Insights from ProSight’s State of Fraud Prevention Survey and Fraud Alert Network

Drawing on findings from the 2026 ProSight State of Fraud Prevention Survey, Jason Bartolacci, director of ProSight’s Fraud Alert Network, examines why many financial institutions feel they are falling behind fraudsters. The conversation explores AI-enabled fraud, authorized push payment scams, real-time payments, check fraud, and the growing need for industry-wide collaboration to combat emerging threats.

Subscribe to ProSight Podcasts: Apple, Spotify, Amazon Music, YouTube

TRANSCRIPT:

Frank Devlin: This is the ProSight Banking Strategies podcast. We’re here to inform you on the top trends, challenges, and opportunities in banking today. ProSight is a leading non-lobbying connector of people and information with deep expertise in risk, fraud, compliance, and retail and commercial banking. Our purpose is to empower financial services leaders to strengthen and advance our industry through training and insights, as well as tools and resources like this podcast.

Hello, and welcome to this ProSight Banking Strategies podcast. I’m Frank Devlin, a senior editor at ProSight. In the 2026 ProSight State of Fraud Prevention Survey, 85% of respondents said the fraud threat landscape is evolving faster than they can respond. That’s a remarkable finding at a time when organizations are investing more than ever in fraud prevention. Criminals are operating at digital speed, leveraging AI, exploiting real-time payment systems, and increasingly turning to manipulation rather than technical compromise. At the same time, old-school check fraud is surging. Today, we’ll dive into what this complex picture means for financial institutions, discuss why fraud has become a challenge that no organization can solve alone, and look ahead at the threats and opportunities that could define the fraud landscape through 2027.

Joining us is Jason Bartolacci, director of the ProSight Fraud Alert Network, and a certified fraud examiner with over 20 years’ experience in fraud risk management, cyber threat intelligence, and financial crimes investigations. Welcome, Jason.

Jason Bartolacci: Hey, Frank, great to be here.

Devlin: It’s great to have you. So, let’s start with the big picture. So, the survey that I mentioned up top found that 85% of the respondents believe that the fraud threat environment is changing faster than their institutions can respond. Why might it feel like the industry is losing ground despite they’re still investing more in fraud prevention?

Bartolacci: Yeah, it’s a great question. And in addition to the survey that we put together, I try and keep my hand on the pulse of everything that’s going on in the community, we have a lot of roundtables we run, we attend a lot of conferences, and this is a sentiment across the industry, and I think it’s a couple reasons. First of all, fraud is trending up. So, year over year, and not just our data, not just our ProSight data, but if you look at the Federal Trade Commission and the Internet Crime Complaint Center (IC3), fraud’s up year over year. So, it’s kind of tough when you’re in this fraud fighting field and you keep seeing those numbers creep up. In addition to that, the fraud threat actors, they always seem to be one step ahead of us.

They’re using AI, they’re using new technologies, and they’re using all that to exploit us on a bigger scale over time. So, I think those two things just give this sentiment that fraud’s up, we’re always playing catch-up, and we still have a lot of work to do.

Devlin: An interesting thing that a lot of folks commented on, and you’ve spoken about this as well, is that we’re seeing more things like account takeover fraud, push payment scams, social engineering. Some folks say that the industry’s doing pretty well at defending the perimeter, the cyber front here. We have people who are stealing money directly from customers who are basically, if they’re convinced, to hand over the money and the funds voluntarily. Can you talk about the phenomenon of this and what it means for the industry?

Bartolacci: Yeah. So, this comes up a lot too. I think banks—igital channels, banks, credit unions, financial institutions, their digital channels are fairly fortified. It’s pretty tough to hack into a bank. So, the fraud threat actors are looking at different ways to access that account, get into the account. So, there’s a couple things to unpack here, the first is you mentioned social engineering and scams and APP fraud, so authorized push payment fraud, that’s when you get, threat actor gets an account holder or tenant victim to transact on their behalf. So, it’s a little bit different than the traditional ATO, where the threat actor’s trying to break into the account. And those things are fueled by romance scams, and social engineering calls and texts, all this gives these fraud threat actors a little more information to get in front of that victim and get them to authorize a transaction.

So, you have that going on, and again, the digital channels or that perimeter around a bank are fairly well fortified. So, what’s going to happen? The threat actors have figured out we’ll attack these softer targets, which is the customer, which is the call center, which is also branches. So, these are also targets for the fraud threat actors to try and exploit, and get information, and either authorize a transaction or take over that account.

