New account fraud red flags: what to watch from day 1 to day 90

New account fraud red flags are the signs that a newly opened deposit account was opened, or is being used, to steal: a mail-drop address, a device or phone shared with other new accounts, a deposit that does not fit the stated job, money withdrawn the moment it lands. Which ones matter depends on the account's age. Regulation CC calls an account new for its first 30 days, but stolen-identity accounts, rented mule accounts and bust-outs often show their shape later, so fraud teams watch three windows, days 1 to 30, 31 to 60 and 61 to 90, each with its own short list. Botminds' New Account Fraud Detection reads an account's flags as one line of events through those windows and proposes a decision only when they form a known shape.

Examples come from the solution's sample data; Tessaly Community Bank, its partners and customers are fictional.

What are the red flags of new account fraud?

They are the patterns that suggest the account is not what its opening file says. The federal Identity Theft Red Flags Rule defines a red flag as any pattern, practice or particular activity that points to possible identity theft, and its guidelines append 26 illustrative examples in five groups: warnings from consumer reporting agencies, suspicious documents, suspicious personal identifying information, unusual use of the account, and notice from customers, victims or law enforcement (Appendix J to 12 CFR part 41). A bank picks the ones relevant to its own accounts and adds its own.

For a deposit account opened online or through a fintech partner, the examples that do most of the work are a handful. An address that is "fictitious, a mail drop, or a prison". An address or telephone number "the same as or similar to" one "submitted by an unusually large number of other persons opening accounts". An SSN "the same as that submitted by other persons opening an account". And, once the account is live, "A material change in electronic fund transfer patterns in connection with a deposit account". The 2009 interagency FAQs add the point that matters most in practice: the examples "may only be relevant when combined or with other indicators of identity theft" (Frequently Asked Questions: Identity Theft Red Flags and Address Discrepancies, 2009).

How long is a bank account considered new? 30 days, with one exception

For funds availability, 30 calendar days. Regulation CC treats an account as new for the first 30 calendar days after it is opened (12 CFR 229.13(a)(2)). The exception matters for fraud teams: an account is not new "if each customer on the account has had, within 30 calendar days before the account is established, another account at the depositary bank for at least 30 calendar days". A customer who opens a second account at the same bank does not reset the clock; a stranger arriving through a partner's app always starts it.

Nothing in the fraud rules ties monitoring to 30 days. The Red Flags Rule covers accounts both at opening and for as long as they exist, and the anti-money-laundering rules require "ongoing monitoring to identify and report suspicious transactions" for every customer, on a risk basis (31 CFR 1020.210). The 30 days define how long a bank may hold deposits more tightly, not how long it should look. That gap is why many fraud teams run a longer review window, and why the solution's default is 90 days.

Days 0 to 30: who controls the account, and does the money fit?

In the first month, the red flags that matter are changes of control and money that contradicts the file. A device that appears on day 12 and has already opened other accounts is a change of control. So is an address moved to a private mailbox on day 14. Money that contradicts the file is a stated warehouse associate who receives a roofing contractor's $6,200 check instead of wages. Each alone has an innocent reading. Together, in that order, they describe an account being prepared for a bust-out, which is what the solution's behavior agent called the sample account of Jordan Kell on day 19.

This is also the window in which money moves fastest after it lands. FinCEN's 2024 alert on deepfake identities lists, among indicators that warrant more diligence, "Patterns of rapid transactions by a newly opened account or an account with little prior transaction history" and "Patterns of withdrawing funds immediately after deposit" (FinCEN Alert FIN-2024-Alert004). In the sample, a $3,000 transfer out followed the $6,200 deposit by 17 minutes. The sample bank's settings reflect the window: a deposit of $2,500 or more on an account under 30 days old must be decided within four business hours, while other accounts in review get two business days.

Days 31 to 60: the dormant account that wakes

After the first month, the most common pattern changes from preparation to sudden use. An account opens, stays almost empty for weeks, then receives large credits and sends them on within hours. FinCEN's mail-theft check fraud alert describes the check version: "Non-characteristic, sudden, abnormal deposit of checks, often electronically, followed by rapid withdrawal or transfer of funds" (FinCEN Alert FIN-2023-Alert003). The opening-day checks were passed weeks ago, and Regulation CC's new-account hold no longer applies after day 30, so the bank's main protections are the general exceptions and its own monitoring.

In the sample bank's queue, the dormant-then-burst shape appears on accounts at day 41 and day 45. The second received a $9,300 wire and sent $9,000 out the same evening, and the sending bank later asked for the money back. The guidelines' example 21(d), a material change in electronic fund transfer patterns, fits exactly; the trouble is that a month of silence also fits "ordinary life" until the day it does not, which is why the window needs watching rather than a check at day 30.

