Stop account takeover fraud before the money leaves, and call the real customer on a number the bank trusts
Takeover transfers held before they leave; the real customer called on a trusted number.
See one case, screen by screen ↓Account Takeover Fraud Prevention is software for bank fraud teams that detects hijacked online banking and contact-center sessions before money leaves. Agents lay one customer's steps across channels on one strip, explain the signals with their sources and propose one protective action inside the transfer's hold window. The fraud analyst approves, edits or releases, and a supervisor checks every release, unlock and restore.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Account takeover fraud rarely happens in one step. A caller passes three knowledge questions and resets the password in the contact center; a new device logs in with it; the mobile number changes so the passcodes and alerts go to the criminal; a payee is added; money moves. Each system sees its own piece. The contact center sees a polite caller, online banking sees a valid password, the payments hub sees a transfer just under the new-payee limit, and the fraud detection engine scores the transfer without seeing the phone reset.
So the fraud analyst rebuilds the story by hand from four or five screens while the transfer's hold window runs down to the same-day ACH batch or the wire cutoff. Calling "the number on the profile" can reach the criminal, because that number was changed first. And once the money leaves, an unauthorized transfer is the bank's loss under Regulation E beyond the customer's $50 or $500.
Estimated split for one escalated takeover case, worked by hand and with the solution.
Eight agents stitch the channels, date every contact detail, propose one action inside the hold window and prepare a safe call; the analyst decides and a supervisor checks.
Thursday, October 22, 2026, at Corvane National Bank. Gloria Henshaw, 64, a retired teacher in Columbus, Ohio and a customer since 2004, has a $9,750.00 transfer held for the 3:30 PM same-day ACH batch. Here is what happens next, screen by screen, in the working solution.
Maya's home screen shows 1,106 takeover alerts today: 1,035 closed by the agents with a reason, 2% of them sampled by a supervisor, and 71 escalated to analysts. Five transfers are held, $37,750.00 waiting for a decision. Needs you now is ordered by hold window, and beside it the agents' findings: one device on three customers, and phone resets behind 41% of takeovers.
“Phone resets began 41% of takeovers: 185 of 452 confirmed in 90 days.”
Maya opens Gloria's case. The strip lays out five steps across channels: a password reset by phone at 1:12 PM, a login from a new device in Las Vegas at 1:50 PM, her mobile number changed at 1:53 PM, a new payee, Brightwell Supply LLC, at 1:58 PM, and the $9,750.00 transfer at 2:04 PM. The phone reset is marked “Where it began”. Above the strip, the hold window: 79 minutes left, decide by 3:10 PM.
“Called from (702) 555-0148, a VoIP number never on her profile.” “Knowledge questions only; no passcode to the phone on file.”
Under the Las Vegas login, two signals: it used the temporary password from the 1:12 PM call, and all 1,412 of Gloria's logins in six years came from Ohio. Maya clicks the source and reads the digital banking session record itself: device D-7F3A seen for the first time, IP 198.51.100.24, and the password changed 28 seconds after login. Credentials stay redacted, and her view goes on the audit trail.
“Credential: temporary password TP-•••• (issued AUTH-88213, 1:12 PM).”
Maya asks the agents in plain words. The answer gives three reasons, each with its source: the call came from a VoIP number never on her profile, she has only ever called from her own mobile or home line, and 38 minutes later the temporary password was used in Las Vegas. Beside it, the agents' run lists each step they took, ending at takeover confidence 94%.
“Knowledge questions alone can be answered from breached data.”
The proposal reads: hold the transfer and lock profile changes; call the number on file before the change, (614) 555-0172, never (702) 555-0193. Maya could edit it or release instead. She approves under reason code P1. The hold and the lock take effect at once, because protection cannot wait, and Derek Whitfield must confirm them by 2:43 PM.
“Held at 2:13 PM by Maya Castellanos · profile changes locked · Derek Whitfield to confirm by 2:43 PM.”
The outreach agent lists Gloria's contact details with the date each went on file: her mobile since March 14, 2019, her home line since August 2004, her email since 2012. The number added at 1:53 PM is marked never call. Luis asks questions a criminal cannot answer from breached data, such as her last debit card purchase. Gloria did not call the bank or change her number, and she had entered her password on a page a text sent her to. He records a confirmed takeover at 2:23 PM.
