Banks Deploy AI to Chase Stolen Funds After Payments Clear

Real-time payments move money faster, and they remove the window to recover it. Transactions sent over instant rails are irreversible. Once funds leave an account, they cannot be recalled, leaving institutions with no way to claw the money back. The problem is compounding. PYMNTS Intelligence found that 40% of financial institutions lost more money to fraud last year, while 38% experienced higher fraud volumes.

The pattern driving those numbers has shifted. Scams now account for 23% of fraudulent transactions reported by financial institutions, following a 56% year over year rise, PYMNTS Intelligence found. The share of dollars lost to scams increased by 121%. In authorized push payment (APP) fraud, the victim authorizes the payment, the credentials are valid and the transaction clears. By the time the fraud is identified, the money is moving through a chain of accounts. APP fraud losses in the U.K. rose 19% to 576.4 million pounds (about $774 million) across cases last year, with 66% of cases beginning on online platforms, according to a June 15 report by PYMNTS.

Fraud AI has historically asked one question: should this transaction be approved? The next layer asks something different. Given that a transaction cleared, what does it connect to and where did the money go?

Nasdaq Verafin announced the expansion of its Agentic AI Workforce with two new role-based agents, an Agentic Fraud Analyst and an Agentic AML Analyst, designed to automate the investigative work that fraud and compliance teams currently perform manually. The Agentic Fraud Analyst will initially triage unusual ACH activity. The Agentic AML Analyst will focus on cash structuring alerts, cases where criminals deliberately break up large sums into smaller deposits to avoid triggering regulatory reporting thresholds, before expanding to flow-of-funds analysis and unusual international transactions. Both reach general availability in the third quarter of 2026.

Nasdaq Verafin reported that more than 650 financial institutions have already adopted the platform, which runs on a consortium data network spanning more than 2,800 institutions. That scale lets the system identify counterparty fraud risk across institutions, not just within a single bank. The company said its existing agents have already cut workloads: the Agentic Sanctions Analyst reduced alert review by up to 90%, and the Agentic EDD Analyst cut enhanced due diligence review time by up to 50%.

In India, the Reserve Bank Innovation Hub, an arm of the Reserve Bank of India, launched MuleHunter.AI, an AI system now operational across 26 banks that detects about 20,000 mule accounts per month. Mule accounts are intermediary accounts criminals use to route stolen funds through multiple banks before withdrawing them. Data from the Indian Cyber Crime Coordination Centre reported by The420 illustrates the scale of the challenge. As of Dec. 31, the agency had identified 2.65 million first-layer mule accounts that cybercriminals used to move stolen funds. Authorities estimated the networks facilitated the theft of nearly 200 billion rupees (about $2.4 billion), of which about 81.9 billion rupees (roughly $980 million) has been recovered and returned to victims.

JPMorgan Chase and ACI Worldwide announced a partnership to embed JPMorgan's Kinexys Liink account verification directly into ACI Worldwide's enterprise fraud platform, applying consistent controls across payment rails before funds leave the account. PYMNTS reported that faster payment rails have made post-settlement recovery impractical. The assumption that finance teams would have time to fix mistakes after money moved has broken down.

Blocking fraud before it clears remains the first line of defense. What banks are now building runs alongside it: AI that reconstructs transaction patterns, connects related activity across institutions, and traces stolen funds before criminals can withdraw them.