Banks' elder fraud prevention comes down to three moves: notice the exploitation while the money is still in the account, delay the payment where a state law gives the bank that power, and report what was seen to the people who can act on it. Each move rests on a different legal basis, and each goes wrong in a different way. A bank that notices late loses the money; a bank that freezes on a hunch without a statute or a review invites a complaint and, sometimes, an enforcement action; a bank that reports carelessly can tip off the person taking the money. Botminds' Elder Financial Exploitation Detection is software for credit union and bank fraud and BSA teams built around that split: agents find who is new around an older customer's money, lay out the policy's steps and draft every guide, notice and report, while staff decide each step and a second person approves a delay or a report to adult protective services.
The examples come from the solution running on a fictional sample: Norrell Federal Credit Union and its member Eleanor Marsh, 81, who asks to cash out a $42,000 certificate payable to a man added to her account 19 days earlier. The rules and statistics are public and linked.
One concern, from signal to report: each step done by an agent or decided by a person
Agent
Pattern agent: her money against her own 12 monthsFlags new payees, first gift cards, an early certificate closure, cash and first wires, with FinCEN’s red flags as its reference.
Never: holds, blocks or contacts anyone
Agent
Circle agent: who is new around the moneyBuilds owners, trusted contacts, agents under a power of attorney, payees, phones and devices into one picture, with when each appeared.
Never: links two members on a name alone
A person decides
Teller and branch managerThe teller reports the concern from the window; the manager talks with the member alone and records her purpose in her words.
Never: mentions a report, or calls her a victim
Agent
Policy, Drafting and Safeguards agentsMap the facts to the policy and the state hold law, compute the clocks, draft the call guide, notice and reports, and check each draft against its reader.
Never: sends, files, or sets a delay
A person decides
Specialist proposes, a second person approvesThe specialist sends the delay; the branch manager approves it. The specialist calls the trusted contact within the member’s consent.
Never: approves a step they proposed
A person decides
BSA officerApproves the adult protective services report and accepts the confidential SAR referral; the BSA team decides whether and what to file.
Never: lets the SAR appear on a branch or member view
How do banks prevent elder fraud? Three moves, three legal bases
Banks prevent elder fraud by detecting it in their own data and at the counter, by delaying payments under state hold laws, and by reporting to FinCEN, adult protective services and the police. The detection side is the bank's own risk management, framed by FinCEN's 2022 advisory and its red flags. The reporting side is federal and state law: a suspicious activity report where the SAR rules require one, adult protective services where a state mandates it, and the Senior Safe Act's immunity for trained staff who disclose suspected exploitation of someone 65 or older.
The hold sits between them, and it is the move with the thinnest footing. The 2024 interagency statement on elder financial exploitation, revised in June 2026, does not create a federal power to hold. It notes that some states let institutions delay disbursements and says the practices "should be used appropriately and in compliance with applicable laws and regulations." The Senior Safe Act protects disclosure only. In the FTC's October 2024 overview of state laws, 24 states had laws on financial institution transaction holds; 26 states and the District of Columbia did not.
That arrangement explains the division of labour. Detection is pattern work over data held in five or six systems, which is where software helps most. Holding and reporting are decisions with legal consequences for a named customer, made under a statute that usually requires a "reasonable belief" and a review. Those stay with people.
Who decides to hold an elder's transaction?
A person at the institution, applying its policy and the state statute; in most hold-law states the decision is discretionary and the law protects it only if made in good faith. Washington's law is typical. If a financial institution reasonably believes a vulnerable adult has been, or is being, exploited, or that someone has tried, it may refuse a transaction that pays out funds, but does not have to (the state-by-state guide quotes the statute). It must then make a reasonable effort to notify the parties authorised on the account and report to adult protective services and local law enforcement. The refusal ends after five business days, ten if a security is being sold, unless a court extends it, and the institution is immune if it decided in good faith.
The interagency statement lists what a good decision weighs: "the account holder's explanation of the purpose of the transaction, the requirements to provide disclosures, and the prohibitions against unfair, deceptive, or abusive acts or practices." Its footnote is the warning. It cites a 2024 Federal Reserve order against Green Dot Bank and 2023 CFPB and OCC consent orders against U.S. Bank as "enforcement actions related to restrictions on account access". Restricting a customer's money is itself a regulated act.
