The FDIC asks its examiners to watch for "internal crimes" and also stay "alert to any attempts by outsiders to defraud financial institutions" (Section 9.1, October 2025 edition). Yue Cao was the internal kind: a quant analytics manager at an Ohio bank "hired to help protect customers from fraud", he took money from customers' accounts and was convicted of 10 counts of bank fraud. He got 120 months (Justice Department, 17 September 2026).
What is bank fraud?
Bank fraud, also called banking fraud, is a crime against a bank or the money it holds. In US federal law, 18 U.S.C. 1344 punishes whoever "knowingly executes, or attempts to execute, a scheme or artifice" (1) "to defraud a financial institution" or (2) to obtain property it owns or holds "by means of false or fraudulent pretenses, representations, or promises". The maximum is a $1,000,000 fine, 30 years in prison, or both. 18 U.S.C. 20 names ten kinds of financial institution, from insured depository institutions to mortgage lending businesses.
The types table of what fraud is describes banking fraud as tricks that take account access or funds, with banks and account holders as its typical victims.
Who is the victim of bank fraud, the bank or its customer?
Cao's victims, aged 90 to 103, had not enrolled in online banking; he enrolled them with email addresses he created and moved about $2 million.
Shaw v. United States (12 December 2016) explains why that is bank fraud. A bank "ordinarily becomes the owner" of deposits, or holds them in a role "akin to that of a bailee", so a scheme to take funds from a depositor's account by fraud "normally is also" a scheme against the bank, at least where the defendant knew the bank held the deposits and misled it to get them. No bank loss, or intent to cause one, is needed.
Ufuk Gürdaş, who reviewed this entry: "Name the victim before the statute: under Shaw, money taken from a customer's deposit account is normally taken from property the bank holds too, so the charge rarely tells you who owns the case, but whether the customer consented to the payment does."
Is it bank fraud when a customer is tricked into sending the money?
Not always. Loughrin v. United States (23 June 2014) held that clause 2 needs no intent to defraud a bank, but the property must come "by means of" the lie, which needs "some real connection to a federally insured bank". A lie that never reaches a bank falls outside clause 2, though if it travels by interstate wire it can be wire fraud under 18 U.S.C. 1343.
In the EU, the loss follows consent: PSD2 Article 64(1) treats a payment as authorized only if the payer consented, and Article 73 has the provider refund an unauthorized one. APP fraud covers who repays a payer who consented.
What are the types of bank fraud, and where does each one lead?
Table 1. Bank fraud types, the first signal of each, and its entry.
| Type | Who is defrauded | First signal | Entry |
|---|---|---|---|
| Account takeover | The account holder and the paying bank | A new login, device or contact detail before a first payment | Account takeover fraud |
| Authorized push payment (APP) | The customer who sends the money | A rushed first payment to a new payee | APP fraud |
| Check fraud and kiting | The bank that pays or credits the check | Washed or altered checks; checks paid against uncollected funds | Check fraud |
| Loan and mortgage fraud | The lender | Income, identity or collateral details the file cannot support | Loan fraud; mortgage fraud |
| Wire and ACH fraud | The payer and its bank | Payment instructions changed by email; wires out of uncollected funds | Wire fraud; ACH fraud |
| Card and ATM skimming | The cardholder and the issuer | Card data copied at an ATM or terminal | Skimming fraud; credit card fraud |
| Online and mobile banking fraud | The account holder | Access through internet, telephone or mobile banking, then an unauthorized transfer (UK Finance) | Cyber fraud |
| Insider fraud | The bank and its customers | Staff who lend their own money to customers | Insider fraud; employee fraud |
| Money mules | Victims upstream; the bank holding the mule account | Money that lands and leaves within hours | Money mule |
UK Finance put its members' gross fraud losses for 2025 at £1,279.8 million, authorized and unauthorized together, across nearly 4.1 million confirmed cases where a loss occurred. Each case is a card or account, not a person (Annual Fraud Report 2026, pp. 13 and 47).
How does a bank fraud scheme move the money out?
The three cases on this page break into four steps:
- Access. Account details, checks or system rights. Cao had client data; Loughrin stole checks from mailboxes.
- The false statement. The scheme has to deceive the bank or reach it: a forged check, a false enrollment, an instruction the account holder never gave.
- The transfer or loan. Cao sent funds to his own bank and credit card accounts.
- The cash out. Loughrin returned goods for cash. Cao opened accounts in his victims' names, some for brokerage, and moved their money in.
What are examples of bank fraud?
One example comes from the FDIC's manual, two from the Supreme Court:
- Reciprocal loan participations. The FDIC's loan participations list tells examiners to watch for Institution A selling a 100 percent participation in a loan to one of its insiders to Institution B, which sells A the same in a loan to one of its own insiders.
- Forged checks. Kevin Loughrin made out six stolen checks to Target, for up to $250 each, drawn on federally insured banks, then returned the goods for cash.
- Account numbers. Lawrence Shaw used the identifying numbers of Stanley Hsu's account to move funds to accounts at other institutions.
What is the penalty for bank fraud in the US, UK and EU?
The US has a bank fraud offense; the UK and EU reach the same conduct through general fraud law and payment rules.
