New account fraud detection that reads each account's first 90 days, so a ring is restricted before its first big check clears
Bad accounts restricted before the first big deposit clears, with partners told on time.
See one case, screen by screen ↓New account fraud detection finds deposit accounts opened with a stolen identity, rented out as money mule accounts or seasoned for a bust-out, in their first 90 days. In New Account Fraud Detection, agents re-read each account's opening file, draw its first 90 days on one line and find linked accounts, then propose monitor, restrict or close for a fraud analyst to decide and a second person to check.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
New account fraud detection has a short window. A new checking account is most dangerous in its first 90 days: a stolen identity opens it, a mule recruiter rents it, or a fraudster seasons it with small deposits and then pushes one large check through before the item can come back unpaid. At a sponsor bank most of these accounts are opened inside a fintech partner's app, so the bank sees each opening only as the file the partner sends.
Today an analyst rebuilds the account from the core, digital banking device data, the check image archive and the partner's file, one alert at a time, and the alert gives a score, not a reason. Linked accounts are found by searching one attribute at a time, though a ring opens five accounts in a week across two or three partners. Every restriction needs a second person, each partner is owed the notice its program agreement requires, usually written from scratch, and a referral to the BSA team must never reach the partner or the customer.
Estimated split of about 40 minutes by hand for one account, from the opening file to a decision, against the 10-minute target with the agents.
Three agents read each new account from three sides: its opening file, its first 90 days and its neighbors. An analyst decides; a checker approves.
Tessaly Community Bank runs a sponsor-bank program with 14 fintech partners. On Thursday, October 22, 2026, a $6,200 mobile check lands on an account opened 19 days earlier in a partner's app. Here is what happens next, screen by screen, in the working solution.
Marisol opens Lifelines. On the left are the 12 accounts that need a decision today, out of 38 in review, sorted by day in life from day 2 to day 84, each with its shape in plain words. She picks Jordan Kell, who opened Fernway Everyday Checking in the Fernway app on Saturday, October 3 at 11:42 pm. Today is day 19 of 90.
Every event is a labeled dot sized by amount: the opening, an identity check passed at 71 against a pass mark of 65, deposits of $25, $40 and $35, a new Android device on day 12, a private-mailbox address on day 14, then a $6,200 mobile check at 6:14 am and a $3,000 transfer out 17 minutes later, held by the fraud detection engine. The shaded band is the 30-day new-account hold window.
“A bust-out in setup: three small deposits, then a $6,200 mobile check on day 19, from a device that opened four other accounts this week.” 93% confident.
Marisol clicks the $6,200 dot and opens its source, the remote deposit item from document imaging: a Halbrook Roofing & Siding LLC check, number 10482, payable to Jordan Kell, drawn on Calder Valley Bank, memo “roof job”, deposited from device ····7Q4C. Her view of the source is logged.
“Same check stock as items 10479, 10481 and 10485, deposited to three other Tessaly accounts this week.”
The agent sets what Fernway sent on October 3 beside what the account has done since, field by field: 10 mismatches in 13 fields. Name, date of birth and ID number still fit. The address is now a private mailbox that two ring accounts also give, the device was replaced by the one behind the ring, and a warehouse associate expecting $1,000–$2,500 a month in wages received a contractor's $6,200 check. It proposes moving the customer risk rating from Low to High.
The file is scored against §4.2 of Fernway's program agreement: this one is complete; Fernway's October files are 88% complete.
Jordan Kell, Talia Brennan and Keisha Lowery at Fernway, Marcus Odell at Harborly and Ray Duquesne at Quillo were opened in six days. All five share device ····7Q4C, three give the Larkin St mailbox, and four were funded with Halbrook checks from the same book: $6,200, $4,780, $5,400 and $2,975, or $19,355 in all. Each shared item opens its evidence, and unticking an account leaves it out of the decision.
“A shared item is evidence, not guilt.”
