A bank-fraud readiness checklist for startup payments

The first sign that a startup's payment controls are weak is often a lender asking for a bank statement you cannot explain. The second is a customer asking why a refund took longer than the invoice did. IC3's 2025 annual report, cited by the FBI, counted over 1 million complaints and more than $20.877 billion in reported losses, up 26% year over year.

Bank fraud is an operational risk. Run the review before the event, not after the subpoena.

Loans can be the fraud, not just the victim

In Kolkata, the Enforcement Directorate began an early-Thursday sweep of 11 premises tied to suspects in a Rs 290 crore alleged bank-fraud case against Kohinoor Power Pvt Ltd. The sweep included the premises of group promoters Prashant Bothra and Vijay Bothra, as well as other directors and auditors. The agency framed the action as a money-laundering probe under the Prevention of Money Laundering Act, aimed at tracing the money trail. Kohinoor had taken bank loans to build a 66 MW plant in Jharkhand, yet the probe said the funds were redirected to group companies and personal spending. After the company went to the National Company Law Tribunal, liquidation produced only Rs 7 crore, leaving creditors with substantial losses.

The startup lesson: approval, use, and reporting need separate owners.

Payment controls decide who can move money

Augustus, the payments company behind Ivy, chose in July 2025 to seek a US national bank charter because a bank under its API could own customer accounts, run its own ledger, link to payment systems, and cut reliance on sponsor banks. Ferdinand Dabitz, the 25-year-old founder, had no disclosed track record in deposits, liquidity, credit risk, or steering a regulated balance sheet through stress, so Augustus split strategy from operations and hired executives with regulatory and banking experience.

Ivy developed payment tools that handle routing, risk controls, rapid payouts, and payment links to manage bank payment completion and risk. Its account-to-account bank payment flow could lower card fees and chargeback exposure, but it also removed consumer features: credit access, the dispute process customers recognize, and the credentials that work everywhere.

The trade-off is visible: more control can mean more responsibility, and fewer consumer features can mean more trust work.

Scam volume makes the checklist a standing review

Augustus's proposed US national bank would have to give compliance, risk, and treasury officers real stop power: the resources, reporting lines, and authority to delay or stop activity. The FBI's July 20, 2026 public service announcement named AI-made videos, fake websites, and direct contact through email, phone, or social media. For a startup, that makes fraud a customer-trust question as much as a vendor question.

Run this checklist before a lender asks

Each item is a quick test, not a project. If you cannot do it, you have found the gap.

• Name the person who can stop a payout, and confirm that person can do it without asking the founder.
• Write a rule that no single person can approve a new payee and release funds.
• Pull recent bank activity into a single view, including failed payments.
• List every bank account, card, API key, and payout route, with an owner for each.
• Show the customer-facing page that explains which payment features are missing.
• Define a lender-reporting rule that says who confirms revenue, drawdowns, and exceptions.
• Find the last written approval for a high-risk payment, including the reason and the approver.
• Hold a short incident script for a suspected fraud, including who calls the bank and who tells customers.
• Save the last sandbox test that blocked a fake payout request.
• Keep a dated review of payment controls, bank relationships, and customer disclosures, with a named owner.

The list is short because the failure modes are short: moving money, approving it, explaining it, and stopping it.

Keep the checklist in the same place as the bank login.