First-Party Fraud Detection

Dispute fraud specialist: the job, the proof and the second signature

A dispute fraud specialist investigates claims of unauthorized transfers and, on the hardest ones, decides whether the customer made the payment himself. Because the law puts the burden of proof on the bank, the job is built around evidence and a second signature. The role seat by seat, as First-Party Fraud Detection lays it out.

Updated · 12 min read

A dispute fraud specialist is the investigator who works customers' claims that a debit card, ACH, ATM or P2P transfer was not theirs, and decides on the evidence whether someone else really made it. Most claims end in reimbursement on the regulation's clock. The hard ones are first-party claims, where the bank's records suggest the customer made the payment himself, and there the specialist is building a case that a supervisor, a compliance tester and sometimes a court will read. The Electronic Fund Transfer Act puts the burden of proof on the bank, so a denial is only as good as its evidence and the second person who checks it. Botminds' First-Party Fraud Detection gives that work a structure: agents gather and pair the records, the specialist decides, a supervisor signs, and compliance, partner risk and BSA each hold their own seat. This page describes the job, and who carries what.

Five seats around one first-party claim, before and after the agents

Dispute Investigator

Today

Opens case management, the core, digital banking and the P2P portal for each claim, and writes notes like “customer has filed before; device matches”.

With agents

Opens each flagged claim with the customer’s statements already paired with the records that answer them; asks about any pair, sets one aside with a reason, decides with a reason code.

Still theirs: the decision

Disputes Supervisor

Today

Approves a denial if it reads well; the letter is a template with a sentence of findings.

With agents

Checks each denial beside its pairs, the fairness note, the reason code and the letter; approves or returns it; is never offered his own work.

Still theirs: the second signature

Compliance Officer

Today

Tests whether similar claims were treated alike only when she samples a month by hand.

With agents

Sees denial rates by program and transfer type each month, the reasons struck and the overrides by reason code, and signs the review.

Still theirs: the policy and its settings

Fintech Partner Risk Manager

Today

Requests a partner customer’s device data by email while the Reg E clock keeps running.

With agents

Sees each partner’s data timeliness and the claims a late file holds up; retries, reminds or escalates under the program agreement.

Still theirs: the partner relationship

BSA Officer

Today

Hears about a confirmed false claim by email, while a customer status sometimes says “under fraud review”.

With agents

Receives each referral restricted to her, with the claims and amounts behind it, and decides whether to file.

Still theirs: the filing decision

The seats of the fictional sample bank, Tessaly Community Bank, as First-Party Fraud Detection defines them. An Internal Auditor and an Administrator complete the seven roles.

What does a dispute fraud specialist do?

They gather evidence, take the customer's account, decide whether an error occurred and write down why. The federal occupational database files the work under fraud examiners, investigators and analysts, whose job it describes as gathering evidence, taking statements, writing reports and testifying to what they found about fraud allegations. The tasks it rates most important are documenting all investigative activities, preparing written reports of findings, interviewing and taking statements, and gathering financial documents. On a Reg E desk those become intake, investigation, decision and the result letter.

Job titles vary. Banks advertise for dispute analysts, fraud and dispute specialists, claims investigators and fraud analysts, and the O*NET sample titles include "Fraud Analyst" and "Financial Crimes Investigator". What sets the dispute fraud specialist apart is the second half of the job title: the specialist works inside an error-resolution rule with deadlines, a burden of proof and a required letter, not an open-ended fraud investigation. The card side of the same job, with Regulation Z and network chargebacks added, is described in who investigates a card dispute.

The skills O*NET rates most essential for fraud examiners and analysts

Active listening
81
Writing
81
Reading comprehension
78
Speaking
78
Critical thinking
75
Importance scores out of 100, O*NET 13-2099.04 Fraud Examiners, Investigators and Analysts (updated 2026). Listening and writing lead: the customer's statement in, the findings letter out.Source: O*NET OnLine, 13-2099.04

The burden of proof is the job description

The specialist's real task on a first-party claim is set by one sentence of the Electronic Fund Transfer Act. In any action over a consumer's liability, the bank must show the transfer was authorized, or, if it was not, that the conditions for making the customer bear part of the loss were met (15 U.S.C. 1693g(b)). Either way, the bank proves; the customer does not.

That turns the specialist's instinct around. A specialist who has seen many false claims learns to spot one, and the danger is that recognition replaces proof: "customer has filed before; device matches" is a hunch written as a note. The burden asks for something else: each thing the customer said, set beside the record that answers it, and a written search for the signs that would make the claim genuine. In the sample, that is the Evidence agent's work, and the specialist's job is to read it critically, question any pair and decide.

A morning on a flagged-claim desk

Take a fictional sample bank as it runs Botminds' First-Party Fraud Detection. On Wednesday, October 21, 2026, Nadia Okafor, a dispute investigator at Tessaly Community Bank, opens her desk at 8:40 a.m. Eleven flagged claims are hers and three are ready to decide. One is Trevor Haldane's $740.00 P2P payment, "I never sent this payment", set against an iPhone registered to his account since 2024 and a Face ID sign-in two minutes before the transfer. The agents propose a denial with evidence. Another is a $1,150.00 transfer from a customer who read a one-time code to a caller; the agents propose payment as an impostor-induced, unauthorized transfer.

