Cybersecurity Report Roundup: ‘Friendly Fraud,’ Verify IDs in the Age of AI, the Fraud Price Tag for FIs
By Roy Urrico
Finopotamus aims to highlight white papers, surveys, blogs and reports that provide a glimpse as to what is taking place and/or impacting credit unions and other organizations in the financial services industry.
In this cybersecurity roundup we focus on “friendly fraud,” managing identity verification, and the cost of fraud to financial institutions. Monica Eaton, CEO of Chargebacks911 provides commentary on all three reports.
'Friendly Fraud' Possibly Bigger Than Merchants Believe
Every merchant that accepts credit or debit cards also accepts the risk of chargebacks, according to Tampa, Fla.-based Chargebacks911’s 2026 Chargeback Field Report. The study revealed the chargeback system, created to protect consumers against fraud and merchant error, is still effective in that role. For merchants, however, chargeback abuse has become a serious threat to revenue and business stability.
“Friendly fraud,” illegitimate disputes initiated (either accidentally or intentionally by consumers or their financial institutions, represents a growing threat for merchants. Yet most have limited visibility beyond their own chargeback activity.
“Chargeback rights are meant to protect consumers and strengthen trust in the payments system, especially online. Unfortunately, protecting buyers often leaves merchants to absorb the cost of fraud and misuse, even when they aren't responsible,” said Eaton.
Misdiagnosing the source of chargebacks could direct antifraud investment toward the wrong problems ahead of peak trading season, indicated the report.
Key Takeaways:
Merchants estimate friendly fraud accounts for 43.8% of their chargebacks on average.
Visa data cited in the Chargeback Field Report suggests the figure could be as high as 75%; Chargebacks911's own internal data puts it at 86%.
More than 83% of enterprise merchants reported an increase in friendly fraud in 2026.
Nearly one-quarter of merchants report internal (employee-initiated) fraud.
Nearly two-thirds of merchants currently or plan to incorporate AI into their fraud prevention strategies.
Chargebacks911 did note the scale of the gap points to a fundamental problem for merchants: Identifying whether a chargeback stems from criminal fraud, legitimate customer dissatisfaction or first-party misuse remains extremely difficult.
“Chargeback rights are meant to protect consumers and strengthen trust in the payments system, especially online. Unfortunately, protecting buyers often leaves merchants to absorb the cost of fraud and misuse, even when they aren't responsible,” said Eaton.
Closing the gap requires merchants to look beyond individual fraud decisions and build a clearer view of what is driving disputes over time, advised Chargebacks911. “More fraud technology will not solve a visibility problem on its own," Eaton added. "Before deciding where the next dollar of fraud investment should go, merchants need confidence that they understand the problem they are actually paying to solve.”
Verifying Identity in the Age of AI Agents
PYMNTS Intelligence’s How Enterprises Can Build a ‘Know Your Agent’ Defense: Digital Identity Verification in the Age of Bots, produced in collaboration with Trulioo, surveyed 350 leaders in compliance, risk management, fraud, underwriting, supplier acquisition and merchant monitoring at global companies.
“Companies that keep digital identity verification in-house face a noticeable exposure to adversarial bots and agents: 53% report know-your-agent (KYA) related incidents or losses, compared with 28.8% of firms using a mix of internal and external teams and 24.1% of those relying on external providers,” revealed the report. The difference, it said, shows that the way identity verification is operated can affect both security outcomes and the business costs that follow.
"There is no risk-free way to verify who, or what, is on the other end of a transaction. Businesses are simply choosing where the risk lands,” commented Eaton. "Companies that keep verification in-house report the most incidents and losses involving bots and AI agents. Those that outsource report fewer, but struggle with inconsistent results. Hybrid setups still report the highest exposure to account takeover.”
Verification, fraud prevention and dispute management are separate jobs, but a weakness in one can show up in another, noted Eaton. “AI can help companies spot anomalies faster, but only if they also measure what happens after the transaction. Merchants rarely have that visibility on their own. Without it, they cannot tell whether tighter checks are stopping fraud, turning away good customers or just moving the losses elsewhere.
How Fraud Costs FIs
“Scammers now work on two clocks. Some rush victims from first contact to payment in less than an hour, while others spend weeks building trust before asking for money,” observed Fraud’s Loyalty Tax: How Scams Cost Banks Their Customers, the first installment of the PYMNTS Intelligence Fraud Economy series. The report is based on a survey of 9,524 U.S. consumers fielded in July 2026, 1,913 of whom said their most costly scam in the past five years happened to them personally.
The study revealed how certain tactics drive losses, discourage reporting and put financial institution loyalty at risk. “In July 2026, 21% of U.S. consumers—about 57 million people—said they’d been victims of a scam in the past five years.”
The research reported the tactics are changing: First contact by text message rose 35% since September 2025, while email-based contact fell 30%. And while the typical victim lost relatively little, the financial stakes can be extreme: 1.1% of victims, “which is still hundreds of thousands of people) lost $250,000 or more,” revealed this PYMNTS Intelligence report. “The fallout extends beyond money. Romance scams are climbing faster than any other type as a source of victims’ heaviest losses. Victims often become more suspicious of others, with some even reconsidering their relationships with their financial institutions. Losses usually happen fast, and banks’ response is critical to what happens next.”
“This research shows that once a scam has succeeded, recovery most often happens through the bank. Victims who reported to their financial institution were roughly twice as likely to get all their money back as those who went to the police or a federal portal. And 79% of victims who recovered anything got it back through their bank,” said Eaton.
“That means what happens after the transaction can matter just as much as what happens before it. Fraud prevention and dispute resolution are separate but connected functions,” continued Eaton. “Where a dispute process applies, it should not simply be treated as an extension of the fraud system. It can act as an independent check on decisions made upstream, but only if it is handled accurately. This means getting genuine victims their money back, while making sure legitimate transactions are not reversed along the way.”
