buy these checks. Mail theft has surged over the past couple years. It’s very low-tech. It’s very easy to do.

And I think importantly, too, check fraud can be high dollar amounts in terms of fraud losses. So especially business checking, a fraud threat actor can get tens of thousands of dollars from a counterfeited or manipulated check just in one instance. All those things create kind of a perfect storm for check fraud. It’s just easy to do.

Devlin: And you only have to be right once if you’re the fraudster, if you can get off with the tens of thousands of dollars. You mentioned about banks do have stronger perimeters that’s kind of maybe opened the door for check fraud, but also working within the confines of the parameters, you can find a way in as a fraudster. If you can take advantage of a customer and just convince them to hand over their money, that’s the best thing if you’re a fraudster. So can you talk about that dynamic, how long it’s been happening, why it’s been happening, what can be done about it?

Bartolacci: We’re making the distinction between traditional fraud and scams. Of course, this has been around forever. These Nigerian 419-type scams preyed on folks to prepay taxes on an inheritance or some kind of money that was sitting there, and that’s just evolved with how the technology is. You have a lot of scams out there that use things like phishing sites and phishing emails, texts, so now everybody’s getting texts. Not completely new, but for the last 10, 15, 20 years, text has been an increasing form of communication. Of course, the fraudsters are going to use text. So we start seeing things like text messages to intended victims that they had to pay a toll or their driver’s license would be suspended, or the IRS was asking for money, click on this link. Basically what they’re doing is harvesting credentials through those malicious links. And it’s really easy too, Frank, for a fraud threat actor to send out tens of thousands of texts. And as you mentioned, you only have to be right once or twice. This is very easy for these fraud threat actors to do.

And to your point, kind of pivoting off of that, the digital channels are pretty fortified for a bank or credit union. But if you can get somebody to give up their credentials by impersonating a bank employee or a law enforcement official or a government official, we’re seeing one-time passcode being bypassed or overridden. It’s pretty easy to bypass that control because, again, you’re impersonating a bank, you’re getting the victim to give up their one-time passcode or their username, their password. It’s pretty easy to do. And we’re seeing those fraud losses significantly increase over the past couple years.

Devlin: Again, we’re at this kind of mix of old-school fraud, new fraud, and another concept, another area of new fraud and makes it more challenging to defend is real-time payments because in a split second, that money’s gone. How has the rise of real-time payments changed the fraud prevention challenge?

Bartolacci: Any new technology or convenience that makes it easy for the customer or the consumer, you’re also going to make it easy for the fraud threat actor. I mean, real-time payments is real-time fraud. That money’s out the door very quickly. It’s oftentimes very hard to recover or claw back those funds. By the time a bank or credit union is alerted to a fraudulent transaction using real-time payments, usually that money is a couple hops away, meaning it’s through different banks and then overseas or through crypto or some other medium. But again, every time you have some kind of new technology that makes it easier, you’re going to find somebody that’s there to exploit it, and it just makes it that much quicker and easier for the fraud threat actors.

Devlin: Yeah, including AI, of course, which is dominating every discussion, and that’s no different here as we’re talking about fraud. So we had a finding that’s saying that 80% of the respondents to the ProSight Fraud Survey believe that fraudsters are ahead of financial institutions in the use of AI. Do you agree? And if so, why do you think criminals have gained this early advantage? Is this sort of par for the course with other technologies? They just get in there first and they can throw everything they want against the wall? They’re not meeting any regulations, no framework, anything like that?

Bartolacci: Again, easier entrance into fraud that the barriers are pretty low with AI. Early in my career, so I worked in law enforcement, you would have to have a pretty skilled person to create a fictitious ID or counterfeit signature or document. Now, you don’t really need to possess that skill. You can dump images into an AI agent and manipulate those documents, you can create new IDs. I think they’re pretty hard to detect. I would bet that you really can’t do it with just a human investigation. You kind of need AI to investigate AI.

A couple dynamics going on. Fraud threat actors, they can basically try anything they want to very quickly. If there’s a new tool out there that can help with their nefarious activities, they can give it a shot. Banks, on the other side, or in financial institutions, we’ve got internal controls, committees, third-party risks, so when you’re trying to develop a defense against these AI-type attacks, you’re probably a year, year and a half down the road before you can implement something quickly. You’ve got that too.