Nadia reads Trevor's six pairs, the search for signs the claim is genuine (none found, with one stated limit: Face ID cannot rule out a household member holding his phone) and the fairness review, which compared his claim with 38 similar ones. She denies with evidence, reason code "Authorized by the customer: own device and known recipient", and the claim moves to a second person.

The second person reads the same pairs before anything is sent

The checker's desk of Glen Whitaker, Disputes Supervisor: waiting for a second person. Every denial, payment after review, account action, partner notice and settings change is prepared by one person and checked by another; nobody checks their own work. His desk lists five items, including RC-26-10482 deny with evidence $740.00 prepared by Nadia Okafor, approved; a deny with evidence of $612.00 prepared by Lena Fischer; a pay after review of $415.00; an account action, close with 30 days' notice; and a reopen and pay of $164.00 from the fairness review. The open item shows Trevor Haldane's five pairs with their strength, a Fairness agent note marked Consistent, the reason code Authorized by the customer: own device and known recipient, the letter DN-2 v3 with 8 of 8 elements checked, and the money line: nothing posts or reverses, no provisional credit was made. Below, the run: decision recorded, letter released to the customer notice service, case management updated, claim closed on business day 6.
Fictional sample bank. The supervisor's queue mixes denials, payments after review and account actions; each was prepared by someone else.

Who approves a Reg E denial, and why a different person?

Regulation E does not name who must sign a denial; the bank decides. What the regulation and the statute do set is the cost of getting it wrong, and that is why careful banks put a second person on every denial. The person who prepared a decision has read the case one way; a second reader who did not prepare it is the cheapest available test of whether the evidence carries the finding.

Federal Reserve examiners trace many Regulation E failures to weak controls rather than bad intent. In their review of 2024 examinations, violations of the results-and-explanation rules were attributed largely to third-party oversight and templates, and to gaps in staff training, written procedures and internal controls. A second signature is an internal control; so is a rule that the system never offers a checker his own work.

Who may do what on a first-party claim in the sample bank

SeatPreparesChecksSees a referralSees customer names
Dispute InvestigatorDecisions on claimsNoNoYes
Disputes SupervisorNoDenials, payments after review, account actionsNoYes
Compliance OfficerSettings approvals, the monthly reviewSettings proposed by the AdministratorNoYes
Fintech Partner Risk ManagerPartner data requests and noticesNoNoYes
BSA OfficerFiling decisionsNoYes, restricted to this seatYes
Internal AuditorNoReads and exportsNoMasked
Fictional sample bank. Every denial, payment after review, account action, partner notice and settings change needs a maker and a different checker; agents never decide, post, debit, send or refer.

The line a dispute fraud specialist must never cross

Never conclude "no error" when the evidence cannot support it. The EFTA triples a consumer's actual damages where a bank knowingly and wilfully reached that conclusion against the evidence it had (15 U.S.C. 1693f(e)(2)), and also where it failed to recredit provisionally within ten days without a good-faith investigation or a reasonable basis for its view. Both describe a specialist who decided first and looked second.

Three habits keep a specialist on the right side. Write the finding as what the records show, not what the customer is. Treat earlier claims, a known device or a familiar recipient as context unless other records carry them, because each has been rejected as a sole reason; the full list is in Reg E denial reasons. And when the evidence is mixed, pay: the sample bank sets a confidence floor of 0.75 below which the agents propose payment, and its September review counted no denials below it.

A specialist's checks before pressing deny

  1. Can I name the finding in Reg E terms?

    Authorized by the customer; a furnished card or phone before revocation; fraudulent intent. Not "suspicious".

  2. Does each statement have a record against it?

    Every pair opens its source; a pair I doubt I can question or set aside with a reason.

  3. Did we look for the genuine claim first?

    New device, reset, failed sign-ins, scam contact, SIM change, lost phone, each with a result.

  4. What can the records not rule out?

    A household member with the phone, a shared network. If it matters, ask the customer.

  5. Is the clock safe?

    Flagged claims decided by business day 8 in the sample, with escalation at day 7, so the 10-day deadline is never at risk.

  6. Would a stranger reach the same answer from the file?

    That is what the supervisor, the compliance tester and an examiner will do.

What does compliance test after the decision?

Whether denied claims met the burden, and whether similar claims were treated alike. Federal Reserve staff suggest a compliance department sample previously denied claims and confirm, for each, that staff reviewed all relevant information in the bank's records and that the findings established that no error occurred (Consumer Compliance Outlook, 2025). That is a test of the specialist's file, not of the outcome.

