Scams and stolen credentials now account for most of the fraud dollars banks lose. Both arrive with a valid login or the account holder’s own approval, so the defense has to start at the transaction.

The fraud mix has flipped. For years the industry worried most about the forged check and the counterfeit card. Now most of the money leaves through the front door, with a valid login or the account holder’s own approval.

PYMNTS reported on Oct. 16 on “Scams Get Personal: Why Banks Pay More to Fight Fraud,” a PYMNTS Intelligence report based on a July 2026 survey of 90 executives at U.S. banks, credit unions and FinTechs. Scams alone now make up 22.4% of fraud dollars, up from 12% in 2025. Add account takeover through stolen credentials (28.2%, a share that grew 82%) and the total reaches 50.6% of fraud dollars, up from 27.6% two years earlier. Physical forgery and counterfeit fraud fell to 6.1%.

Half the losses now come from transactions that look legitimate at the moment they’re made.

The member is the one pressing “send”

The report puts the core problem plainly: “A customer can authorize a transaction without understanding who will receive the money.”

That is the playbook the American Bankers Association is trying to break. On Oct. 1 the ABA relaunched its #BanksNeverAskThat campaign with a new “Scam Slayer” initiative and more focus on AI and deepfakes. “Artificial intelligence makes it easier for criminals to create convincing impersonations and target more people,” said Paul Benda, ABA executive vice president for risk, fraud and cybersecurity, “but it does not change their ultimate goal: getting consumers to surrender sensitive information or send money.” He added: “A familiar voice or realistic video is no longer enough to prove that a request is legitimate.”

Benda walked through the typical script for WFSB on Oct. 13: “They’ll send a fake fraud alert. You’ll say, ‘No, I didn’t make that purchase,’ and they’ll immediately call you.” The caller ID may even show the bank’s real number. His advice is to hang up and call the number on the back of your debit card.

Good advice. Education matters. But a campaign can’t be on the phone with every member at the moment a scammer is.

The losses are bigger than the official numbers

The scale is hard to overstate. A Gallup survey for the Stop Scams Alliance estimated 2025 U.S. scam losses at $68 billion, against roughly $16 billion reported to federal agencies, American Banker reported. The estimate has a wide 95% confidence range, from $33 billion to $114 billion, but even the low end is about double the official count.

Two findings land squarely on financial institutions. Fifteen percent of scams involved someone impersonating a bank or credit union employee, second only to fake tech support. And 66% of victims recovered none of their money. Meanwhile 55% of scam reports went to a bank, credit union or other financial institution. Members already treat you as the place to turn after the money is gone.

More tools, more complexity

Institutions aren’t standing still. Per PYMNTS, every surveyed institution uses tools that analyze behavior, identify devices and verify identity, and 96% use machine learning or AI. Yet 78% now cite the complexity of new technology systems as their top barrier to innovation, up from 48% a year earlier.

Stacking more detection tools doesn’t help if every one of them ends in the same place: an alert in a queue.

Real-time detection isn’t the same as real-time protection

When the login is valid and the member approved the payment, the gates at the front door have already said yes. The only decision point left is the transaction itself: the new payee, the drained balance, the transfer that doesn’t fit anything the member has done before.

Seeing that in real time is necessary. It isn’t enough. A scammer on the phone is working in minutes. An alert that waits for an analyst to start a shift is a record of the loss, not a defense against it.

The old model: Detect → Alert → Wait for a human.

The model this moment demands: Detect → Assess → Act.

Where RembrandtAi® fits

RembrandtAi® doesn’t stop at telling you something looks wrong. It ingests events across every channel (card, ACH, remote deposit, online banking, ATM), scores each one in real time with multi-stage AI, including neural networks, statistical analysis and machine learning scoring, and checks that risk score against your thresholds. Then it acts directly in your banking core. Member alerts, card restrictions, transaction blocks, account freezes and access suspension fire automatically, 24/7/365, with no human in the loop required.

That matters most when the fraud comes through the front door. RembrandtAi® doesn’t need the login to look wrong. It judges what’s happening in the account as it happens, and when behavior breaks from the member’s pattern, the countermeasure is already underway, often while the scammer is still on the line.

Humans still matter. Your team sets the thresholds, works the exceptions and owns the member relationship. RembrandtAi® makes sure the money doesn’t wait on them.

The approach has a track record. Launch Credit Union adopted RembrandtAi® at the end of 2020 and saw a 97% reduction in fraudulent transactions, saving $1.8 million in 2021, American Banker reported. As CFO Kevin LeBeau put it: “If you’re uploading three hours later, that money is already gone.”

The takeaway

Half of fraud dollars now move with a valid credential or the member’s own approval. Education campaigns like #BanksNeverAskThat help members hang up sooner. More detection tools help you see more. Neither stops a payment that’s already in motion.

What stops it is acting at the speed of payments, in the core, every hour of every day.

Identity is a moment. Risk is continuous.

See how RembrandtAi® acts in real time, in your core. Request a demo.

Sources

1. PYMNTS, “Scams Capture 22.4% of Fraud Dollars as Banks Adjust Defenses,” PYMNTS, Oct. 16, 2026. https://www.pymnts.com/cybersecurity/fraud-prevention/2026/scams-capture-22-4percent-of-fraud-dollars-as-banks-adjust-defenses/
2. American Bankers Association, “ABA, America’s Banks Relaunch #BanksNeverAskThat Campaign with New ‘Scam Slayer’ Initiative, Resources on AI-Powered Scams,” ABA press release, Oct. 1, 2026. https://www.aba.com/about-us/press-room/press-releases/2026-banks-never-ask-that-launch
3. Cassidy Williams, “Banking group launches campaign to help consumers spot impersonation scams,” WFSB, Oct. 13, 2026. https://www.wfsb.com/2026/10/13/banking-group-launches-campaign-help-consumers-spot-impersonation-scams/
4. Carter Pape, “Banks see $68 billion in scam losses Washington misses,” American Banker, July 22, 2026. https://www.americanbanker.com/news/banks-see-68-billion-in-scam-losses-washington-misses
5. “Florida credit union overhauls its fraud prevention with big assist from AI,” American Banker, May 6, 2022. https://www.americanbanker.com/news/ai-revolutionized-how-this-credit-union-prevents-fraud