The banks built instant-payment systems for speed, let fraudsters drive the money away, and leave the panicked customer holding the bill.
The FBI’s Internet Crime Complaint Center logged more than 22,000 AI-linked complaints in 2025, with roughly $893 million in reported losses. Investment fraud took $632 million. Americans over 60 lost $352 million. Those are not a sideshow. They are the indictment: an industry automated the con faster than it automated the defense, then asked the victim to install her own lock.
A cloned voice needs seconds of audio. A deepfake meeting moved about $25 million from the architecture firm Arup. Resilience reported that more than 85% of losses in its claims portfolio during the first half of 2026 came from attacks aimed at people rather than systems. The machine is learning where the human hand is weakest. The bank still calls the payment authorized.
That is the arrangement. The law binds the panicked grandparent, the small customer who wires money under deception, and the account holder who hands over a code while a fraudster wears the voice of a grandson or the face of a chief financial officer. It protects the bank whose authentication stack let the payment through and whose platform was built to move money in minutes, not recover it.
The bank says the customer approved the transfer. The customer says a thief made the choice for her. The difference is a legal word and a lost account.
Banks have the security teams, transaction data, networkwide analytics, and power to see patterns across millions of payments. A household has a phone, a frightened voice on the other end, and whatever presence of mind survives the panic. When the institution with the machinery assigns the risk to the person without it, “authorized” becomes a polite word for abandoned.
The roster is familiar. HSBC admitted laundering money for Mexican drug cartels and sanctioned regimes, paid $1.9 billion, and no individual was prosecuted. Wells Fargo opened millions of unauthorized accounts under sales quotas, paid $3 billion through a deferred-prosecution agreement, and the agreement was made with the bank rather than the people responsible. AIG paid $165 million in bonuses to the unit that helped bring the company to its knees after roughly $182 billion in federal support. The fine arrives. The individual walks. The customer pays.
The Consumer Financial Protection Bureau sued Zelle’s operator and three major banks in late 2024 over their response to alleged fraud, then withdrew the case in March 2025. That withdrawal is the exception that proves the class rule: when the public agency steps back, the bank’s protection remains in place and the victim’s loss remains hers. New York’s attorney general filed her own suit, which a judge allowed to proceed in July. Zelle’s operator denies the allegations and says it will appeal.
The United Kingdom took the less fanciful route. Since late 2024, banks there have had to reimburse most scam victims up to £85,000, with the cost split between the sending and receiving institutions. The regulator reports that 88% of money lost to eligible scams has been returned. The point is not charity. It is leverage. Make the institution absorb the loss and the institution has a reason to stop treating fraud as somebody else’s household problem.
Call it what it is. A bank that keeps the speed, the fees, and the customer data while exporting the fraud loss has not built convenience. It has built a trap.
The account holder gets the bill. The bank gets the exit.