Banks Check More Than Your Password. Here's What Trips Them

On September 4, 2026, a Russian national pleaded not guilty in federal court in Atlanta to charges that he and co-conspirators ran spoofed bank websites, promoted through sponsored search links, to harvest customers' logins. According to the Justice Department, the indictment alleges he maintained databases holding more than 5,000 stolen login credentials and software built to capture "sensitive authentication data." Prosecutors say the group used the stolen credentials to start unauthorized wire transfers.

The case shows why a correct password and code no longer prove the person signing in is you. Banks also judge the device, the network, the phone number, the way you type and where the money goes, which is why an honest login can now trigger a hold or an extra check.

Key takeaways

US bank regulators' 2021 authentication guidance lists device fingerprinting, behavioral biometrics, login rate limits, checks on contact changes and transaction monitoring as layered controls.
No single signal decides. The same guidance calls device cookies, geolocation and IP address matching insecure and ineffective if used alone, so banks combine them.
The pattern that stands out most is a sequence: an unfamiliar device, then a changed email, phone number or address, then a large transfer to a new payee.
Travel, new phones, VPNs and caregivers sharing a login trip the same signals.
The FBI's complaint center logged about 4,700 account takeover complaints and $359.7 million in reported losses in 2025.

What it means for you

You were just locked out or asked to verify. One or more of the signals below probably fired. Verify only inside the bank's own app or by calling the number on your card. The FBI warns that criminals pose as bank staff and ask for one-time codes, and says not to trust caller ID.
You travel or switch phones often. You will mostly trip signals 1, 2 and 5: new devices, new places and a number that just moved.
You use a VPN. Your IP address can place you far from where your phone actually is (signal 2).
You are an older adult or a caregiver. FinCEN tells banks to watch for sudden contact changes and for a new caretaker or relative suddenly making transactions without proper documentation. A caregiver signing in with your password looks like a takeover and can cost you legal protection (see the FAQ).
Your account has already been taken over. Call the bank right away, ask for a recall of the transfers and file a report at ic3.gov with full transaction details. The FAQ covers how federal rules treat codes you were tricked into sharing, and wires.

This article is educational, not legal or financial advice; your account agreement and the payment type used decide your rights in a specific case.

Why a right password isn't enough

An account takeover happens when a criminal gets into a real customer's account and uses it to move money. The Federal Reserve's account takeover toolkit, published on April 22, 2026, describes three phases: harvesting credentials, gaining access (including checking balances and limits, then changing contact details to lock the owner out) and moving the money.

Because phished passwords and codes are real, banks add other checks. The Federal Financial Institutions Examination Council's 2021 guidance on authentication and access warns against relying on any single control and lists examples rather than mandates. Banks do not publish their fraud models, so the signals below are categories regulators and the Fed describe, not any one bank's settings. The Fed's 2026 risk officer survey of more than 400 institutions found a 7% increase in institutions reporting that an unauthorized party took over an account.

The seven signals banks watch

1. A device the bank has never seen

The FFIEC guidance describes building a "complex digital fingerprint" of the customer's device. The Fed's November 2025 post on risk signals says device intelligence collects hundreds of data points, such as browser type, screen size and whether the device is on a call, to separate your usual devices from unfamiliar ones. A new device is the classic trigger for a one-time code. The guidance also gives "restrictions on devices for adding payment recipients" as an example control, which is why a new phone may be able to view the account but not add a payee right away.

2. A location or network that doesn't fit

The Fed's guide to detecting takeovers suggests asking whether the IP address matches the customer's typical location. The risk-signals post adds two conflicts: a login location much farther from the phone's cell tower than expected, and a device that has "traveled an implausible distance" in a short time, often called impossible travel. It also checks whether an IP address is known for fraud. The FFIEC calls IP address and geolocation matching insecure and ineffective if used alone; a VPN, for example, can make an IP address appear to be somewhere else.