“Never read out an amount, payee or detail before the customer says it; never ask for a password, passcode or full card number.”
The same device logged in to Harold Pruitt at 12:21 PM, with $8,900.00 now held, and to Neha Varadarajan at 12:55 PM, whose phone number was changed. Brightwell Supply LLC is the payee on both money profiles. Maya protects both customers, blocks the payee for every customer and steps up logins from the IP block for 7 days, in one bundle that goes to Derek to check.
“The holds and locks are in place now; the checker confirms within 30 minutes.”
Seven steps, each with before and after: cancel the transfer, put back (614) 555-0172, remove and block the payee, revoke device D-7F3A and end all sessions, reset her credentials, step up contact-center authentication for 90 days, and mail a letter to her address on file since 2004. The letter tells Gloria what happened and that no money left, with no internal referral and no full account number. Nothing changes until a second person checks it.
“We stopped the transfer before it left. No money left your account.”
Derek's checks show each request with its maker, reason code, changes and the agents' summary. He confirms Gloria's hold and the protection for the two linked customers, then opens the restore. Also waiting: a $1,850.00 release for a customer who passed step-up, and a wire hold past the cutoff that Derek requested himself, which another supervisor must check.
“Every ‘after’ value predates the first suspicious step at 1:12 PM.”
Derek approves the restore and the transfer is canceled before the 3:30 PM batch. The case record holds ten timeline entries from people and agents, each with its evidence. The Regulation E position reads no money left and no claim, with the $9,700.00 the bank would have borne avoided. The controls, tied to the FFIEC guidance, show what failed, the knowledge-only phone reset first, and what worked.
“Loss avoided: $9,700.00 the bank would have borne if it had gone.”
The same case, seen by the people who decide, call, check, tune and audit it: what their day looked like, and what it looks like now.
Eight agents stitch the channels, date every contact detail, propose one action inside the hold window and prepare a safe call; the analyst decides and a supervisor checks.
Joins the contact-center authentication record, digital and mobile sessions and branch events for one customer into one ordered strip, and links a phone reset to the login that used its temporary password.
Lists every change made before money moved and dates every contact detail, so it is clear which ones were on file before the first suspicious step.
Explains the one or two signals under each step in plain words, scores takeover confidence and maps each signal to the layered controls in the FFIEC guidance.
Knows each rail's clock (the same-day ACH batches, the wire cutoff, person-to-person payments), orders the queue by it, asks for a decision 20 minutes before a window closes and escalates at 15.
Prepares the call with trusted contact details and questions a criminal cannot answer from breached data, and notes the call as it happens.
Finds the same device, IP block or payee on other customers and proposes protection for all of them in one bundle.
Prepares the restore plan and the customer letter, and builds the case record, the Regulation E position, the BSA referral and the export packs.
Turns failed controls into rule proposals, back-tests them on past cases and drafts the weekly outcome review.
Approve, check, call. The agents propose; a named person decides.
Ask in plain words. Every answer points to the record it came from: the authentication log, the session, the change log, the payee.
Why do the agents think Gloria Henshaw's account was taken over?
Takeover 94%. The temporary password from a 1:12 PM phone reset was used 38 minutes later on a new device in Las Vegas; the mobile number changed 3 minutes after that, and the new payee's passcode went to the new number.
Which held transfers leave in the next hour?
Two: Dana Kowalski's $2,400.00 person-to-person payment at 2:45 PM, after a number port 17 minutes before the login, and Delgado Landscaping's $18,400.00 wire at the 3:00 PM cutoff. Neha Varadarajan's profile also needs a decision by 2:59 PM.
Who else did the Nevada device touch today?
Device D-7F3A logged in to Harold Pruitt at 12:21 PM and Neha Varadarajan at 12:55 PM. Harold's began with a phone reset like Gloria's, and the payee Brightwell Supply LLC is on both money profiles. Protection for both is ready to send.
What happens if we release?
The $9,750.00 goes in the 3:30 PM batch to an account opened 11 days ago. If Gloria did not authorize it, it is an unauthorized transfer under Reg E: her most is $50 if she tells us within two business days, so about $9,700.00 would be the bank's loss. A release needs a supervisor's check.
