Earthmover Credit Union

Nyla Cortes, CBSAP, CUERME, Director of Risk Management and Compliance

Protecting Community Institutions through Smarter Fraud Prevention

Nyla Cortes

Fraud Prevention Steward

Building Fraud Defenses around Member Relationships

The best control a community institution has is not a control anyone can buy. It is knowing the member. A megabank is scoring a stranger with a model. We are looking at someone whose accounts, habits, and history we can see in full. That is a real edge, and most of us waste it by trying to defend fraud the way a large bank does, with layers of technology chasing a problem our size does not have.

So the highest-impact move is cheap: put the people who touch members closest to the decision. Give the teller or member service representative who notices something the authority to pause a transaction and ask a second question, without routing it through three approvals first. Losses tend to happen in the gap between someone sensing that a transaction feels wrong and someone empowered to stop it actually looking at it. Close that gap, and you prevent more fraud than most platforms will.

The second move is to stop spreading resources evenly. Pull your last year of actual losses and rank them. For most community institutions, the money leaves through a short list of channels, usually debit fraud, account takeover and wire and A2A schemes. Fund your defense in that order. It is unglamorous, and it works better than building sophisticated controls against the fraud that makes headlines but rarely hits your book.

Reading the Signals behind the Transaction

The signal is almost never a single transaction. It is a break in a pattern you already had in front of you. A member who never travels to transact overseas. A quiet account suddenly moving money to a brand-new external destination in a hurry. A business whose deposit volume shifts without a reason you can name. Large institutions have to learn a baseline. We already have one, which is exactly why missing these breaks is harder to forgive.

“When a member cannot plainly explain why the money needs to move right now, that is the moment to slow down and verify through a channel you control, not the one the request came through.”

The other signal is behavioral, and it shows up in how a request is made, not just what is requested. Urgency, secrecy, and a story that keeps changing are the constants across wire fraud, elder exploitation, and social engineering. When a member cannot plainly explain why the money needs to move right now, that is the moment to slow down and verify through a channel you control, not the one the request came through.

Always look inward. Insider activity is less common than external fraud but usually costs more per incident, because the person already has access and knows where the monitoring is thin. Dual approval on sensitive functions and periodic review of who touched what is not bureaucracy. They are the controls that catch the loss you least expect.

Human Judgment before Machine Learning

The industry talks about behavioral analytics as if it requires a machine-learning budget. It does not. Behavioral monitoring is velocity, geography and deviation from a member's own normal. How much, how fast, from where, and how far outside their pattern. Those are rules you can define and check, and at community-institution volume, well-tuned rules with a human reviewing the exceptions will catch most of what matters.

This is where our scale is an advantage again. A large bank cannot have a person look at edge cases; it has too many. We can. The right sequence is to get consistent, clean data and a tight set of rules working first, then automate the review to save your team's time, and only then consider AI if your volume genuinely justifies it. Buying the model before you have disciplined the process just automates noise.

The Culture behind Effective Fraud Prevention

Culture is the part of fraud prevention you cannot outsource, and it is where good intentions quietly fail. Every institution says fraud is everyone's job. Far fewer make it safe to be the person who raised a concern that turned out to be nothing. If staff get a subtle message that flagging a good member was an overreaction, they stop flagging. Your best early-warning system goes silent, and you never see the losses it would have caught.

Build the escalation path to reward the attempt, not just the correct call. Thank the employee who raised it either way. Share anonymized examples of losses that were stopped, so the work feels real instead of theoretical. And be honest, that culture is set by what leadership does under pressure. If a deal or a deadline can override a fraud concern at the top, everyone below learns the concern was never the priority.

The Future of Community Fraud Prevention

First, treat member education as a control, not a courtesy. A meaningful share of losses arrives through the member's own credentials, given up to a convincing story. The institutions that pair simple, repeated education with easy-touse authentication will keep the fraud out of the front door instead of chasing it after.

Second, take vendor and third-party risk as seriously as your own. More of the member relationship now runs through providers you do not control. Their weakness becomes your exposure, and a single vendor compromise can reach your entire membership at once. Knowing what your vendors can access, and what happens when one fails, is fast becoming core to fraud prevention rather than a separate compliance chore.

Underneath all of it, protect the one thing that does not scale: the judgment of people who know your members. The institutions that stay resilient will be the ones that use technology to extend that judgment, not replace it. That is the advantage community institutions have always had. The next few years will belong to the ones who finally stop giving it away.