Regulators, Firms Urge Treating Fraud as Ecosystem

Regulators and industry leaders urged treating fraud as an interconnected ecosystem during recent consultations and industry gatherings in the United States and Europe. They said current rules and business practices treat scams as isolated incidents and are ill-suited to coordinated schemes that move across platforms and borders.

Participants described patterns that combine synthetic identity fraud, account takeovers, bot-driven account creation, money mule networks and rapid conversion of stolen funds through peer-to-peer transfers and cryptocurrency gateways. The meetings brought together bank compliance officers, payments firms, fraud investigators and policymakers to outline where existing defenses break down.

Speakers gave examples of how criminal groups assemble simple steps into larger attacks. Fraud rings build synthetic profiles from fragmented personal data, use automated bots to open or access accounts at multiple institutions, recruit and pay money mules via social channels to receive and withdraw funds, and move value through crypto exchanges and payment apps to obscure trails. Those activities often cross regulatory boundaries, so a single bank or platform cannot see the full pattern in time to stop losses.

Regulators described several responses under consideration. Proposals include standardizing fraud typologies so firms report linked events consistently, lowering legal barriers to share anonymized intelligence, and creating rapid notification channels between banks, payments platforms and law enforcement. Some supervisors indicated they would consider adapting suspicious-activity reporting rules to permit aggregated, near-real-time feeds that surface patterns rather than isolated transactions.

Industry representatives said firms are expanding signal-sharing networks that combine device signals, geolocation and behavioral indicators, deploying machine-learning models trained on cross-sector data, and tightening verification for high-risk flows. Several firms reported redesigning onboarding and transaction monitoring to detect cross-system patterns rather than relying on single-account thresholds.

Attendees identified friction points that slow coordinated responses: delays in legal approvals for cross-border intelligence sharing, inconsistent definitions of reportable fraud across regulators, and weak incentives for firms to disclose incidents that could harm their brands. Smaller fintechs and newer payment providers said they lack funds and staff to buy advanced detection systems or join multiple information-sharing groups.

Regulators discussed policy options to address those frictions, including harmonizing reporting requirements across supervisory agencies, creating protected forums for anonymized threat-sharing exempt from certain disclosure rules, offering regulatory safe harbors for good-faith sharing of indicators, and running joint supervisory exercises that simulate cross-sector fraud scenarios to test coordination and reveal legal or technical gaps.

A compliance executive at a multinational bank told attendees, “There is no single point of failure anymore,” arguing for data and legal frameworks that allow institutions to see and act on patterns across systems and borders. Law enforcement officials cautioned that any information sharing must comply with privacy and data-protection laws and called for clearer rules to balance investigative needs and consumer rights.

Participants said they will prioritize pilot programs that test cross-sector reporting, shared analytic models and legal frameworks for intelligence exchange. Organizers will assess those pilots to decide whether rule changes or new regulations are required. International cooperation was highlighted as necessary because many fraud ecosystems rely on actors and infrastructure in multiple countries.