The action agent proposes restricting all five accounts, holding the four Halbrook checks under the Reg CC new-account exception, referring to the BSA team and notifying Fernway, Harborly and Quillo. Marisol keeps Restrict with the ring as the scope: debits, P2P and transfers out blocked, deposits held with a written notice of the reason, debit cards frozen, digital banking view only. She picks reason codes R-03, R-07 and R-05 and submits it for a checker.
Choosing anything other than the agents' proposal requires an override reason.
Grant's approvals show the ring restriction with the five accounts, $19,355 in checks held, $5,400 in transfers out held, the reason codes and the evidence, to decide by 12:00 pm. He approves, and the holds and blocks are applied in the core. Below it, threshold version v15 waits for the Model Risk Manager, so his Approve button is disabled with the reason shown.
“Threshold and agent versions are approved by the Model Risk Manager.”
The notice agent drafts three partner notices and five customer hold notices. Fernway's, under §7.3 of its program agreement, lists the three restricted accounts, what Fernway must do in its app, and a reply due Friday, October 23 at 5:00 pm. The internal draft shows the one sentence the agent struck because it mentioned a referral. Only Naomi Feld, the Fintech Partner Risk Manager, can approve and send it.
“Notice agent removed 1 sentence before anyone approved it.” Fernway never receives it.
Referral BR-2026-0417 for ring R-1022 reaches Curtis's restricted queue with a SAR decision due November 21, 30 days from detection, beside older referrals counting down, one of them two days from its deadline. Anyone outside the BSA team sees a locked screen, and the attempt is logged.
“Nothing here reaches a partner, a branch screen or a customer notice.”
The audit trail shows the link agent's five-account link, Marisol's submission, Grant's approval and the notice agent's tipping-off check, each with who, what, when, why and the evidence. Entries about the referral show only as restricted. Owen builds an FDIC examiner pack for October 1–22: 412 entries and 63 sources, SSN and date of birth masked, each file sealed with SHA-256.
The same ring, seen by the people who carry it: what their morning looked like, and what it looks like now.
Three agents read each new account from three sides: its opening file, its first 90 days and its neighbors. An analyst decides; a checker approves.
Re-reads each partner's account-opening file and the CIP and CDD record against what the account has done since, field by field, and scores the file against the partner's program agreement.
Draws days 0 to 90 of a new account as one line and writes one sentence on its shape: bust-out, mule pass-through, stolen identity, kiting, synthetic-looking or ordinary life.
Joins accounts across partners and branches by device, phone, email, address, payments between them and check stock.
Proposes keep monitoring, restrict or close, for one account or a whole ring, with the evidence, reason codes and Reg CC hold reasons, and a confidence for each proposal.
Drafts the partner notices each program agreement requires and the customer notices, and removes anything that would reveal a referral.
Builds the referral packet for the BSA team's restricted queue: the decision, the evidence and the 30-day clock.
Scores each partner's file quality, review and restriction rates and notice duties, watches its feed, and proposes per-partner review thresholds from outcomes.
Decides with a reason; a lead checks. The agents propose; a named person decides.
Ask in plain words. Every answer cites its source, and the assistant can open the screen for you.
Why do the agents call Jordan Kell a bust-out?
Three small deposits in 14 days, $25, $40 and $35, then a $6,200 mobile check from Halbrook Roofing on day 19, and a $3,000 transfer out 17 minutes later, held. Fernway's file says warehouse associate, wages $1,000–$2,500 a month.
Which other accounts share Jordan Kell's device?
Four: Talia Brennan and Keisha Lowery (Fernway), Marcus Odell (Harborly) and Ray Duquesne (Quillo), all opened on device ····7Q4C between October 15 and October 20. Three use the Larkin St mailbox and three hold Halbrook checks 10479–10485.
Draft the Fernway notice without anything the partner must not see
Drafted under §7.3 of the Fernway agreement: three accounts, the action Fernway must take in the app, and the reply due by Friday 5:00 pm. I removed one sentence that mentioned a referral (31 CFR 1020.320(e)). Here is exactly what Fernway will see.
Which partner sends the most accounts to review this month?
Fernway: 71 of the 298 reviews this month, from 1,412 openings (5.0%), and 17 restrictions. Its files are missing the device identifier on 12% of openings, which §4.2 requires. Tidewell's feed is late this morning.