The sample bank adds a monthly consistency review signed by its Compliance Officer: denial rates of flagged claims by program and transfer type, the reasons struck before a person saw them, and every override by reason code. In September it showed flagged claims from one fintech partner's customers denied at 62%, against 45% across all programs; the agents re-read those eight denials, two decision records were reworded to drop a mention of reporting time, and one $164.00 claim was reopened for payment. The measures behind that review are in first party fraud prevention, and what a tester should find in each file is in Reg E documentation.

The fintech partner and BSA seats, and the confidentiality between them

Two seats sit outside the dispute desk and matter most to a sponsor bank. The Fintech Partner Risk Manager holds partners to the data duties in their program agreements, because a partner customer's claim runs on the bank's Reg E clock. In the sample, one partner's device and session file is 26 hours late with three claims waiting; if no data arrives by business day 8, the agents propose provisional credit, and a claim is never denied for missing partner data.

A partner's late file, and the claims it holds up

Fintech partner programs view for Eli Navarro, Fintech Partner Risk Manager: partner customers' claims are Tessaly's claims; Tessaly holds the deposits and the Reg E duty for every Tallowbird and Saltmeadow customer. An alert: Saltmeadow's device and session file is 26 hours late, last file Tuesday, October 20, 6:00 a.m.; three claims wait on it, RC-26-10417 on business day 7, RC-26-10502 on day 4, RC-26-10520 on day 3. Buttons: retry the feed, send a reminder, escalate under section 7.3. No data by business day 8: the agents propose provisional credit; a claim is never denied for missing partner data. Two partner cards: Tallowbird, a banking app for gig workers, 318 Reg E claims in September, 29 flagged, 12 denied with evidence, 97% of data requests answered within one business day against a 95% target, median 5 hours; Saltmeadow, a family and teen money app, 154 claims, 13 flagged, 8 denied and reviewed in the consistency watch, 81% against 95%, median 19 hours, feed late, one section 7.3 notice this quarter. Below, the data duties in the program agreements.
Fictional sample bank and partners. Late partner data pushes a claim toward provisional credit, never toward denial.

The BSA Officer decides whether a pattern of false claims becomes a suspicious activity report. A bank must file one for a transaction that involves or aggregates at least $5,000 and meets the regulation's suspicion tests, within 30 calendar days of first detecting the facts that may call for a report (31 CFR 1020.320(b)(3)), and it may file below that amount. Because a report and anything revealing one are confidential, the referral in the sample is visible only to the BSA Officer, is proposed only after the denial has been checked, and never reaches a letter, a customer screen or the specialist's notes to the customer.

Skills, pay and the path into the role

O*NET puts fraud examiners, investigators and analysts in Job Zone Four, where "Most of these occupations require a four-year bachelor's degree, but some do not", with several years of related experience or on-the-job training. Its wage and employment figures are published only for the broader group the occupation belongs to, "Financial Specialists, All Other", so treat them as a range-finder rather than a dispute-desk salary.

The occupation in federal data

$81,100

median annual wage, 2025, for the parent group Financial Specialists, All Other

137,800

employed in that group in 2025

9,400

projected job openings, 2025–2035

3–4%

projected growth, rated average

O*NET OnLine, 13-2099.04, data for the parent occupation. There is no federal series for bank dispute staff alone.Source: O*NET OnLine

The skills that make a good specialist are the ones O*NET ranks first, listening and writing, plus two it does not name: reading device and session data well enough to know what it cannot show, and the discipline to pay a claim the evidence does not settle. Botminds estimates that agents cut the gathering on one flagged claim from about 65 minutes to about 10, an estimate kept modest; the time that remains is the part of the job that was always the specialist's.

Questions people ask

Does a fraud claim denial need a second reviewer?

Regulation E does not require one, but the cost of a wrong denial makes it a sound control: treble damages where a bank knowingly concluded no error against the evidence, and remediation of every similar denial when a policy is wrong. In the sample bank, a supervisor who did not prepare the decision checks every denial.

Who has the burden of proof in a Reg E claim?

The bank. Under 15 U.S.C. 1693g(b) it must show the transfer was authorized or, if it was not, that the conditions for holding the customer liable were met. If it cannot, Federal Reserve staff note, the transfer is treated as unauthorized and corrected.

What are treble damages under the EFTA?

Three times the consumer's actual damages, available under 15 U.S.C. 1693f(e) when a bank did not provisionally recredit within ten days and lacked a good-faith investigation or a reasonable basis for its view, or knowingly and wilfully concluded no error against the evidence.

How much does a fraud and dispute specialist earn?

Federal data does not track dispute specialists separately. O*NET's figure for the parent group, Financial Specialists, All Other, is a median of $81,100 a year in 2025, or $38.99 an hour.

Can AI replace a dispute fraud specialist?

It can replace the hunting through systems, not the deciding. In the sample, agents gather, pair and compare records and draft the letter, but they cannot deny, post, send or refer; the specialist decides and a different person checks.

First-Party Fraud Detection.
See it on your own files.

An agentic solution from Botminds. Dispute investigators flag likely false Reg E claims with evidence, to deny fairly on record Book a demo, or explore how it works.