New account fraud detection: one account's first 90 days, traced

New account fraud detection is the work of finding deposit accounts that were opened to steal, whether with a stolen identity, as a rented mule account or as a bust-out waiting for one large check, before the money leaves. Banks detect it by reading three things together: the opening file against what the account has done since, the account's events as one timeline, and the other accounts it shares a device, phone, address or check book with. It is hard because each signal looks ordinary alone, the evidence sits in four or five systems, and a young account can turn in an hour. Botminds' New Account Fraud Detection is built for exactly that read: agents assemble it and propose an action with reasons, a fraud analyst decides, and a second person checks every restriction.

The trace below uses the solution's sample data. Tessaly Community Bank, its fintech partners Fernway, Harborly and Quillo, and every customer, check and device named here are fictional.

How do banks detect new account fraud?

Most banks still detect it by hand, one alert at a time. In the Federal Reserve's 2026 survey of financial institution risk officers, "71% of institutions" relied on manual review to identify mule accounts and "less than half" used automation, and "49% only discover it after losses occur" (Federal Reserve Financial Services, 2026 Risk Officer Survey; the survey says of itself that it is not independent academic research; margin of error ±6%). The same survey found that manual review of the account holder at opening was the most common detection method; automated review at opening was used by 36%.

The rule behind the work is the Identity Theft Red Flags Rule, which requires each bank to have procedures to detect the red flags it has chosen and to respond in proportion to the ones it finds (12 CFR 41.90(d)(2)(iii)). The rule says what a program must do, not how. In practice the work comes down to three questions about every young account: does it still look like the person who opened it, does its behavior have a known fraud shape, and is it alone. The rest of this page answers them in order on one account, then follows the decision.

Day 0: what the opening file promised

Jordan Kell opened Fernway Everyday Checking in the Fernway app on Saturday, October 3, at 11:42 pm. At a sponsor bank like Tessaly the bank never met the applicant: it received the file Fernway sent, with an identity check passed at 71 against Fernway's pass mark of 65, a stated occupation of warehouse associate, expected activity of $1,000 to $2,500 a month in wages, and a stated purpose of everyday spending. The email address had been created nine days earlier, and the phone number was a VoIP line.

None of that is a reason to refuse an account. A young email is common among people who have just changed providers, and a pass is a pass. What the file is for, nineteen days later, is a comparison: the opening file is the account's own statement of what it would be, and the most useful fraud question is how far its life has drifted from it. The Customer Identification Program rule itself allows identity to be verified within a reasonable time after the account is opened, not only before (31 CFR 1020.220(a)(2)(ii)), so the file a partner sends at opening is the start of the evidence, not the end of it. How the identity check itself is run belongs to the customer identification program; this trace starts after it passed.

Days 2 to 14: small deposits, a new device, a mailbox

The account's first two weeks are the part a rules engine scores as ordinary. A $25 first deposit on day 2, a $40 payment in on day 6, $35 more on day 9: a balance of $100. On day 12 a new Android device, ending 7Q4C, began logging in. On day 14 the address changed to 1180 Larkin St, Apt 4, a private mailbox at a shipping store.

Each of these events, alone, matches a list of red flags that every program borrows from. The interagency guidelines give "a suspicious address change" as an example of suspicious personal identifying information, and list mail drops among the addresses commonly associated with fraud. But a mailbox is also where many honest people who move often receive post. What separates the two is order and company: a device change followed within two days by a mailbox, on an account whose only money in is three small transfers, describes an account being prepared, not a person settling in. The guide to new account fraud red flags by day takes those combinations one window at a time.

Day 19: the check that does not fit

On Thursday, October 22, at 6:14 am, a $6,200 mobile check arrived: Halbrook Roofing & Siding LLC, check 10482, drawn on Calder Valley Bank, memo "roof job". At 6:31 am a $3,000 transfer out was attempted and held by the bank's fraud detection engine, which gave the account a score of 912 against Fernway's threshold of 640. A score says the account is risky. It does not say why, or what else to look at, and a held transfer does not stop the next one.

By the time the analyst opened the account, the behavior agent had already written its sentence: "A bust-out in setup: three small deposits, then a $6,200 mobile check on day 19, from a device that opened four other accounts this week." It gave its confidence as 93%. A warehouse associate expecting wages received a roofing contractor's check, on a device that had appeared on day 12, at a mailbox set on day 14. Clicking the $6,200 dot opened the check image itself, and the note under it: the same check stock as items 10479, 10481 and 10485, deposited to three other Tessaly accounts that week.

The first 90 days on one line, with the agents’ sentence on top

How do you find linked fraudulent accounts?

You find them by joining accounts on the things a fraudster has to reuse: devices, phone numbers, email patterns, addresses, payments between the accounts and, for check fraud, the check stock itself. Done by hand, that is a search per attribute, per system, and it is why rings are so often found one account at a time. The Federal Reserve's synthetic identity toolkit gives the same list for a post-loss review: search by name, address, phone, email, birthdate and SSN, and "Identify the device ID and IP address (if available) used to access the account and cross-reference to find potentially linked accounts" (Federal Reserve, Identifying Existing Synthetics Post-Loss).

Here the link agent joined Jordan Kell to Talia Brennan and Keisha Lowery at Fernway, Marcus Odell at Harborly and Ray Duquesne at Quillo. Three of the five sit at different partners, which is the point: a partner sees only its own customers, and only the bank sees all of them. The rule the agent works under is printed on the screen, "A shared item is evidence, not guilt", and the analyst can untick any account to leave it out of the decision. A household that shares one tablet is not a ring; a device that opened four accounts in six days and then took over a fifth is.