Devlin: So, you mentioned there’s more fraud happening. It’s faster. It’s tougher to defend. How do real-time payments figure into this picture? What are you hearing about that?

Bartolacci: Well, think about it, anything that’s meant for ease of the customer or speed or efficiency can also be exploited by the threat actor. So, real-time payments, this is instant access and instant transaction, instant settlement. So, what happens is the financial institutions, they lose that lag time or that grace period to detect and stop fraud. The money’s already gone. So, it makes it much more challenging to get that money back, in most cases you can’t, it’s already out of the account holder’s account. Anything that we make, that we build, or that we do that’s thinking of the customer in mind, to help that customer, it also helps the threat actor too.

Devlin: You always have this kind of balance, the push-pull where you want to make the experience really great and seamless for the customer, but there needs to be, if you want to stop the fraud, there has to be some friction, some delay, something. It’s common sense, but it’s an issue that seems to never go away.

Bartolacci: Exactly, because you don’t want to block out all your good customers and transactions and friction and good customer experience.

Devlin: We had verbatim responses with that survey so where folks can fill in a dot for some questions, but then they’ll actually write out almost a small paragraph, and someone said they specifically wanted to be consumer unfriendly, with some debit card protections, where they know that they’re making it tough for their customers, but they just felt like this is an area where they had to take a stand because they just needed to protect themselves and protect their customers, did a very practical thing, and they had to make that choice in that situation. You really feel for people who have to make these decisions because you can see that the pluses and the minuses on both sides. So, you talked about the AI making it easier for fraudsters, we actually did ask folks about that and 86% of respondents believe fraudsters are ahead of financial institutions in the use of AI.

There are some reasons, another possibility, does it have to do anything with regulations and proving how you’re using AI? Why do you think that the balance is tipped like that right now, if you do agree? Maybe you don’t agree and you think it’s both sides are pretty much fighting an even battle now.

Bartolacci: I agree. I don’t think that we’re fighting an even battle right now. You already mentioned a few things, but I was thinking about this portion of the survey, fraud threat actors, criminal groups, they don’t have committees, they don’t have regulators, if they want to try something, they can do it fairly quickly. And that’s other part of all this AI talk is these tools are almost off the shelf for these threat actors. So, it’s very easy, you don’t even have to be very technical to create a deepfake, create fictitious documents. They can do that very quickly and they can spool that up very quickly and they can deploy that quickly.

Conversely, with financial institutions, if you want to employ some sort of AI detection tool, you have to do a vendor review, third-party risk management, it’s going to go through a couple committees, contract negotiations. It’s a year and a half down the road. Yeah, we’re always playing catch up and we’re always playing whack-a-mole because then when we figure out one defense that works, the fraud threat actors pop up somewhere else very quickly.

Devlin: Are certain AI-enabled fraud tactics more of a concern to you than others?

Bartolacci: Looking at this customer journey, the first part is getting into the bank and opening up a bank account, that’s kind of the first step. That’s why KYC and know your customer is so important, because once you establish that account, all the biometrics, other tools, that kind of goes out the window. So, if you can get into the account first, legitimately, you control that account. So, my biggest concern right now is around fictitious documents, AI-generated identification, things like utility bills, proof of address—all that can be generated very quickly, at scale, deployed across multiple financial institutions. And then, the fraud threat actor, they already have the account established, so it’s very easy to navigate after that.

Devlin: Right. Interesting, because to me, that’s less of a wow factor than a deepfake, where they’re able to mimic someone’s face and voice. You’re saying if they can get the documentation, it sounds like they could do it at scale and do more damage quicker.

Bartolacci: Yeah. Well, the deepfake stuff is really interesting, but how many times are you on a video call with your bank? Probably not too often. So, the deepfakes as it pertains to fraud or maybe some sort of exploitation, this is a fraud threat actor group is targeting a high-value target, board of directors, CEO, maybe chief financial or operations officer on the business side, who’s going to go out and transact on behalf of these threat actors. For our group and for our audience, our respondents to the survey, it doesn’t happen very often, but these documents, I’m hearing a lot about fictitious documents getting through the defenses right away.

Devlin: Interesting. So, another thing that maybe it doesn’t have the wow factor of a computerized deepfake is check fraud, which is old school, and it’s out there in the physical world, and it’s people literally stealing mail. I mean, I learned this from you, I think you use brake fluid to erase the ink and then you write your own name on there.