Who decides each step of an elder exploitation case, and on what authority
| Step | Who decides | Authority | What an agent may do |
|---|---|---|---|
| Report a concern from the window | The teller or member services representative | Institution policy; Senior Safe Act training | Open the case and assemble the account history in minutes |
| Talk with the customer alone | Branch manager or specialist | Interagency statement, section 3: the account holder’s explanation | Draft plain questions; record answers as given |
| Call a trusted contact | The specialist | The customer’s written consent; GLBA | Draft a call guide limited to what the consent allows |
| Delay the disbursement | Specialist proposes, a second person approves | State hold law (where one exists) | Compute the business-day clocks; draft the notice |
| Report to adult protective services | The BSA officer approves; the specialist files | State reporting law; Senior Safe Act immunity | Fill every section from the case, each value cited; confirm the reporter’s training |
| Suspicious activity report | The BSA team | 31 CFR 1020.320 and the banking agencies’ SAR rules | Draft the referral with FinCEN’s key term and the 30-day clock |
Why a fraud filter must not decide alone
The clearest public warning against automated freezes comes from a 2022 consent order. The CFPB found that Bank of America acted unfairly when it rejected prepaid debit cardholders' error notices and froze their accounts on the strength of a faulty fraud filter alone. The bank paid a $100 million civil penalty to the Bureau; the OCC separately fined it $125 million. The case concerned prepaid cards, not older customers, but the principle carries: a model may flag, and a person must decide.
Supervisory guidance has not caught up with agents. The revised model risk guidance issued in April 2026 by the OCC, the Federal Reserve and the FDIC puts generative and agentic AI outside its scope, on the ground that both are new and still changing fast. Until the agencies say more, an institution using agents in elder cases carries the full burden of showing how each one is limited and who signed off. A design in which agents can only propose, draft and check, and in which every action that touches the customer needs a named person, is the easiest one to defend.
"Every report we make to the state has to be one I can defend to an examiner."
Priya Castellane, BSA Officer in the fictional sample
What Elder Financial Exploitation Detection's agents do well: finding the new person around the money
Agents are best at the part of elder exploitation that is scattered across systems: the order in which people and devices appeared around an older customer's money. FinCEN's trend analysis warns that theft by trusted people tends to go unreported and undetected precisely because the victim trusts the person taking the money. A trusted person's changes look authorised one at a time. Laid end to end, they read differently.
Elder Financial Exploitation Detection: the people around her money, with who is new and when they appeared
In the sample, Curtis Vane was added as joint owner at another branch on Saturday 3 October. Two days later the phone of record changed through the contact centre; the next evening online banking started on a new Android phone; three days after that the phone added a payee, Ridgeline Restoration LLC, which received $2,400; $3,100 of gift cards followed. Each step was authorised. Together they produced a concern of 0.91 against a threshold of 0.85 to page the specialist. The same view shows what did not change: the caregiver who has held a power of attorney for 18 months spent $590 to $690 a month throughout, so she is not treated as a suspect.
The second thing agents do well is connect members. The phone number Curtis put on Eleanor's account had been another member's phone of record since 10 September, and the same device had signed in to both.
A second member found through the same phone and device
What do banks do when they suspect elder abuse?
They talk with the customer privately, call a trusted contact if one is on file, delay the payment where the law allows, report to adult protective services and the police, and file a SAR where the rules require one. The order matters less than the speed. The interagency statement says plainly that "Timely reporting of elder financial exploitation increases the likelihood of successful recovery of funds." It also suggests referring customers to the Justice Department's National Elder Fraud Hotline, 833-372-8311, and telling them about the FBI's Internet Crime Complaint Center.
Reporting is where practice has lagged. In the CFPB's study of elder exploitation SARs, "Fewer than one-third of EFE SARs indicated that the filer reported the suspicious activity to a local, state, or federal authority." A SAR goes to FinCEN's database; it does not send a caseworker to the customer's door. The CFPB's 2019 advisory recommends reporting to "all appropriate local, state, or federal responders, regardless of whether reporting is mandatory or voluntary under state or federal law."
Do banks report elder abuse to APS?
Many must, and the rest may. As of April 2019, the CFPB counted 26 states and the District of Columbia that require financial institutions, or named kinds of financial professional, to report suspected elder financial exploitation. In 2013 eight federal agencies confirmed that the privacy provisions of the Gramm-Leach-Bliley Act generally do not prevent such reports. Washington ties its reporting duty to the hold: an institution that refuses a disbursement must report to adult protective services and local law enforcement.
The report itself is a document the BSA officer has to stand behind. In the sample, the agents drafted every section of the state's adult protective services report from the case with each value cited, confirmed the Senior Safe Act training of the specialist filing it and the teller who first reported, and checked that it named no SAR. The BSA officer approved it at 11:02, an hour and ten minutes after the teller's report. Which states mandate reports, and to whom, is set out in elder financial abuse laws by state.
What is a disbursement delay?
A disbursement delay is a temporary refusal to pay out a customer's requested transaction, for a period a state law sets, while the institution reviews whether the payment would complete an exploitation. It is not a freeze of the account: other payments continue, and in the sample the certificate stays open and keeps earning dividends. State laws attach conditions, usually notice to the people authorised on the account, a report to adult protective services, a time limit, and in some states an extension for further review or on request of the authorities.