13 screens from the working solution, on its sample data. Pick one to see it large.
The thresholds, clocks and data rules every new account is watched against are settings, versioned and on the record.
| Setting | Default | Choose from |
|---|---|---|
| Review score threshold | Fernway 640 · branches 700 | Set per partner and for branches; a new version runs once the Model Risk Manager approves it |
| Agent confidence floor | 70% | Set per agent (link agent 75%, action agent 80%); below it the agents ask a person instead of proposing |
| Review window | 90 days | Accounts graduate from review at day 90 |
| Deposits of $2,500 or more on accounts under 30 days | Decide within 4 business hours | Escalate to the lead at 75% · other accounts in review within 2 business days |
| Restrictions and closures | Checked within 2 business hours | A maker never checks their own decision |
| Partner notices | Within each agreement's window | 1 or 2 business days by partner (1 for Fernway) · escalate to the Partner Risk Manager at 50% |
| Reason codes | R-01 to R-12 | Override reasons O-01 to O-06, required when a person differs from the agents |
| Data retention and masking | Five years from account closure | SSN and date of birth masked on every screen and export; unmasked for the BSA team on request, logged |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures and rules (Federal Reserve Financial Services, 2026 Key Findings from the Financial Institution Risk Officer Survey: 51% of institutions identified mule activity only after losses; 31 CFR 1020.320, SAR within 30 days of initial detection and its confidentiality; 31 CFR 1020.220, Customer Identification Program; 12 CFR 229.13, the Reg CC new-account exception; 31 CFR 1010.430, five-year retention). Tessaly Community Bank, its fintech partners, customers, checks, accounts and devices named on this page are fictional, and the people are characters in the working solution.
New account fraud detection finds deposit accounts opened with a stolen identity, rented out as money mule accounts or seasoned for a bust-out, in their first 90 days. In New Account Fraud Detection, agents re-read each account's opening file, draw its first 90 days on one line and find linked accounts, then propose monitor, restrict or close for a fraud analyst to decide and a second person to check.
In the sample case: a young email and a VoIP phone at opening, a few small deposits, a new device, an address changed to a private mailbox, then a large check that does not fit the stated occupation and a transfer out minutes later. Each is common on its own; the behavior agent reads them together as a shape and cites the record behind each one.
The link agent joins accounts across partners and branches by device, phone, email, address, payments between them and check stock. Each shared item opens its evidence, and the analyst can leave any account out before restricting the ring as one decision. A link is treated as evidence, not guilt.
The onboarding agent re-reads each partner's opening file against what the account has done since and scores the file against the program agreement. The partner oversight agent tracks each partner's file quality, feed and notices owed. When a feed is late, accounts opened in the meantime are held in restricted funding until their files arrive and are re-read.
No. The notice agent removes any wording that mentions a referral and shows exactly what the partner will see, and the Fintech Partner Risk Manager approves each notice before it is sent. Referrals sit in a restricted queue that only the BSA team can open, with a 30-day SAR decision clock.
Yes. The agents propose and never restrict, close, notify, file or change a customer record. A fraud analyst decides with reason codes, records an override reason when they differ from the agents, and a Fraud Operations Lead checks every restriction and closure; nobody can approve their own.
Yes. Review thresholds per partner and for branches, agent confidence floors, the review window, SLAs and escalations, reason codes, notice windows, retention and masking are settings. Each change is versioned, and the Model Risk Manager approves threshold and agent versions before they run.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your fraud policy, partner program agreements and a sample of past new accounts, and it goes live once every quality gate has passed. We will walk you through it on your own accounts first.
Mule accounts frozen while the money is still there, and every victim's bank told.
1-min demoAccount Takeover Fraud PreventionTakeover transfers held before they leave; the real customer called on a trusted number.
1-min demoAPP Fraud DetectionScam payments stopped mid-call, with every question and answer kept for the claim.
1-min demoWe'll run New Account Fraud Detection on a sample of your own new accounts and partner opening files.