Plus, we’re bound by regulations. The fraud threat actors are not. They’re always going to be a little bit ahead of us. But one of the things that we can do is compare notes, share information, collaborate with some other banks and financial institutions for both signals and best practices and strategies. And that’s kind of what we’re trying to do here with ProSight and the Fraud Alert Network so people can share those insights to try and either catch up to the fraudsters, or maybe even just get ahead a little bit.

Devlin: I was having an earlier conversation with you when I asked you what AI tactics concern you the most, and I was thinking of deepfakes, and they’re really wow-factor things’—taking over someone’s identity, someone’s voice. And that’s a concern, but can you talk about just even something more basic, like maybe the first place to go, how it’s so easy to recreate documents or change documents?

Bartolacci: And you’re right. So the deepfake topic gets a lot of attention. I think that’s a really great tactic for fraudsters to use if they’re targeting one particular high-value target. But I’m not as concerned about that. Those types of attacks are getting better and better. But I’m looking at more wide-scale attacks or strategies that can be employed by the fraud threat actors, and to your point, that’s fictitious documents and identification.

So if you think about the life cycle of a depository account, you’ve got your account opening, and you can add names to the account, you can fund the account and move money. Pretty hard to take over accounts. There’s some work involved in that. But if you can control that account from the very early beginning of that account life cycle, you don’t need to take over the account. You don’t need to do things like social engineering. You already own the account. So I see that a pretty big risk where fraud threat actors can use a manipulated ID to commit ID theft or synthetic ID-type fraud. But they open the account up with these fictitious documents. They can do it at scale. They can open hundreds and hundreds of accounts pretty much in one day with very little effort. So I think that impact and likelihood is a little bit higher for those types of fraud strategies.

Devlin: Earlier on, I mentioned that one of the findings was that people are pretty much spending more in their budgets, most people I think between 5 and 10% that answered the survey. That didn’t register as far as the need for money and for budget as a reason it’s hard to fight fraud. What came up was there’s alert overload, data quality issues. What does that tell us about the state of fraud prevention today? Maybe that’s going to hit on some of the same themes you’re talking about, but I’m just wondering what you thought about that.

Bartolacci: It’s a great thought. There’s this notion of information overload or intelligence overload. There’s a lot of different data feeds. And then what do you do with it? I think the opportunity for AI on the financial services side is using AI to triage all that information and turn raw data into actionable intelligence or high-value intelligence. Then your analysts or your investigators have more time to actually dig in and investigate that.

There’s also a flip side of that too. So you can comb through a lot of data through AI, have your investigators or analysts go through that and have that human in the loop, look at that information. Then you can also automate things like SAR filings and narratives and case notes and document collection with AI that’s also going to give some of our analysts and investigators a little more time. So I think you’ve got a couple things that are in flight right now that are a little more positive.

Devlin: I was wondering, from your role as director of the Fraud Alert Network, and we’re talking about collaboration, and a lot of times it’s collaboration among banks, but then the survey pointed out a lot of respondents were hoping for more from law enforcement, more from telecommunications providers. Why aren’t they maybe stepping in and stopping some of the social media companies? What are your thoughts on how some of that can be promoted, improved, that kind of whole ecosystem cooperation? How can that happen? Is it happening to some extent?

Bartolacci: I worked in law enforcement before I got into banking, and then I worked at a fusion center here in Pittsburgh with people that work for banks and law enforcement in the same spot, so I’ve been doing this for a little while. The law enforcement community is doing everything they can to keep up with this. There’s probably just not enough investigators, detectives, agents to keep up with all the fraud. So they are working pretty hard to try and keep up with this.

I think the one thing that the industry can do to collaborate a little better with law enforcement is to bring higher-value cases to law enforcement. So they’re not going to be able to investigate every instance of check fraud or scams or ID theft or account takeover, but if you can piece these cases together across multiple institutions, maybe you’ve got a couple hundred thousand dollars lost at one bank, but those threat actors are also targeting multiple banks at the same time. So if the banks can coordinate and share information, they get a bigger picture of a really big fraud scheme. And if you have 10 banks now that experience the same type of tactics by the same threat actors, then you can take that case to law enforcement. There’s a much better chance that they’ll take that case, and then there’s a much better chance of them actually being able to do something about it. So I think that’s one thing that the industry and law enforcement can do to collaborate a little bit better.