Table 2. Bank fraud law in the US, UK and EU, with each maximum or remedy.
| Jurisdiction | Rule | What it covers | Maximum or remedy |
|---|---|---|---|
| United States | 18 U.S.C. 1344 | A scheme, executed or attempted knowingly, to defraud a financial institution or to obtain property it owns or holds by false pretenses, representations or promises | A fine up to $1,000,000, prison up to 30 years, or both; a Class B felony under 18 U.S.C. 3559(a)(2), as the maximum term is 25 years or more |
| United States | 18 U.S.C. 1349 | An attempt or conspiracy to commit an offense in chapter 63, 1344 included | The same penalties as the offense it aimed at |
| United States | 18 U.S.C. 3293 | The time limit for 1344, and for mail or wire fraud that affects a financial institution | Indictment or information within 10 years after the offense |
| England, Wales and Northern Ireland only (Fraud Act 2006, section 15) | Fraud Act 2006, sections 2 and 4 | A false representation made dishonestly by someone aware it is or might be untrue or misleading, or the dishonest abuse of a position held to safeguard another person's financial interests; either with intent to gain, to cause loss or to risk loss | Up to 10 years in prison on indictment, or a fine, or both (section 1(3)(b)) |
| Scotland | Common law fraud (Scottish Government) | Fraud under Scots common law | Not stated in the source opened |
| European Union | Directive (EU) 2019/713, Articles 3 and 6 | Intentional fraudulent use of stolen, counterfeit or falsified payment instruments other than cash (Art 3), or a transfer causing an unlawful loss for an unlawful gain by interfering with a system or data without right (Art 6) | Member states set a maximum term of at least 2 years (Art 3) and at least 3 years (Art 6) (Art 9); the UK and Ireland (recital 38) and Denmark (recital 39) were not taking part in its adoption |
| European Union | PSD2, Articles 73 and 74 (civil) | Refunds of unauthorized payments | The provider refunds immediately, by the end of the next business day at the latest, unless it has reasonable grounds to suspect fraud and tells the national authority in writing; the payer may bear up to EUR 50 for a lost, stolen or misappropriated instrument, or the whole loss if acting fraudulently or breaching Article 69 duties with intent or gross negligence |
In the US, the OCC points fraud victims to the police or a local FBI office, and to the Internet Crime Complaint Center (IC3) for internet fraud. In England, Wales and Northern Ireland, victims report to Report Fraud on 0300 123 2040; in Scotland, to Police Scotland on 101 (NCSC).
Bank fraud, wire fraud or money laundering: which charge fits?
Bank fraud turns on the victim, a bank or money it holds; wire fraud turns on the channel, an interstate wire, whoever is deceived. Money laundering is the handling of the proceeds afterward: Cao had one laundering count beside ten of bank fraud.
Which warning signs do bank examiners look for?
The FDIC's manual lists warning signs of possible fraud and insider abuse, covering only the areas where they occur most often. Six, with the data a bank can pull:
Table 3. Six FDIC warning signs (Section 9.1), the data to check and a control.
| Warning sign (FDIC list) | Data to check | Control |
|---|---|---|
| "Lack of separation between authority to initiate a wire transfer and authority to approve a wire transfer" (wire transfers) | User rights for starting and approving wires | Different people start and approve |
| "Intentional circumvention of approval authority by splitting transactions" (wire transfers) | Same day wires to one payee that add up past an approval limit | Approve on the daily total per payee |
| "Large or frequent wire transfers against uncollected funds" (wire transfers) | Wires sent from deposits not yet collected | Hold until the deposit is collected |
| "Poor control of name and address changes" (credit cards and ATM transactions) | Contact changes followed by card, PIN or limit requests | Confirm changes through contact details already on file |
| "Poor control of returned mail" (credit cards and ATM transactions) | Returned statements and cards, by account | Log each item and follow it up |
| "Insider lending personal funds to customers or borrowing from customers" (insider transactions) | Payments between staff and customer accounts | Compare staff accounts with customer flows |
How do banks stop bank fraud before the money leaves?
In the EU, PSD2 Article 97(1) requires strong customer authentication for online account access, electronic payments and remote actions that may imply fraud risk. In the US, a bank must file a suspicious activity report (SAR) on a transaction that "involves or aggregates at least $5,000" if it has knowledge, suspicion or reason for suspicion of illegal funds or another listed ground; the deadline is 30 calendar days from detection, or 60 at most while it identifies a suspect (31 CFR 1020.320).
UK banks stopped 70p of every £1 of attempted unauthorized fraud in 2025 without a loss, by UK Finance's count (p. 13).
complead, formerly Sanction Scanner, runs AML, KYC and fraud work on one AI native platform. Its fraud detection for bank transactions scores each transfer, its payer, payee and any intermediary bank before execution, and the fraud team chooses to hold, block or release it. Onboarding, screening, monitoring and investigation share that engine, so each account holder has one risk score.
Three queries for a bank's own data, Cao's route first:
- Online banking enrollments on accounts that never had one.
- Contact detail changes followed within days by a payment or card request.
- Users who can both start and approve a wire, the FDIC's first wire sign.
Related terms
- APP fraud. A payment the customer is tricked into sending.
- Account takeover fraud. A criminal controls a real customer's account.
- Check fraud. Forged, altered or stolen checks.
- Insider fraud. Staff who abuse their access to money.
- Money mule. An account holder who passes stolen funds on.
