Trust Issues

Phishing for sale. Accounts for hire. Money laundering on demand. September stories show just how far fraud’s service economy has come. But all that machinery still depends on something very human: getting someone to believe you. And that someone isn’t always the customer, as Revolut learned the hard way.

1. Revolut Breach Shows Why Victim Count Isn’t the Whole Story

Revolut disclosed customer data after fraudsters successfully submitted fake information requests using a legitimate government agency email domain. The exposed information reportedly included identity documents, contact details, transaction histories, and account statements, with multiple reports putting the number of affected customers at around 680. The attackers threatened to release or sell the stolen data unless Revolut pays a $3 million ransom.

Lesson #1: The incident is a telling example of social engineering working upstream. Rather than targeting Revolut's systems directly, the attackers abused a trusted government channel and its authority to obtain sensitive information—a threat banks may be far less prepared to tackle.

Lesson #2: The incident allegedly affected only a tiny fraction (about 0.00085%) of Revolut's more than 80 million customers. But fraud and security incidents are rarely judged by the percentage of victims. An attack affecting hundreds of customers can become a trust problem for millions.

2. FinCEN Exposes the Infrastructure Behind Scam Centers

FinCEN has linked nearly $12.7 billion in financial activity to suspected digital asset investment scams run by overseas scam centers, based on an analysis of almost 34,000 reports filed between September 2023 and December 2025.

The analysis also offers a closer look at the infrastructure supporting these operations—and finds a high degree of specialization. Scam centers rely on criminal service providers available through “guarantee marketplaces.” Here, they can purchase phishing, account creation, and professional money laundering services. This is the level of fraud sophistication we’re at—essentially an online one-stop shop for criminal services.

But FinCEN’s data also shows what happens on the other side of the scam. Before money ever reaches a crypto exchange, victims may drain savings, liquidate retirement accounts, take out loans, or borrow against their homes. The final crypto transaction may be authorized, but it doesn’t necessarily come out of nowhere. The signals can start much earlier—and behavioral intelligence can help banks see them.

3. US and UK Join Forces Against Industrial-Scale Scam Operations

The US and UK have formalized cooperation against scam centers linked to crypto investment fraud and other cyber-enabled scams. The agreement will enable coordinated investigations, intelligence sharing, and joint action against criminal networks responsible for billions in annual losses.

More notable than the agreement itself is what it represents: scam centers—many of which are based in Southeast Asia and linked to Chinese organized crime networks that reportedly rely on trafficked labor—have become a strategic law enforcement priority. FBI Director Kash Patel said this month that the agency had led four joint overseas operations targeting scam compounds in Southeast Asia and the Middle East over the past 18 months.

After years of operating at industrial scale, the infrastructure enabling these scam operations is increasingly becoming a target in its own right.

4. What Happens After a Scam? Often, Not Much

Nearly half of reported scam cases across six Southeast Asian markets remain unresolved, according to a new GSMA study, highlighting a growing challenge for the region's digital economy. While 69% of scam victims in Indonesia, Malaysia, the Philippines, Singapore, Thailand, and Vietnam reported their cases, 45% said those reports were never resolved, and 82% of victims who lost money recovered none of their funds.

The numbers expose a gap that gets less attention than scam detection: what happens once a scam has already succeeded. Even when victims do report, resolution is far from guaranteed—and recovering the money is rarer still. That leaves institutions facing a second challenge after the scam itself: restoring trust once it has already been lost.

5. AI Phishing Campaign Targets Nearly Every US Military Base

Between July 2025 and July 2026, The Media Trust observed AI-enabled phishing campaigns targeting roughly 99% of all US domestic military bases—as well as personnel and their families. By July, monthly attack volume had topped 4.3 million. And forget the dodgy email: attacks appeared in ads, browser redirects, social media, mobile apps, and fake tech support experiences, with AI tailoring malicious content to each target’s device, operating system, and security setup.

