When the Bank Suspects a Scam and the Customer Disagrees
A teller who suspects a scam faces a customer who insists it is fine. What FINRA’s hold rule and FinCEN’s red flags show about the limits of frontline judgment.
A customer in her seventies wants a large cash withdrawal and is on the phone while she asks for it. She says it’s for home repairs. The teller has seen this before. She looks nervous, she keeps checking the phone, and she has been told, by someone, exactly what to say. The teller’s manager is at lunch. What happens next depends less on how skilled the teller is than on what the institution has given her to work with.
US securities firms have a specific rule letting them pause a disbursement when they suspect exploitation of an older or impaired customer. Bank tellers have red flags and training, and the authority to act on them varies by institution and state. The gap between suspecting and being able to act is a design problem, not a personal one.
What the frontline can see
FinCEN’s 2022 advisory on elder financial exploitation gives a precise picture of what customer-facing employees may notice, and it notes why that matters: some victims have limited contact with others, and “their only outside contact may involve visiting or communicating with their local financial institution.”
| FinCEN behavioral red flag | What a scam script does to it |
|---|---|
| Appears distressed, fearful, or anxious to follow others’ directions about their accounts | The customer has often been told that the teller may be part of the problem |
| “Taking direction from someone” on a cell phone, and “nervous, leery, or unwilling to hang up” | Keeping the line open prevents the customer from thinking alone |
| Agitated about an urgent need to send money for a purported family emergency | The emergency removes any room for a pause |
| Mentions an online friend or romantic partner asking them to receive and forward money | The relationship provides the motive and the instructions |
The second column is our reading, and the first is FinCEN’s list. Together they describe a situation in which the customer’s statements may be the least reliable source of information available. The person in front of the teller may have been rehearsed, frightened and told to lie about the purpose of the withdrawal. That person is also an adult with the legal right to their own money.
The two errors, and who bears each
| Customer really is being scammed | Customer is fine | |
|---|---|---|
| Staff intervene | Money saved; the customer may be angry at first | A competent adult is delayed and insulted; a complaint follows |
| Staff do not intervene | Money lost; the teller may carry that for years | Nothing happens, and no one notices |
Look at where the visible consequences fall. An unnecessary intervention produces a complaint with a name on it. A missed scam often produces nothing that reaches the branch at all, because the victim may never come back or report it. An employee working only from feedback will learn that speaking up is risky. Any institution serious about this has to supply feedback that runs the other way, recognizing the stops, including those where the customer was furious at the time.
What a formal hold looks like
US broker-dealers have a defined tool. FINRA Rule 2165 lets a firm temporarily hold a disbursement of funds or securities, or a securities transaction, when it reasonably believes financial exploitation of a “specified adult” has occurred, is occurring, has been attempted, or will be attempted. A specified adult is a person 65 or older, or someone 18 or older who the firm reasonably believes has an impairment preventing them from protecting their own interests.
| Stage | Length | Condition |
|---|---|---|
| Initial hold | 15 business days | Firm’s reasonable belief; internal review must begin immediately |
| First extension | Up to 10 more business days | Internal review supports the belief |
| Second extension | Up to 30 more business days | Firm has also reported to a state regulator, agency or court |
| Notification | Within 2 business days | Trusted contact and authorized parties told, unless unavailable or suspected of involvement |
Three features of this design carry over to other settings. The rule does not require a hold, so it is a permission and not a mandate. It ties action to reasonable belief, which spares an employee from having to prove the crime on the spot. And it brings in someone else, a trusted contact named in advance, which breaks the isolation a scam depends on. The last extension was added in 2022 after commenters noted that state investigations can take longer than the original limit allowed; Regulatory Notice 22-05 cites an average of 52.6 days for such investigations in a national reporting system, as supplied by a commenter.
The notice gives examples of what the rule has prevented, drawn from FINRA’s Senior Helpline, including a $60,000 romance scam and $200,000 lost to a scam claiming to involve a CIA lawsuit. These are illustrative cases. FINRA’s notice does not report how many holds are placed, how many prove justified, or what happens when a customer disagrees and the hold expires.
Does training the frontline help?
Some evidence says yes, with caveats. In a six-month pilot reported by AARP and Virginia Tech’s Center for Gerontology in 2019, over 1,800 employees at nearly 500 branches took part. Employees trained in AARP’s BankSafe program saved an average of $865 of customer money compared with $70 for those not trained, and they reported more than four times the number of suspected incidents.
Those numbers are encouraging, and they need three cautions. AARP developed the program and helped publish the evaluation. The public summaries we could open do not describe how employees were assigned to groups, or how the savings were measured, so we cannot say how much was caused by the training. And more reported incidents could mean better detection, greater willingness to report, or both. Our reading is that the pilot gives a reason to invest in frontline training and a reason to measure it better. By contrast with controlled trials of phishing training, this result comes from a much less rigorous design, so the two should not be compared directly.
What the conversation can and can’t do
An experienced frontline employee does not try to win the argument. Scripts often prepare a person for precisely that argument, by warning them that bank staff will try to stop them. A more promising approach is to change the topic from the payment to the conversation that produced it.
- Ask about the call, not the money. “Is someone on the phone asking you to do this?” is easier to answer honestly than “Is this a scam?”
- Offer a neutral reason for a pause. A rule that applies to everybody protects the customer’s dignity, a point we explore in the social cost of verification.
- Bring in a second person. A manager or a trusted contact changes the setting, and takes the employee out of a one-on-one standoff.
- Know the exit. If the customer insists and the institution has no authority to hold, staff need a written next step: document it, escalate it, file a report when warranted, and tell the customer how to reach someone if they change their mind.
That last point matters because some interventions will fail. A customer can walk out and go to another branch. Leaving the door open, without an accusation, is worth doing. People do change their minds, sometimes days later, and the memory of having been treated with respect can affect whether they come back.
Five questions for an institution
- Does a frontline employee know, in writing, that pausing a suspicious transaction will be backed by the organization, even if it turns out to be wrong?
- Is there a named person to call during every shift, including lunch?
- Are customers asked to name a trusted contact before any crisis?
- Does anyone count stops and near-misses, and tell the staff who made them?
- Is there a procedure for when the customer refuses, and does it avoid both giving in and giving up?
For a family member reading this, the same logic applies at a smaller scale. A conversation held before any crisis about naming someone to call, and about the fact that a bank asking questions is doing its job, is one of the few pieces of preparation that still works once a script begins. Our earlier look at the money-transfer counter covers what the law expects of those on the other side of the counter.
Sources
- FINRA Rule 2165 (FINRA): definitions, holds, extensions, notification.
- Regulatory Notice 22-05 (FINRA): reasons for the 2022 extension, examples of losses prevented, 52.6-day figure.
- FinCEN Advisory FIN-2022-A002 (FinCEN, June 15, 2022): behavioral red flags.
- BankSafe pilot results (AARP, October 17, 2019): pilot scale and outcomes.
Found a factual error or a source that has changed?
Send a correction →