Bartolacci: Yeah.

Devlin: Why is this old-time scheme still causing so much damage and disruption in a digital-first world?

Bartolacci: So, just your last statement there, digital-first world, this is non-digital. This is low-tech, easy to do, hard to detect, you’ve got threat actor groups that share information freely. So, there’s a complete ecosystem with check fraud, there’s a big problem with mail theft right now. The marketplace is flooded with stolen checks, you can buy the physical check, you can buy a washed check, you can buy an image of the check, it’s very easy to do. You can hire people to be “runners” to go in and negotiate those checks at a branch. The dollar amounts are fairly high. So, especially if you have a legit business check, you can get $10,000 or $15,000 off a business check, personal check might be a little smaller. When you think about a counterfeited credit card or some kind of compromised credentials, you might not get that much money out of those instances.

Might be a couple hundred, might be a couple thousand before somebody catches on. But the checks, there’s a lag time with checks too, you got a few days to be able to cash those out and take the money and run. So, there’s a lot of different things that you can do to make it so easy for check fraud. And even think about things like remote mobile deposit, it just takes a grainy image of that check that’s being negotiated or deposited, banks don’t necessarily keep the checks for very long, the checks are basically destroyed pretty quickly after they’re digitized so that physical evidence is gone. And there’s so much of it out there that I think law enforcement’s pretty much overwhelmed with all the check fraud. So, you have a pretty good chance of getting away with it too.

Devlin: Right. So interesting that you mentioned law enforcement because my next question was going to be how this is sort of a network problem, and a lot of folks have talked about that. It’s not enough for banks to throw a lot of money and resources at this, they’re going to need cooperation with other banks, with law enforcement, people even mentioned the telecoms, how can they get involved? What does effective collaboration look like in practice? That’s what the Fraud Alert Network is all about. What do we need to see? How can this become a way that everyone gets together and do better at stopping this?

Bartolacci: Yeah, that’s a great question. I think it’s probably the most important takeaway right now is the fraud threat actors are collaborating and sharing information. They’re sharing their tactics, their procedures, anything you want to learn about how to conduct fraud, it’s out there. The banks need to work together more collaboratively, that’s why we created this space for our members to share information. It serves as a directory, you can find the right person at a different institution, to reach out to, to speak with about a pending fraud case. I think the most important thing too is being able to share that in near real time. So, it’s too late after the money’s out the door and you’ve already completed your investigation, banks and credit unions and FIs need to collaborate while the fraud’s occurring, be able to reach out to other banks and their peers to get ahead of these fraud threats.

And what that looks like in practice is just an authenticated shared space, where you know who you’re talking to, you can either reach out and get the right information or get the right contact about a suspicious transaction or situation, you can share indicators of compromise or IOCs. You can share tools, tactics, and procedures, you can share best practices. So, you can share things on a more tactical level, so real-time fraud instances. And then, also you can share things on a more strategic level, where you’re sharing, hey, here’s a tool that worked really well for us, or here’s a procedure that worked really well for us, or here’s a training tool that we rolled out to our customers or frontline staff and this worked really well for us. So, it’s a combination of all those things, both on a tactical and a strategic level to share that information, share that intelligence, and really start getting ahead of fraud threats.

Devlin: So, what’s preventing it from becoming more effective as you can picture it and as the industry should be acting? Is there anything that’s getting in the way that can be improved?

Bartolacci: Oh, for sure. So, this has been going on ever since I started in banking. So, I came from law enforcement, I worked on a task force, we shared information, come to banking, a little more restrictive. So, there’s some regulations that are out there that aren’t quite clear. So, 314(b) guidance from FinCEN, part of the Patriot Act, it was never very clear on fraud. I always interpret it as, yes, you can share information on fraud because fraud is a predicate of money laundering anyway, money laundering is usually the money movement after the fact. So, you still have that built in there. But I think most banks wanted to take a more risk-averse approach to that. So, this summer, back in June, FinCEN came out with some more clear guidance. I don’t think it’s quite there yet, some of the folks that I’ve talked to in the industry want it even more crystal clear, but in the new 314(b) guidance, they recommend sharing information in real time, you don’t have to wait until your investigation is over before you share information.