A disbursement delay, proposed by one person and approved by another
The clocks are the part people get wrong under pressure. The agents compute them from the first day of the delay: in the sample, five business days from Thursday 22 October ends on Thursday 29 October, with the notice due Monday 26 October. Who receives the notice is a legal question that differs by state. Washington's text tells the institution to notify every party authorised on the account, with no exception written in; Florida's excludes anyone the institution reasonably believes is involved in the exploitation. The solution follows whichever rule you set, and the Safeguards agent blocks a notice addressed to a suspected party where your rule excludes them.
Can AI detect elder financial exploitation?
It can detect the account-side patterns earlier and more completely than people working across separate systems; it cannot see the room. The account side is well defined: FinCEN's red flags include new contact details, sudden gift card purchases, first wires, certificates closed regardless of penalty, and new people transacting for the customer. Software can compare every older customer's activity with their own history every night. What it cannot see is the companion who answers the teller's questions. That is why the solution starts from both: alerts from the transaction monitoring system and a teller's report from the branch.
The harder question is what AI should be allowed to do once it has detected something. Elder Financial Exploitation Detection's answer is in its limits. The Pattern agent below a concern of 0.70 only watches. No agent holds, releases, sends, files or changes a member's details. Overriding an agent's proposal needs a reason code, such as "Purpose verified with the member", so the cases where people disagree with the agents can be reviewed.
Choosing elder fraud prevention software: questions that separate the tools
Judge any elder fraud tool by whether it shortens the time to a protective step without moving a single decision away from a person. Most tools sold for this work are transaction-monitoring rules with an age filter. They help detection and leave the rest of the case on paper.
Questions to put to any elder fraud prevention product
- Does it see people, not just payments?
Joint owners, powers of attorney, phone and device changes, payees, and when each appeared. Scams and theft by trusted people both show up here first.
- Does it take a teller’s report as an input?
The behavioural signs live at the window. A tool fed only by transactions starts late.
- Can it apply your state’s hold law, not a generic one?
Hold length, notice rules, extensions and eligible ages differ. Ask to see the rule, its source and its version.
- Who can hold, release, send or file?
If the answer includes the software, ask how that would read in a consent order like Bank of America’s.
- How does it keep a SAR off every customer-facing page?
Notices, call guides and APS reports are all read by people who must never learn of a SAR.
- Does it check the reporter’s Senior Safe Act training?
Immunity depends on training before the report, not on an annual completion rate.
- Can an examiner follow one case end to end?
Who decided, when, on which evidence, under which version of the rule, with other members redacted.
Elder Financial Exploitation Detection answers those questions in a particular way, and it has limits a buyer should know. It reads from the core system, the teller platform, digital banking, the card processor, the transaction monitoring system and the learning management system; it does not replace monitoring. The hold law, ages, notice rules and approval limits are your settings, versioned and approved by the BSA officer, not ours. It is built around the sample policy's five steps, so a pilot starts by loading your own policy and a sample of your past cases. What to gather before that pilot is the subject of the elder financial exploitation policy and its inputs; the full case is on the Elder Financial Exploitation Detection page.
Questions people ask
Can a bank refuse an elderly customer's withdrawal?
Where a state hold law allows it, yes, for a limited time and with conditions. Washington, for example, lets an institution refuse a disbursement for up to five business days on a reasonable belief of exploitation, with notice to the account's authorised parties and a report to adult protective services and the police. Without such a law, a bank can talk with the customer, call a trusted contact and report, but has no statutory protection for delaying.
Does a bank need the customer's permission to report to adult protective services?
No. The 2013 interagency guidance confirmed that the Gramm-Leach-Bliley Act's privacy provisions generally do not prevent reporting suspected elder financial exploitation to appropriate agencies, and in many states the report is mandatory. Sharing with a family member is different and normally needs the customer's consent, such as a trusted contact designation.
Can a family member ask a bank to freeze a parent's account?
A family member without legal authority over the account cannot direct the bank. They can report their concern to the bank, to adult protective services or to the National Elder Fraud Hotline, 833-372-8311. In Washington, information from adult protective services, law enforcement or a prosecutor can itself support the bank's decision to refuse a disbursement.
Does the Senior Safe Act let banks hold transactions?
No. The Act protects trained staff and institutions for disclosing suspected exploitation of people 65 and older to covered agencies. Hold authority comes from state law, and the FTC's October 2024 overview found such laws in 24 states.
Does elder fraud software replace transaction monitoring?
It should not need to. Elder Financial Exploitation Detection takes alerts on members 65 and older from the existing monitoring system as one input, adds the teller's report and the people around the account, and prepares the case. The monitoring system keeps doing what it does.