The fraud investigation process in banks turns an alert or a customer's report into a closed case in nine steps: the alert is raised, triaged and merged into a case; evidence is gathered; the fraud is classified; an investigator decides and a second person approves; money is recovered and the loss booked; the BSA team gets a referral if a SAR may be needed; the customer is told the outcome; and the file is closed and kept. Each step has an owner, and most carry a clock, some from Regulation E or the SAR rule, some from the bank's own policy. The process is hard because one fraud usually arrives as several alerts from different engines, the evidence sits in five or more systems, and the money keeps moving while the case is open. Botminds' Fraud Case Management runs the gathering and drafting with agents and leaves each decision with a named person.
The case followed below is from a fictional sample bank, Corvane National Bank, and its business customer Ridgeline Auto Body LLC; the names, numbers and dates are invented sample data. The legal clocks are real, and each is linked to its rule.
One account-takeover case, against the clocks that ran on it
- Alerts arrive, Oct 13 to 152 days
- Evidence, memo, decision, Oct 15 to 216 days
- One day spare before the decision clock, Oct 22
- Fraud case open8 days
- Left for the BSA team’s decision, to Nov 1222 days
What are the steps of a fraud investigation in a bank?
Nine, though banks name and group them differently. What does not vary is that each step needs an owner, a definition of done, and a clock. The table below sets out the nine as a fraud operations manager would assign them, with the sample bank's settings beside the legal clocks so the two are never confused.
Nine steps of the fraud investigation process in banks, with owners and clocks
| Step | What happens | Owner | Clock |
|---|---|---|---|
| 1. Alert | A detection engine flags a payment, login or deposit; or a customer reports a loss | Detection engines; contact center | Real time |
| 2. Triage and merge | Related alerts become one case per customer; duplicates are dropped with a reason | Intake agent proposes; an analyst decides below 0.90 | Bank: 24 hours from the alert |
| 3. Evidence | Transactions, device and session logs, images, calls, prior cases and the bank’s standards are gathered | Evidence agent; investigator | Inside the decision clock |
| 4. Classify | Who initiated the payment, and how the fraud worked | Investigator | Inside the decision clock |
| 5. Decide and approve | Confirmed fraud or not; reimburse or deny; the memo and general ledger entries | Investigator decides; supervisor approves; senior officer above a limit | Law: Reg E, 10 business days for consumers. Bank: 10 business days, 5 above $25,000 |
| 6. Recover | Wire recalls, ACH returns, check warranty claims; loss booked | Recovery agent drafts; investigator proposes; supervisor approves entries | Network and counterparty deadlines |
| 7. Refer to BSA | A referral when a SAR may be required | Referral agent drafts; the BSA team decides | Law: SAR within 30 days of detection (60 with no suspect). Bank: referral 5 business days after fraud is confirmed |
| 8. Tell the customer | The outcome, in a letter checked for any hint of a referral | Investigator sends after a wording check | Law: Reg E, results within 3 business days of finishing |
| 9. Close and keep | Case closed; rule gaps sent to fraud strategy; records kept | Supervisor; fraud strategy | Law: SAR supporting documents, 5 years from filing |
How are fraud alerts turned into cases?
By grouping the alerts that describe one fraud, so one investigator works it once. A detection engine raises an alert per event it dislikes; a fraud is usually several events. On October 13 someone reset the owner's digital banking password at Ridgeline from a new Android phone, changed the mobile number on the profile, deposited a check by phone, added a new wire payee and sent $48,600 to it. An ACH debit of $9,800 from an unfamiliar originator posted the same day. The payments fraud engine raised three alerts, one a duplicate of another; two days later the check and deposit engine raised a fourth when the check came back counterfeit.
In the solution the intake agent joins alerts that share a customer, device or payee inside 72 hours, on its own only at 0.90 confidence or above. The Ridgeline alerts joined at 0.97 into case FC-2026-18342, with the duplicate dropped and kept visible. The sample bank's triage clock is 24 hours from the alert. Without the merge, two investigators could have worked the same fraud and the bank would have counted its loss in pieces.