3. Bursts of login attempts

Credential stuffing means trying usernames and passwords leaked in other breaches until a pair works. The FFIEC lists rate limits on login attempts from one user or one IP address, lockouts after repeated failures and strong authentication before password resets. The Fed notes that banks can get lists of compromised credentials from vendors or industry groups and force a reset, so a surprise reset request may mean your password showed up in a breach, not that anyone got in. Do the reset by opening the app or typing the bank's address, not through a link in an email or text, since the FBI warns that criminals pose as banks.

4. Profile changes just before money moves

Criminals change the email, phone or address on an account so alerts and reset codes go to them. The FFIEC calls for enhanced checks on changes to address, email, password, contact information or enrolled devices, and the Fed tells banks to treat them as high-risk events. Its January 2026 post gives the sequence: a new device changes the home address, then tries to move half the balance to a new account soon after. FinCEN's elder exploitation advisory lists sudden, unusual contact changes on an older customer's account as a red flag.

5. A phone number that just moved

In a SIM swap, a criminal gets your carrier to move your number to a phone they hold. In a port-out, they move it to another carrier. Either way, text codes go to them. The FFIEC asks banks to handle "changes to established phone numbers or carriers," and the Fed says a bank can ask a mobile data provider whether the SIM card recently changed. AT&T, T-Mobile and Verizon announced a shared SIM swap check for businesses in February 2025. The FBI's 2025 internet crime report counted 971 SIM swap complaints with $17.4 million in losses.

6. Behavior that doesn't match you

Behavioral biometrics, according to the FFIEC, can include your swipes, taps, keystrokes and mouse use. The Fed adds that if the behavior matches you but you are on an active call while using the app, that can indicate a scam in which you are being coached, not a takeover. On December 3, 2025, Google began a US pilot on Android 11 and later, with JPMorganChase and Cash App among the partners, that shows a warning and a 30-second pause when a participating financial app opens during screen sharing on a call with an unsaved number. The limit: the Fed's January 2026 post says bots can now imitate mouse movements and typing patterns.

7. Money leaving out of pattern

The FFIEC lists limits on transaction value and daily count, allowed payment windows, and monitoring for changes in transaction velocity. The Fed's guide flags sudden large transfers, several payments to new recipients and rapid withdrawals. The FBI says takeover cases can involve 50 or more simultaneous ACH transactions to accounts at several banks. The Fed says criminals who stay within normal amounts and timing help make this stage one of the hardest for banks to detect.

False alarms and how to avoid them

Signal	Common honest trigger	What helps
1. New device	New phone or laptop, cleared cookies, private browsing	Expect a one-time check and complete it only in the bank's own app or site
2. Location or network	Travel, a VPN, hotel or airport Wi-Fi	Pause the VPN for banking, or pick a server in your home region
3. Login bursts	Retrying a forgotten password, a stale saved password	Reset through the official app and use a password unique to the bank
4. Profile changes	Moving, a new email address, a new number	Make changes from a device the bank already knows, and leave large new-payee transfers for another day
5. Number moved	Switching phones or carriers	Turn on your carrier's lock, and remember to turn it off before you switch
6. Behavior	An injured hand, a relative helping at the keyboard	Expect an extra check and complete it yourself; don't bank while sharing your screen or on a call you didn't start
7. Payment pattern	A car purchase, a contractor, a first tuition bill	Expect a hold, and confirm through the app or the number on your card

Carrier locks are free at AT&T (Wireless Account Lock) and T-Mobile (SIM Protection, postpaid accounts); T-Mobile notes its lock does not block eSIM transfers on Apple devices. Verizon offers SIM Protection and Number Lock in the My Verizon app; Number Lock must be off before you move your number elsewhere.

How signals stack: an example

Illustrative example. A customer signs in from her usual phone in San Francisco at 9:00 a.m. Her account normally sends out about $1,200 a month and holds $12,000. At 9:40 a.m., an unfamiliar laptop signs in from an IP address in New York.