They don’t really care or specify what medium you share, so you can use things like the Fraud Alert Network, or informal networks, or formal networks to share information, and it most certainly does include fraud. So, those things were very important, but you still have a lot of institutions that won’t share information until it goes through legal or another process. By that time, the money’s already out the door. So, we really need to codify and streamline this information sharing process, and really get all the institutions on the same page and sharing information in real time, that’s what it’s going to take.

Devlin: Jason, was there a worry from some institutions that they didn’t have a safe harbor, and that if they did report something that somehow—you said they have to go through legal review. They’d be seen as accusing someone of a crime and it was an accusation, it wasn’t proven, and then that could get back on them and make that a legal issue for them, and they could perhaps lose a case?

Bartolacci: Yeah, that’s one of the arguments, [inaudible 00:15:34] to say no to something and be safe and to say yes. If you think about it, if I worked for a bank and I shared information on a suspected fraudster, if they want to sue me and show up in court, I would love to meet them there because we have a case built around them, that would be fine with me. But not all banks see it that way.

Devlin: I know that one of the big problems, as you mentioned earlier, is that fraudsters can try 100 things. One thing just has to work. They rarely get caught, they rarely pay the price, and that’s another reason why it proliferates so quickly.

Bartolacci: Exactly.

Devlin: Is there some good news? You sort of mentioned some good news, because you’re saying maybe now with FinCEN’s new guidance, banks and credit unions will feel a little bit more free in what they can share. I know that customer education is seen as maybe a way that, for not much money, banks, it can let people know to be more on guard, but what’s positive, what’s maybe going well? Maybe it’s banks getting better at using that AI, even with all the restrictions they have. What’s going well maybe in the fraud battle?

Bartolacci: It’s a great question, I’ve been thinking about this a lot over the past few months, just all the conferences and round tables that I’ve attended. Fraud seems to be top of mind for most institutions, so that’s a good thing. I think if you were to ask a few years ago what top risks would’ve been, probably some sort of compliance and the cyber risk. Now, we’re looking at fraud risk and AI risk, I would argue that fraud and AI and cyber risk go hand in hand. So, that’s good, the conversation is started, it’s a top of mind for most banking execs. So, [inaudible 00:17:03] that point. I think that the tools are getting better, so we do have some AI tools that are starting to catch up in terms of detection and investigation and remediation. So, that’s good. I think there’s some relief coming too in terms of AI.

The survey indicated that a lot of the banks operationally felt that they didn’t have either enough staff or not money resources, but people resources to combat fraud. So, AI will do a lot of the menial type jobs and a lot of the report writing for fraud investigators so they can really dig into what happened and why, and how we could do better. So, I think that’s a positive. Again, just to reiterate, the collaboration, I think we’re very close as a community for financial institutions to share information and collaborate, again, that’s why we have the fraud alert network, that’s why we want to share information. That’s why we are doing as much as we are with ProSight around fraud in terms of summits and councils and round tables. So, it’s a major part of every conversation we’re having.

Devlin: So, that’s good. So, clearly it’s on the agenda and people are thinking about it all the time, which also came across in the survey. So, it’s not like people aren’t going to try to really improve the situation. And so, for a final question, if you could, if you think this question makes sense, what do you think the big fraud story might be in a year or two? Is anything going to change, or do you think it’s just going to continue at the level where we are now? Fraud continues to increase, it continues to outpace somewhat the capability of the industry to counter it. What do you think we’re going to be talking about in a year or two?

Bartolacci: Yeah, as much as it pains me to say this, I think we’re going to see a jump in fraud rates and in losses because AI is getting that much better at automating these attacks, automating things like fictitious documents, and you mentioned deepfakes too. Instead of having five or 10 folks that are in some sort of fraud, they’re doing a lot of manual things, you can have one or two people do the work of that same group, that same fraud ring. So, you’ll probably see a little bit of a jump, I think you’ll see some new techniques that are going to be rolled out by the fraud threat actors, it’ll take us a little bit of time to catch up, but I think it’s what we’re going to be talking about next year.

Devlin: Thanks so much, Jason, for sharing your perspectives with our ProSight Banking Strategies podcast audience today. To our listeners, thanks for spending your valuable time with us. If you liked it, please spread the word. I’m Frank Devlin.

The views expressed by the speakers are the speakers’ own and do not reflect the views of ProSight Financial Association, BAI, or RMA. The views expressed and information shared are of a general nature and are not intended to address the circumstances of any particular individual or entity. No one should act upon any such views or information shared during this podcast without appropriate professional advice after a thorough examination of the particular situation.