The customer is genuine and the payment is authorized: 55% of banks say scams dominate fraud

Fifty-five percent of institutions in ThreatMark's Fraud Readiness Benchmark 2026 said social engineering is involved in most of their fraud ^[1]. That is a statement about the detection stack as much as about criminals: when the victim uses their own credentials on their own device and approves the transfer themselves, controls built to spot stolen credentials, suspicious devices or account takeover see a legitimate customer completing a normal transaction ^[2][3].

The mechanics are mundane. Criminals pose as bank employees or other trusted people and persuade the customer to send the money ^[4]. Every technical signal a fraud engine was tuned on stays intact, because the account is being operated by the person who owns it ^[5]. So fraud teams are shifting attention to how the session is conducted rather than who appears to be conducting it, looking for indications that a customer is under pressure or following someone else's instructions before the money leaves ^[6].

That is what the report means by behavioral intelligence: baselining how a customer normally interacts with the service and flagging in-session changes such as unusual hesitation, repeated steps, or an uncharacteristically large transfer to a new payee ^[7][8]. Eighty-three percent of respondents called it effective against social engineering; 18% said it was already in use ^[9][10]. That is a 65 point gap between belief and deployment ^[11], with roughly four in five institutions not yet running the control they rate most highly ^[12]. More say they are planning deployments ^[13], which is what respondents always say.

Worth noting what those signals are. Hesitation, repetition and a large payment to a new payee also describe a customer doing something unfamiliar for the first time, so the control's value depends on false positive tolerance the report does not quantify. The published account also does not state how many institutions were surveyed or how they were selected ^[14], and the benchmark carries a vendor's name.

The forcing function is money. In authorized push payment fraud the victim is manipulated into authorizing the transfer, so the payment originates from the legitimate account holder, which complicates both detection and recovery ^[15]. In North America, 69% of respondents expect regulation requiring reimbursement for APP fraud within two years, while 31% say they are prepared for such a requirement now ^[16][17]: a 38 point readiness deficit ^[18]. Reimbursement rules move more of the loss onto banks and payment providers and generate claims, investigation, customer communication and recovery work ^[19]. Stopping the payment is cheaper than paying it back.

On the back end, 91% agreed AI can significantly shorten investigation times, with uses including linking related alerts, assembling account activity into a timeline and ranking cases by risk ^[20][21]. The operational argument is time-to-freeze: faster investigation leaves more room to hold funds or coordinate recovery ^[22]. The report also found 81% of fraud professionals surveyed now carry cybersecurity responsibilities ^[23], which matches the shared threat list of phishing, malware, credential theft and account takeover ^[24].

What to watch: whether that 18% adoption figure moves in next year's benchmark, and whether any North American regulator actually issues a reimbursement mandate on the two-year timeline 69% of respondents expect ^[16][10]. Watch also for the first published numbers on behavioral intelligence false positive rates, and for what happens to intelligence-sharing arrangements, where privacy and compliance requirements remain a constraint ^[25], once reimbursement liability gives banks a direct financial reason to name each other's mule accounts.