Gathering the evidence: what an investigator needs open
The evidence step assembles everything the decision will rest on, and in most banks it is where the hours go. For an account takeover that means core transactions, the digital banking device and session log, any deposited check images, the customer's call, prior cases on the customer and the payee, the status of any recall or return, and the bank's own standards for the controls that should have fired.
On the Ridgeline case the evidence agent pulled nine sources into a binder, each tab saying in one line what it took. The device log tab read: a new Android phone at 6:44 a.m.; the number changed at 6:47; a wire payee added at 7:03. The bank-standard tab showed why a control did not fire: the bank's standard requires a 24-hour hold on new payees after a number change, but a software release had attached the hold only to the security settings page, and the number was changed on the profile page.
Classify what happened before deciding who pays
Classification answers two questions: who initiated the payment, and how the fraud was carried out. The answers drive who bears the loss and how the case is counted. The Federal Reserve's FraudClassifier model splits first on whether an authorized or unauthorized party initiated the payment, then by method: an authorized party manipulated or acting fraudulently; an unauthorized party who took over the account, modified payment information or misused account information. Ridgeline is the second branch: an unauthorized party took over the account, using compromised credentials.
Classification also decides which law applies. A consumer's unauthorized electronic transfer falls under Regulation E. Ridgeline is a business, so its wire falls under Article 4A of the Uniform Commercial Code, under which a bank can hold its customer to an unauthorized order only if, among other things, its security procedure was commercially reasonable and followed. The memo's section on why the bank bears the outstanding loss turned on the payee hold that did not fire.
The decision, and the second signature
The investigator decides and a different person approves anything that moves money or speaks to the customer. On the sample case the drafting agent proposed confirmed third-party fraud and a $22,300 reimbursement, with all 17 memo sentences cited. The quality agent challenged one sentence that stated the owner's guess about a phishing email as fact; the supervisor accepted the corrected wording and approved the close, the reimbursement and two general ledger entries in one step. Net loss of $22,300 was inside his $50,000 limit; above it, the Chief Fraud Officer would have had to approve.
Queues and clocks: what every investigator owes, and when
Recovery: recalls, returns and the loss on the books
Recovery runs alongside the investigation, not after it, because the chances fall by the hour. On the sample case the bank sent a recall on the $48,600 wire on October 14 and got $29,100 back on October 16; the recall stays open to January 12, 2027. It returned the $9,800 ACH debit with return code R29 on October 14 and was credited on October 15. The counterfeit check of $2,800 had no recourse. Loss $61,200, recovered $38,900, outstanding $22,300.
Loss and recovery, line by line, with the entries waiting for a checker
The entries are part of the decision, not bookkeeping after it. When the close is approved, the general ledger entries to fraud losses post with the maker's and checker's names on them, which is what lets a quarter's fraud loss report be the closed cases added up rather than a spreadsheet rebuilt by hand. How to report those numbers is covered in fraud KPIs for fraud operations.
When does a fraud case become a SAR?
When it meets a reporting threshold and the bank's BSA function decides the activity is reportable; the fraud team refers, the BSA team files. For a national bank, the OCC's rule makes a SAR mandatory for a known or suspected federal criminal violation committed or attempted against the bank or through it at three fraud thresholds.
When fraud makes a SAR mandatory, and how long the bank has
Anyamount
insider abuse
$5,000
or more where a suspect can be identified
$25,000
or more regardless of a suspect
30days
to file from initial detection; up to 60 with no suspect identified
The filing clock is strict about what starts it. A bank must file within 30 calendar days of the date it first detected facts that may justify a SAR, not 30 days from the date the fraud case closes, with up to 30 more days to identify a suspect if none was identified at detection. That is why a fraud team's referral clock should be much shorter than 30 days: every day the fraud case takes is a day the BSA team does not have. On the sample bank the referral is due five business days after fraud is confirmed. Ridgeline's total of $61,200 was over the $25,000 threshold, so the referral agent drafted a referral into a restricted BSA space, and the fraud case keeps only its reference.