13 screens from the working solution, on its sample data. Pick one to see it large.
Every threshold, window and outreach rule is a setting: proposed by the fraud systems administrator, approved by the strategy manager, and kept in the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Propose a hold | Takeover confidence 0.80 or higher | Escalate to an analyst at 0.60 · step-up only between 0.30 and 0.60 |
| Close without an analyst | Below 0.30, with a reason | A supervisor samples 2% daily |
| Hold windows | Same-day ACH 11:00 AM and 3:30 PM · wire cutoff 3:00 PM | Person-to-person payments held 45 minutes · profile-only cases decided within 2 hours |
| Decide by | 20 minutes before the window closes | Escalate to the supervisor at 15 minutes · protective holds confirmed within 30 |
| Trusted contact detail | On file 30 days before the first suspicious step | Never contact a detail changed in the last 30 days |
| Outreach attempts | 2, 15 minutes apart | Then the hold stays and the supervisor is told |
| Contact-center step-up after a takeover | Passcode plus callback for 90 days | Added to the customer's profile as a restore step, after a check |
| Retention and redaction | Records and evidence 5 years · call audio 25 months | Temporary passwords, passcodes, full account and card numbers always redacted |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, to be measured in the live solution · “estimated” = our estimate · “typical” = published figures (FBI IC3 public service announcement I-112525-PSA, November 25, 2025: over $262 million and 5,100 complaints; Javelin Strategy & Research, 2026 Identity Fraud Study: over $15 billion and 6 million victims). Rules named: Regulation E, 12 CFR 1005.6 and 1005.11; FFIEC Authentication and Access to Financial Institution Services and Systems, 2021. Corvane National Bank and the people, payees, devices and numbers named on this page are fictional: characters and sample data in the working solution.
Account Takeover Fraud Prevention is software for bank fraud teams that detects hijacked online banking and contact-center sessions before money leaves. Agents lay one customer's steps across channels on one strip, explain the signals with their sources and propose one protective action inside the transfer's hold window. The fraud analyst approves, edits or releases, and a supervisor checks every release, unlock and restore.
The session stitching agent joins the contact-center authentication record to the digital session that followed. In the sample case, the temporary password issued on a 1:12 PM phone reset is the one used at a new device's first login at 1:50 PM, so the phone reset, the login, the number change, the new payee and the transfer appear as one story, with the step where it began marked.
The profile change agent dates every phone number, email and address. The outreach agent prepares the call only to contact details on file 30 days or more before the first suspicious step, marks the newly added number never call, and writes questions from recent activity that a criminal cannot answer from breached data. It never asks for a password, passcode or full card number.
Yes. Each case names its entry point: a phone reset with knowledge questions, a phished password and passcode, a mobile number port (SIM swap), password guessing or other. In the sample queue, one case began with a number port 17 minutes before the login, and the strategy view counts where every confirmed takeover began over 90 days.
The case record carries the Regulation E position. A completed takeover transfer is handed to disputes with the strip and the outreach notes, so the investigation starts with the facts and its deadline is shown. Under 12 CFR 1005.6 the customer's liability is $50 when they report within two business days, and the rest is the bank's loss.
Yes. The agents propose and never hold, release, call or restore. The analyst decides, a supervisor confirms protective holds within 30 minutes, and releases, unlocks, credential resets, restores, payee blocks, letters and bulk protection wait for a second person. Overrides take a reason code, and rule and threshold changes need the strategy manager and model risk.
No. The referral is restricted to fraud, BSA and audit roles and never appears on a customer view, letter or call script. The customer letter is checked for no internal referral and no full account number before a supervisor approves it.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your authentication standard, outreach scripts, hold windows and a sample of past takeover cases, and it goes live once every quality gate has passed. We will walk you through it on your own cases first.
Scam payments stopped mid-call, with every question and answer kept for the claim.
1-min demoElder Financial Exploitation DetectionEvery concern about an older member acted on the same day, with each step on the record.
1-min demoWire Fraud PreventionFraudulent wires stopped before they leave; good wires released on time, with two names.
1-min demoWe'll run Account Takeover Fraud Prevention on a sample of your own past takeover cases.