The campaign is a stark reminder that modern phishing goes far beyond “ordinary” consumer scams. It has become an AI-powered social engineering tactic capable of opening a path into even the most heavily protected environments. Harden the network, and attackers will look for another way in—often through the people connected to it. If the human is reachable, few environments are truly out of reach.

6.  Ireland and France Show Just How Dominant Customer Manipulation Is Becoming

Irish payment providers recorded €179 million in fraudulent payments in 2025, up more than 27% year over year. While credit transfers remained the largest source of fraud losses, one trend stood out: fraud involving the manipulation of payers accounted for about 67% of all credit transfer fraud by value, up sharply from just over 45% in 2024.

In France, a similar story unfolded last year: manipulation fraud reached €516 million in 2025, up 34% in a single year. It now accounts for almost 42% of all payment fraud by value, with its share doubling in four years.

The shift toward social engineering is hardly new. What is striking is just how dominant it is becoming. In Ireland, two out of every three euros lost to credit transfer fraud now involve a customer being manipulated into making the payment. In France, manipulation fraud is surging even as card fraud rates have fallen to historic lows. It’s another sign that social engineering is increasingly the fraud banks must stop.

7. Japan’s Online Fraud Losses Jump 45%

Online fraud losses in Japan reached ¥175.5 billion (about $1.1 billion) in the first half of 2026, up 45% year over year, according to new National Police Agency data. The increase was driven by a surge in cases where victims were tricked into sending money through online banking.

There, too, the threat crosses borders: an estimated 45% of phishing email servers are located in China, followed by 14% in Japan and 10% in Brazil.

8. The PSD3 Challenge? Incoming Payments

In a recent interview with The Paypers, Susann Gäbler, Head of Risk Steering Fraud at Openbank Deutschland, pointed to transaction monitoring as a particularly challenging area for banks under PSD3/PSR. While banks already have experience monitoring outgoing payments, incoming payments are another story. Existing AML infrastructure, she argues, is unlikely to cope with instant-payment fraud decisions that need to happen within seconds. That will require real-time data, behavioral signals, and highly automated decision-making.

But banks shouldn’t wait for every regulatory detail to fall into place. Many of the capabilities they’ll need are apparent: real-time monitoring on both sides of the payment, behavioral data, transaction-level intelligence sharing, and mechanisms to suspend suspicious payments. And with the wider costs of online banking fraud already mounting, Gäbler sees a business case for transformation regardless of the regulatory deadline: “In many respects, the industry’s homework is already clear.”

9. FBI Investigates Potential Breach of Millions of IDs

The FBI is investigating a potential breach after access to more than 160 million North American driver’s licenses was reportedly offered for sale on a cybercrime forum. Identity verification provider IDScan.net has since disclosed that an unauthorized party may have accessed or copied customer information stored in its cloud, including driver’s licenses and other government-issued ID numbers. The exact scale and source of the reported cache remain under investigation.

If the claims are confirmed, the implications go well beyond another large data breach. The cache could give fraudsters access to authentic identity data at extraordinary scale—valuable raw material for account opening fraud, account recovery attacks, and synthetic identities. When authentic identity data becomes part of the fraudster’s toolkit, simply establishing that a document is genuine becomes a much weaker test of whether the person presenting it is.

10.  Fraudulent Funds Rarely Stop at the First Mule 

Where does stolen money go? According to a new FCA review, criminals typically cash out between the second and fifth mule account in the payment chain. With each move, the funds become harder to detect and trace, giving banks a narrow window to intervene before the trail goes cold.

Financial firms are getting more aggressive at the front end, closing 238,396 suspected mule accounts in 2025, up 29% from 2023. But the FCA also found some mule accounts being used repeatedly before they were shut down, with the same accounts also used for fraud—pointing to established criminal infrastructure rather than one-off activity.

Banking Threat Bulletin highlights the stories shaping global fraud prevention and customer protection. Stay informed. Strengthen trust. Protect your customers.