A customer who is being scammed rarely looks like a victim of crime. They arrive at the branch or open the app themselves, use their own device and credentials, and approve the payment with the correct codes. Nothing in the transaction looks wrong, so the first person to sense a problem is often a colleague who notices that the story does not fit the person in front of them.
That makes frontline staff, contact centre agents and payment operators part of the response, not only the fraud team. It is also a financial crime issue, because the money a victim sends is the proceeds of crime and usually moves quickly into accounts held by people acting for the scammer. This article covers which signs are worth noticing, how to respond without accusing anyone, and where the money laundering link comes in.
Why scam payments look normal to the system
In unauthorised fraud, someone else uses a customer’s card or login without their knowledge. In a scam, the customer makes the payment themselves, but only because they have been deceived, pressured or frightened into it. This is often called authorised push payment (APP) fraud.
Because the right device, password and one-time code are used, automated controls often have little to flag. What differs is the reason behind the payment. That is why a sensible question at the right moment can be effective, and why systems and people need to work together.
Four stories scammers tell
Impersonation and “safe account” scams. The customer is contacted by someone claiming to be the bank’s fraud team, the police or a tax authority. They are told their money is at risk, or that they face legal action, and are instructed to move funds to a “safe” or “holding” account that the criminals control. A related version changes the bank details on a genuine invoice.
Investment scams. A professional-looking website, app or messaging group promises guaranteed or unusually high returns. Victims are shown fake profits and encouraged to pay in more, then find they cannot withdraw without paying further “fees”. Crypto-assets are often involved, though not always.
Romance scams. Contact starts on a dating site or social media and soon moves to a private channel. The other person can never meet, always for a reason, and over time asks for money for medical costs, travel or a family emergency. The customer may defend the relationship strongly when asked about it.
Tech support and remote access scams. A pop-up or unexpected call claims there is a virus or security problem. The customer is asked to install remote access software, log in to online banking or read out security codes, and may be talked through moving money as a “test”.
Tactics and signs worth noticing
Across all four, scammers pull the same levers: urgency, authority, secrecy and emotion such as fear, love, greed or guilt. Their instructions are designed to make normal safeguards feel like obstacles.
Any of the following can be a reason to look more closely. None is proof of a scam, and many genuine customers are anxious, in a hurry or paying someone new for good reasons. The value lies in a combination of signs that does not fit what you know of the customer.
- The customer says the payment must be made today or something bad will happen.
- They stay on the phone, read from notes or repeat instructions from someone else.
- The story involves a “safe”, “holding” or “protected” account.
- A large or unusual transfer goes to a new payee that does not fit their usual pattern.
- They describe a partner or adviser they have only met online who keeps asking for money.
- They mention guaranteed returns, or fees that must be paid before money can be withdrawn.
- They say they were told not to discuss the payment with staff or family.
How to respond without accusing anyone
The aim is to give the customer a chance to pause, not to prove anything. Ask open and neutral questions: who they are paying, how they came to know them, and whether anyone has asked them to keep the payment private. Listen for explanations that are vague, change as you ask, or sound as if they belong to someone else.
If concerns remain, describe the scam pattern in plain, factual terms. Be patient and respectful, allow extra time where a customer seems confused or isolated, and do not promise outcomes you cannot guarantee, such as a refund.
Then follow your institution’s procedure. That may include pausing the payment, involving a supervisor, and referring the case to the fraud team and, where the indicators warrant it, to the MLRO or equivalent compliance contact. Do not contact the payee or the person the customer says they are dealing with, and do not try to investigate on your own. Record what you saw, what the customer said and what you did while it is fresh.
A scam warning is not the same as disclosing a report. Depending on the law that applies to you, telling a customer that a suspicious activity report has been made or is being considered may be prohibited, which is known as tipping off. Keep the conversation to the payment and the scam risk, and leave reporting decisions to compliance.
Scenario
Mr Tavares comes into a branch to send a large part of his savings to a payee he has never used before. He stays on his phone throughout, reads the account details from a handwritten note and says the bank’s fraud team told him his money is at risk. Priya, the cashier, calmly asks who he is paying and whether anyone has asked him to keep the transfer private. He says he was told not to explain and becomes tense when she hesitates. Priya does not argue. She tells him a supervisor needs to review the payment, notes his words as he says them, and the supervisor refers the case to the fraud team under the branch procedure.
What matters here: Priya noticed a combination of signs rather than a single one, and asked open questions without accusing him. She left the decision to the people trained to make it and wrote down what she saw while it was fresh. She did not promise a refund or call the number he had been given.
Where the money goes and why it matters for AML
Scam payments rarely stay where they land. They often go to accounts that receive money and pass it on quickly, commonly called mule accounts. A money mule is someone who allows their account to be used to receive and move funds for others, sometimes knowingly and sometimes not.
Many mules are recruited rather than starting out as criminals. Adverts for easy work from home, fake jobs described as payment processing, and approaches through friends or social media are all used, and some mules are themselves scam victims asked to “help” a partner. Anyone can be recruited, so a customer’s background should never be treated as an indicator.
On the receiving side, signs include several payments arriving from unrelated people, funds leaving soon after, vague or repeated references, and activity that does not match what you know of the customer. These too are reasons to look closer, not proof.
When several victims have paid the same account, the pattern may point to a network. Whether that amounts to suspicion that must be reported is for the MLRO or equivalent compliance contact to decide, using the facts that frontline staff and fraud teams recorded. Clear notes make that decision easier.
Key points
- In a scam the customer authorises the payment, so the warning signs lie in the story and behaviour, not the transaction.
- Urgency, authority, secrecy and emotional pressure run through impersonation, investment, romance and tech support scams.
- A sign is a reason to look more closely, not proof; look for a combination that does not fit the customer.
- Ask neutral questions, follow your procedure, record what was said, and do not investigate or contact the payee yourself.
- Scam proceeds often pass through mule accounts, so concerns may need to reach the MLRO or equivalent, and tipping off rules may bar disclosing a report.
To build the foundations behind these ideas, take the free course AML Foundations & Core Concepts. The Resources page links to official sources and includes quick references, such as the Red Flags Frontline Checklist and an Internal Escalation Note template, free with a learner account.