Banks do not have to prove the crime before reporting it; the FFIEC's examination manual is explicit that investigating the underlying crime is law enforcement's job. What happens on the BSA side after the referral, from the analyst's review to the filing decision, is set out in AML investigation steps.
How long does a bank fraud investigation take?
For a consumer's claim of an unauthorized electronic transfer, Regulation E sets the clock: the bank must determine whether an error occurred within 10 business days, or within 45 days if it provisionally credits the account within those 10 days; 20 and 90 days apply in some cases, such as new accounts. It must report the result within three business days of finishing. For business accounts there is no equivalent federal clock; the account agreement, the payment network's rules and the bank's own policy govern.
No regulator publishes how long bank fraud investigations take in practice, so a bank can only measure its own. On the sample case, the alerts arrived over two days and the case was decided six days after the last of them, one day inside the bank's five-business-day clock for cases above $25,000. Across the sample bank's third quarter, the median from a complete evidence file to a decision was 38 minutes; the waiting before that is what the clocks are there to control. A customer's view of the same timeline is in do banks really investigate fraud.
Who investigates fraud at a bank?
A fraud operations team, usually separate from the BSA or financial intelligence unit, with several distinct roles. Fraud analysts work alerts and early triage; fraud investigators work cases to a decision; a supervisor approves closes and money within a limit; a quality analyst samples closed cases; the Chief Fraud Officer owns the program, approves losses above the supervisor's limit and approves changes to the rules. The BSA officer receives referrals and owns the SAR decision. Payments operations sends recalls and returns, and the contact center takes the customer's first call.
The sample bank's queue shows the scale: 1,146 open cases across 38 investigators, about 31 each, with one supervisor leading 12. Those are sample figures; real caseloads vary with the fraud mix and the tools, and no regulator publishes them. What one of those investigators actually does with a day is in a day in the life of a fraud analyst.
What happens at the end of a fraud investigation?
The case closes with four things done: the decision recorded with its approver, the money booked, the customer told, and anything learned sent where it can prevent the next loss. On the sample case the supervisor's approval posted both entries to fraud losses, queued the customer letter for the investigator to send after its wording check, and sent rule gap RG-114, the payee hold that did not fire, to fraud strategy. The bank's report shows 14 cases and $212,400 of gross loss tied to that gap in one month.
Closed and posted: who made each entry, and who checked it
What the bank keeps depends on what happened next. If a SAR is filed, the bank must keep it and its supporting documentation for five years from the filing date. The sample bank keeps every case record for five years from close as its own policy, which covers cases that never became SARs. Writing the memo so it survives that long is the subject of how to write a fraud investigation report.
Questions people ask
How does bank fraud investigation work?
An alert or a customer report opens a case; an investigator gathers the account records, logs and documents, decides whether fraud occurred and who bears the loss, and a second person approves any reimbursement or write-off. If the activity meets a SAR threshold, the case is referred to the BSA team, which has 30 days from detection to file.
Do banks investigate small fraud amounts?
For consumers, yes: Regulation E's error-resolution duties apply to an unauthorized electronic transfer of any amount reported in time. The SAR thresholds are separate and only decide whether the case must also be reported.
Who decides whether a fraud case is reported to FinCEN?
The bank's BSA function, not the fraud investigator. The fraud team refers the case with its facts; the SAR decision maker, an individual or committee, decides and files, and the fraud case never shows the outcome.
Can a fraud case be reopened?
Yes, when new evidence arrives, such as a late recall payment or a second victim on the same device. On the sample bank, an investigator can split an alert out of a case with a reason code, and linked cases on the same device stay connected.
Does the fraud team call the police?
Usually the bank's report goes to FinCEN through a SAR. The SAR rule adds that for violations needing immediate attention, a bank must also notify law enforcement by telephone at once, in addition to filing on time.