Linked accounts: five accounts, three partners, one device, one check book

Can AI restrict a new bank account? Not on its own

It should not, and the clearest public reason is an enforcement action. In 2022 the CFPB found that Bank of America acted unfairly when it turned down prepaid cardholders' error notices and froze their accounts on nothing more than a fraud filter's output, a filter the Bureau called flawed; the order carried a $100 million penalty, beside a $125 million OCC fine (CFPB, Bank of America, N.A., 2022). That case was about error claims, not new accounts, but the lesson travels: a filter that freezes accounts by itself, without a person weighing the evidence, is the design regulators have already found unfair.

So in the solution the action agent proposes and stops. For the ring it proposed restricting all five accounts, holding the four Halbrook checks under the Regulation CC new-account exception, referring the case to the BSA team, and notifying Fernway, Harborly and Quillo. Its confidence was 93%; below 80% it would have asked a person instead of proposing. The analyst kept the proposal and the ring scope. Had she chosen anything else, the screen would have required an override reason, which is how a bank later learns whether its proposals or its analysts were right.

The hold itself rests on a specific rule. During an account's first 30 calendar days, Regulation CC releases an ordinary check deposit from the normal availability schedule (12 CFR 229.13(a)(1)(iii)), so a bank may hold it longer than the two business days a local check otherwise gets. Jordan Kell's account was on day 19. The four other accounts, opened October 15 to 20, were younger still. How a bust-out uses those few days, and what each day of delay costs, is its own page.

The decision: restrict the ring, with reason codes and a checker named

What is a reason code for an account restriction?

A reason code is the short, standard statement of why an account was restricted, chosen from a list the bank controls. It does three jobs that free text cannot. It lets the checker see in seconds which evidence the decision rests on; it lets the bank count, a quarter later, how many restrictions rested on each reason and how many of those were reversed; and it is the raw material for the program review the Red Flags guidelines expect, which asks how effective the bank's procedures have been. Here the analyst chose three: R-03, linked by device and address; R-07, deposit does not fit the stated activity; and R-05, counterfeit-looking check stock.

The notices, and the sentence that came out

A restriction creates duties to tell people, and one duty not to. Each partner's program agreement says what it must be told and how fast; Fernway's, under its section 7.3, asks for notice within one business day. The customers whose deposits were held get a hold notice. And nobody outside the bank may learn of a suspicious activity report: no bank, and nobody who works for or acts for one, may disclose a SAR or anything that would show one was filed (31 CFR 1020.320(e)).

The notice agent drafted three partner notices and five customer hold notices. In Fernway's draft it struck one sentence before anyone approved it: "We have also flagged these accounts for a suspicious activity review." The internal draft shows the strike; Fernway's view never contains it. Only the bank's fintech partner risk manager can approve and send a partner notice. The referral itself went to a queue only the BSA team can open, with its 30-day filing clock running from the day of detection.

Who approves closing a new account for fraud?

A second person who did not make the decision. Regulators do not prescribe the title, but separating the maker from the checker is the ordinary control for any action that freezes a customer's money, and the Red Flags guidelines expect someone at a senior level to own the program's oversight. In the solution, the fraud operations lead checks every restriction and every closure, sees the five accounts, $19,355 in checks held, $5,400 in transfers out held, the reason codes and the evidence, and approves or returns it with a reason. The approval cannot be his own submission. Once approved, the holds and blocks are applied in the core banking system.

Maker and checker: the ring waits for a second person

Behind the decision sits a trail an examiner can read: each agent's step, the analyst's submission, the checker's approval and the notice agent's strike, each with who, what, when, why and the evidence. Entries about the BSA referral show only as restricted to anyone outside the BSA team. Whether a detection set like this one would have caught last year's fraud, and how many good customers it would have stopped, is a separate test: replaying it on closed accounts before it runs. To see the whole sequence on your own accounts, start from New Account Fraud Detection.

Questions people ask

What signals show a fraudulent new account?

No single signal does; combinations do. The interagency Red Flags guidelines list examples such as an address that is a mail drop, an address or phone shared by an unusually large number of applicants, and a material change in electronic fund transfer patterns on a deposit account. On a young account the strongest combinations pair a change in who controls it, such as a new device or address, with money that does not fit the opening file.

How long should new accounts be monitored for fraud?

Regulation CC treats an account as new for its first 30 calendar days, which governs how long a bank may hold deposits under the new-account exception. Many fraud teams watch longer; the solution's default review window is 90 days, a bank setting rather than a legal requirement, after which an account graduates from new-account review.

How do you explain an account restriction to the customer?

By saying what is restricted, which deposits are held and until when, and how to reach the bank, without mentioning any report to the BSA team. The SAR rule bars disclosing anything that would reveal that a report exists, so a customer notice describes the restriction and its practical effect, never a referral.

Can a fraud detection score alone justify a restriction?

A score can start a review but should not end one. In the CFPB's 2022 order against Bank of America, freezing accounts on an automated fraud filter's output alone was found unfair. A defensible restriction carries the evidence and reasons a person weighed.

What happens to the money held on a restricted new account?

It stays in the account under the hold until the bank decides. If the deposited checks come back unpaid, the bank can reverse the credit it gave for them; if they clear and the review finds the customer legitimate, the restriction is lifted and the funds are released. In the sample, $19,355 in checks and $5,400 in transfers out were held before any of it left.