Implied speed = distance ÷ time
              = 2,566 miles ÷ (40 ÷ 60) hours
              ≈ 3,850 mph

Here, distance is the great-circle distance between the two cities and time is the gap between logins. About 3,850 mph is far faster than any airliner, so this is impossible travel (signal 2) on a new device (signal 1). Within 20 minutes the laptop changes the account email (signal 4), adds a payee and sends three transfers of $3,000. That is $9,000, or 7.5 times her usual monthly outflow and 75% of her balance (signal 7). Four of the seven signals fire before 10:00 a.m., the kind of combination the Fed says gives these signals their power.

Now change the facts. If the intruder on that laptop changes no contact details and sends $250 to a new payee, about 21% of a normal month, signals 1 and 2 still fire, but the payment itself looks ordinary. Staying within normal amounts is what the Fed says makes this stage one of the hardest to detect, and if the intruder tricks her into reading out the one-time code, the extra check a new device triggers does not stop it.

The honest versions look different. If she flies to New York with her own phone, only location changes. If she stays home with a VPN set to New York, her IP and her phone's cell tower disagree. Each honest case trips a single signal, the kind of anomaly the Fed says can prompt an extra verification step.

Frequently asked questions

If I was tricked into giving a scammer my code, is the theft still unauthorized?

For electronic transfers from a personal, family or household account, which is what Regulation E covers, yes. The CFPB's electronic fund transfer FAQs say that when a consumer is fraudulently induced to share account access information and a third party uses it to make a transfer, that transfer is unauthorized. The same FAQs say a bank cannot use your negligence to raise your liability above what the rule allows. What can raise it is delay: under 12 CFR 1005.6, the amount you can be held liable for depends solely on how promptly you report.

Are wire transfers covered the same way?

Usually not. Regulation E excludes transfers through Fedwire and similar wire systems, which fall under state law based on the Uniform Commercial Code's Article 4A. Under section 4A-202, a wire the bank accepted in good faith after following a commercially reasonable security procedure you agreed to can count as your order even if you did not authorize it, which is why a phished password and code are so costly for wires. That line is being tested in court: in New York's case against Citibank, a federal judge ruled in January 2025 that the electronic step between a consumer and their own bank in an online-requested wire may fall under federal transfer protections. Citibank appealed, and the Second Circuit heard arguments on April 6, 2026; the public docket shows no decision yet. So speed matters: the FBI's 2025 report says to contact the bank immediately, request a recall and file an IC3 complaint, which can help freeze funds.

Can my bank see whether my phone number was just swapped?

It can if it works with a mobile data provider. The Fed describes banks asking such a provider about a recent SIM change after other signals look wrong, and the three largest US carriers announced a shared SIM swap check for businesses in February 2025. Banks generally don't say which checks they use, so a carrier lock is the part you control.

Is it safe to let a family member sign in with my password?

It carries legal risk. Under Regulation E, a transfer by someone you gave your access device to is not unauthorized unless you have told the bank that person's transfers are no longer authorized, and the official interpretation says you are fully liable if that person exceeds the authority you gave. Ask the bank what formal access it offers instead. For suspected exploitation of an older adult, the National Elder Fraud Hotline is 833-372-8311.

Do the FCC's SIM swap rules already protect me?

Not fully yet. The FCC adopted rules on November 15, 2023, requiring carriers to authenticate customers before moving a number and to notify them immediately of SIM change and port-out requests. A July 2024 order waived compliance until federal paperwork review ends and the FCC publishes notice of that approval in the Federal Register. No such notice had appeared as of October 5, 2026.

Before your next flagged login

Reach your bank's site by bookmark or typed address, never through a search ad. The FBI recommends bookmarks, and in the Atlanta case prosecutors say the group bought sponsored search links to send customers to fake login pages.
Check that the email, phone number and address on file are current, and make any changes from a device the bank already knows.
Turn on your carrier's SIM or account lock, and put a reminder to switch it off before your next phone or carrier change.
Turn on whatever alerts your bank offers for new-device sign-ins, profile changes and new payees.
If someone calls about fraud on your account, hang up and call the number on your card. Never read out a code or share your screen.