The review queue, filtered by day band, with an SLA clock on every account

What are early warning signs of a money mule account?

Credits from people or businesses with no visible tie to the customer, sent on quickly, leaving a balance near zero; several new accounts receiving from the same senders; and, at opening or soon after, a device, address or phone shared with other new accounts. The FBI's definitions explain why the signs vary. Unwitting mules do not know they are part of a larger crime; witting mules may have been warned by bank staff and still go on opening accounts; complicit mules may open accounts at one bank after another for the purpose of receiving criminal money (the guide to types of money mules takes each in turn; FBI IC3, Money Mules: A Financial Crisis, 2021).

Only the last group opens an account already intending to use it that way. The first group often starts as an honest customer and becomes a mule weeks later, after answering a job advertisement or a romance scam, which is why mule pass-through tends to show in the second and third windows rather than on day one. The FinCEN deepfake alert's "Patterns of apparent coordinated activity among multiple similar accounts" is the signature a bank can see that no single account shows. Detecting mules on established accounts is the subject of the division's money mule work; for new accounts, the link between them is the first and strongest sign.

Days 61 to 90: the mule that settles in

By the third month a fraudulent account usually looks like a customer, and the flags become patterns of flow rather than events. Credits from several unrelated senders, each sent on within a day; P2P payments to the same handful of new accounts; a balance that never holds. A synthetic identity can also sit quietly here, building a history before it is used. The Federal Reserve's synthetic identity toolkit warns that a deposit account opened on a synthetic identity may show nothing suspicious until the day it is deliberately overdrawn, so the absence of flags at day 75 is not proof of good faith.

Of the 64 accounts the sample bank restricted or closed in October, mule pass-through was the largest single shape, ahead of bust-outs, and the median account was restricted on day 17 of its life. That is sample data, but the split it shows, early bust-outs and later pass-throughs, is the reason a 30-day watch catches one and misses the other.

Why do banks hold deposits on new accounts?

Because a new account has no history to say whether its deposits are good, and a check can come back unpaid days after the money has been withdrawn. Regulation CC lets a bank make less money available, and later, during the first 30 days: next-day availability for certain checks applies only to the first $6,725 deposited on a banking day, the rest available no later than the ninth business day, and ordinary checks fall outside the normal schedule altogether (12 CFR 229.13(a)(1)). The new-account hold is the main reason the first 30 days are the cheapest window in which to stop a bust-out; how bust out fraud works follows the money day by day.

A hold is a tool, not a verdict. A bank that holds every new customer's paycheck for a week loses good customers; the new-account exception is useful precisely because it can be applied to the deposits that do not fit, with a notice the customer can act on.

When does a new account graduate from monitoring?

When the bank's own rule says so, and the rule should be a decision rather than a date. In the solution the review window is a setting, 90 days by default. Our advice is to attach conditions to the date: graduate an account only if nothing is open, meaning no unresolved flag, no outstanding request to a partner for missing opening data and no deposited check still inside its return window. In the sample queue, an account opened at a branch was marked "ready to graduate" on day 84 because its activity matched its file. Graduation does not end monitoring; it moves the account from the new-account watch list to the bank's ordinary transaction monitoring.

Results for the fraud committee: what the restricted accounts looked like

Reading flags one window at a time is the analyst's view of the work; the step-by-step trace of one account shows how the agents assemble it, and New Account Fraud Detection shows the windows on your own accounts.

Questions people ask

What does a red flag on a bank account mean?

It means the bank has seen a pattern or activity it treats as a possible sign of fraud or identity theft, and it may review the account, ask the customer for information, hold a deposit or restrict use while it does. A red flag is a reason to look, not a finding; most programs act only when several flags fit a known pattern.

Is a large first deposit a red flag?

Only against the opening file. A large deposit that matches stated income or a stated purpose, such as moving savings from another bank, is ordinary. A large check from an unrelated business, on an account whose file says modest wages, followed by a quick transfer out, is one of the clearest bust-out patterns.

Why did my bank restrict my new account?

Usually because a deposit did not fit what the account was opened for, the account's details matched other accounts the bank was reviewing, or the bank could not finish verifying identity. The Customer Identification Program rule expects banks to set "The terms under which a customer may use an account while the bank attempts to verify the customer's identity", so limited use during review is a standard response.

Do red flags differ for accounts opened through a fintech app?

The flags are the same; what differs is who sees them. A partner sees its own customers, so a device or address shared across partners is visible only to the bank, and only if it receives each partner's opening data, including device identifiers, in time to compare.

How many red flags are in the federal guidelines?

Twenty-six illustrative examples in five categories, in Supplement A to the interagency guidelines. They are optional: a bank "may consider incorporating" them, and the agencies judge a program by its overall effectiveness rather than by which examples it adopted.