Bank Impersonation Is Becoming a Payment-Control Problem.

On June 15, 2026, the Federal Trade Commission published its consolidated view of consumer fraud reports for 2025. The headline figure — approximately $16 billion in reported losses — represents an increase of roughly 25 percent over the reported 2024 total. Within that total, the FTC reported that consumers lost nearly $1 billion to business impersonators, and that the highest reported losses in that category involved criminals impersonating the consumer's bank.

Two payment-method observations matter more than the headline. First, bank payments produced the highest aggregate reported losses. Second, credit cards were the payment method most frequently identified in fraud reports. Those two facts describe different problems, and conflating them leads institutions to invest in the wrong controls.

The FTC's accompanying testimony on the rising scam economy frames the shift in operational terms: fraud is increasingly delivered as a sustained social-engineering campaign rather than as a single unauthorized transaction.

Most bank and payment controls were designed to answer one question: is this really the customer? Impersonation fraud renders that question insufficient. The customer is genuinely present, genuinely authenticated, and genuinely instructing the payment. What has been compromised is not the credential — it is the decision.

This distinction has direct financial consequences. Unauthorized card fraud is largely absorbed through chargeback and liability frameworks that were built for it. Authorized push payments through bank rails generally are not. When the customer initiates the transfer, recovery depends on speed, beneficiary cooperation and, increasingly, regulatory expectation — not on a dispute right.

It also matters for how institutions read their own numbers. Consumer-reported credit-card fraud is not the same thing as confirmed issuer loss. Reports capture what consumers experienced and chose to report; they do not confirm liability, net loss after recovery, or whether the transaction was ultimately reversed. Treating report frequency as a loss ranking will overweight cards and underweight the rails where the money actually disappeared.

The useful reframing is that impersonation fraud is a payment-control problem sitting inside a customer-communication problem. Authentication confirms identity. It does not evaluate intent, coercion or manipulation. The controls that actually reduce loss in these cases operate on the payment instruction and its context rather than on the login.

In practice, that means treating a set of signals as jointly decisive rather than individually informative. A first-time beneficiary is unremarkable. A first-time beneficiary receiving an unusually large amount, shortly after an inbound call, from a session with an unusual dwell pattern, while the customer navigates directly to the transfer screen without their normal browsing behaviour, is a different event entirely.

The strongest programs we see combine four capabilities: behavioural anomaly detection at the point of instruction, beneficiary intelligence built from network and internal history, calibrated customer intervention that interrupts without insulting, and a recovery function that begins within minutes rather than after the complaint is logged.

Intervention design is where most programs underperform. A generic warning screen shown to every customer is trained away within weeks. Effective intervention is rare, specific, and describes the scenario the customer is actually in — including the fact that a genuine bank will never ask them to move money to a safe account.

Finally, measurement has to change. If an institution only measures unauthorized fraud rate, an impersonation problem is invisible in the reporting until it appears in complaint volume, regulatory attention or press coverage.