The other part is just continued education/awareness on best practices and techniques and strategies for financial institutions to share that information. I’d say probably your top hundred banks have really strong controls and they’ve got some really talented folks out there in fraud investigations. But then if you look at your smaller institutions, those people wear multiple hats, and they might be doing AML compliance as well as fraud and some other risk functions. So we need some more knowledge transfer to those smaller institutions where those resources are really stretched, and then you can start making a little bit more of a dent, too, in all the fraud that we’re seeing.

Devlin: As part of that ecosystem, clearly we have the customers as well, and I know there’s a big interest, and some dollars are being put into educating the consumers as well so they can be more informed and savvy about if they are being taken advantage of and that sort of thing, so that’s a huge part of it as well. Would you say there’s a fraud threat that is currently underestimated by the industry, or maybe it’s known but, like you said, there’s not enough resources to throw at it? Anything that maybe the survey didn’t cover?

Bartolacci: Just one quick thing, too, about your previous point about customer education. So that’s one of the things that we hear from our members. We have developed some resources for our Fraud Alert Network members. It’s called Fraud Studio. So there’s resources that are easily rebranded with your particular institution’s logo or name, but you can share that with your customers. That way you don’t have to recreate something from scratch. We house those resources for you. And we developed that in conjunction with some of our contacts in the industry too. So just another resource for education.

Devlin: So that could be maybe even language on a website or-

Bartolacci: Exactly.

Devlin:… a text for an email or a friendly reminder sort of thing?

Bartolacci: Yeah. Yep. Exactly.

Devlin: Okay. Cool. Great.

Bartolacci: Everything completely evolves or changes over time. I still think check fraud’s going to be a big problem. The controls are just really not there. The numbers are really driving these fraud threat actors to continue check fraud.

I do think that there is an opportunity for us to catch up on the AI front. I think eventually we probably will a little bit. Again, these AI threats I think are only going to get worse in terms of it’s just easier for more fraud threat actors to use these tools that are out there. I don’t really see fraud slowing down anytime soon. I think also you’ve got things like synthetic ID fraud that is also out there. So synthetic ID fraud is a little different than ID theft in that a fraud threat actor is creating a fictitious identity through how the credit bureaus create a credit profile. They’re just exploiting how that is intended to be working. But then those losses are really high compared to things like ID theft. You’ve got a couple things. You’ve just got this convergence of old-school fraud with new tools and then just the enhancement of things like synthetic ID fraud that’s going to be fueled by AI too. You’ve got all those things converging together that just keep fraud increasing, increasing year-over-year.

Devlin: It’s a sunny day right now where I am recording this podcast. This is a very challenging landscape that you’re describing. Can you leave us with some kind of, not sunny, partly cloudy, some decent news to latch onto to be positive about where banks and credit unions can put their efforts to make this problem a little less daunting before we solve it?

Bartolacci: Probably the most promising thing is just the shift towards sharing of information. So we’ve had other conversations, Frank, about 314(b), and there’s been some new guidance or clarity around 314(b) sharing that specifically mentions fraud, and you can share that information in real time. I think that will help banks and financial institutions get over that notion that they can’t share information. And also, what we’re doing here at ProSight, we’re fostering collaboration and information-sharing through things like this, our podcasts, our great content that your team puts out, and a platform like the Fraud Alert Network. We’re trying to build more of this community that people can share information more freely.

So I think that’ll be the shift, though. So I’m very optimistic that your fraud shops at different financial institutions will start sharing information more freely, at scale, more broadly in real time, and that should help. So I’m very optimistic about that part.

Devlin: Great. Thanks so much, Jason. Thanks for the education you gave us today and for the optimism at the end. We’ll get working on that. So thanks for sharing your perspectives with our ProSight Banking Strategies Podcast today. To our listeners, thanks for spending your valuable time with us. I’m Frank Devlin.

The views expressed by the speakers are the speakers’ own and do not reflect the views of ProSight Financial Association, BAI, or RMA. The views expressed and information shared are of a general nature and are not intended to address the circumstances of any particular individual or entity. No one should act upon any such views or information shared during this podcast without appropriate professional advice after a thorough examination of the particular situation.