Dispute Fraud – A Pressing Need for Automated Controls

Dispute fraud, otherwise known as chargeback fraud or friendly fraud, is a costly and vexing problem for card issuers. Such fraud can trigger losses totaling tens of millions of dollars—driving up costs for card issuers and ultimately consumers. Orchestrated fraud, emerging on social media, can overwhelm a financial institution’s ability to conduct timely investigations of disputes alleging error, causing the issuer to increase its minimum dollar threshold for investigating. If that happens, a higher volume of disputes is automatically decided in favor of consumers.¹ And if fraudsters discover the change, the result is more fraud and associated losses. Automated anti-fraud mechanisms offer a potential solution, especially with ever increasing advances in AI. Yet the regulations governing the investigation of consumer disputes and the related agency guidance are unclear and increasingly outdated.

On September 2, 2026, the federal banking agencies and the FinCEN published a Joint Statement clarifying that banks and credit unions can be transparent with their customers regarding suspected fraud, including about the need to close or suspend an account, without violating the Bank Secrecy Act as long as their communications do not reveal the existence of a suspicious activity report (“SAR”).² In light of this clarification, it would be highly beneficial for the CFPB to issue updated guidance clarifying the ability of institutions to address dispute fraud using automated mechanisms without running afoul of consumer financial protection laws and regulations.

In July 2022, the CFPB and the OCC issued related consent orders against Bank of America concerning the bank’s use of an “automated Fraud Filter” for purposes of decisioning customer disputes involving the receipt of unemployment insurance benefits into prepaid accounts during the COVID pandemic.³ According to the CFPB’s order, the bank committed unfair and abusive practices and violated the Electronic Funds Transfers Act (the “EFTA”) and Regulation E by denying such disputes “based solely on the results”⁴ of an automated Fraud Filter that employed three decision rules, the details of which were not discussed in the order. Specifically, the CFPB asserted that Bank of America “knew, or should have known that not all. . [disputes] meeting its Fraud Filter indicators would be fraudulent. . .”⁵ If any of the Fraud Filter’s three rules were triggered, the subject dispute was denied and the consumer’s prepaid card account holding their unemployment insurance benefits was frozen. In this regard, the order detailed the difficulties encountered by affected consumers in attempting to reopen their blocked account, which included spending hours on the phone over multiple days, allegedly due to Bank of America’s failure to reasonably anticipate and prepare for providing needed assistance.⁶

Based on the writer’s experience representing financial institutions, the above consent order has been misapplied by certain federal banking agencies to cast immediate doubt on the use of automation in investigating dispute fraud. Increasingly, however, it is possible to review even a high volume of information quickly and economically through AI and other automated means without comprising the accuracy that would be achieved through an intensive manual review of the same information; albeit, no means of investigating is fail safe from producing some false positives. The official commentary to Section 1005.11(c)(4) of Regulation E provides as follows regarding the minimum expected scope of a dispute investigation:

When “there is no agreement between the institution and the third party [at which the subject transaction occurred] for the type of EFT involved, the financial institution must review any relevant information in its own records for the particular account to resolve the consumer’s claim. The extent of the investigation may vary depending on the facts and circumstances. However, a financial institution may not limit its investigation solely to the payment instructions where additional information within its own records pertaining to the particular account in question could help resolve the consumer’s claim. [This commentary continues on to give specific examples of information that “might” be considered in the course of an investigation.]⁷

Section 1005.11 of Regulation E,⁸ which governs dispute handling under the EFTA, is silent regarding automation, which is unsurprising for rules that were largely written in the late 1970s and early 1980s. Furthermore, Subsection 1026.13 of Regulation Z,⁹ which implements the Truth-In-Lending Act (the “TILA”) and governs dispute handling by credit card issuers, is likewise silent regarding automation. However, Regulation II, which implements the interchange fee-related provisions of the Electronic Funds Transfers Act, encourages the use of automation in investigating potential fraud on debit and prepaid card transactions.¹⁰ Additional CFPB guidance beyond what currently exists would be helpful. Among other things, Subsection 1005.2(m)(2) of Regulation E exempts from the definition of “unauthorized electronic fund transfer” a transfer initiated with “fraudulent intent by the consumer or any person acting in concert with the consumer.”¹¹ It would be helpful if the CFPB were to explain how this exclusion applies in the context of dispute fraud and whether the regulation’s requirements for investigating disputes apply.

Whenever disputes are denied because of suspected fraud, the Bank of America consent order appropriately cautions that the financial institution must be prepared to deal with the consequences. In addition to preparing for the burden of addressing false positives, which on nationwide card program could easily number in the thousands even with a low inaccuracy rate, accounts flagged for suspected fraud are invariably closed or suspended. Therefore, the institution should consider in advance what facts consumers might present that would justify reversing such decisions. In addition, to the extent possible, customer service communications, both written and verbal, and the circumstances under which monetary restitution would be provided to harmed customers should likewise be decided in advance.

Finally, the possibility that an automated methodology for detecting dispute fraud might be abused as a means for improperly denying mass quantities of disputes should be exceedingly low where suspected dispute fraud is disclosed to the affected customer. Simply stated, it is exceedingly unlikely that any financial institution would unnecessarily risk alienating and potentially losing customers. Thus, there is no reason for the CFPB and the federal banking regulator not to embrace the use of automated anti-fraud mechanisms in the context of dispute fraud.