The permission without the evidence

Summary

A permission arrived. The evidence did not.

On 12 June 2026, FinCEN issued an updated section 314(b) fact sheet. It makes information sharing about suspected fraud easier than many institutions believed it to be, and it removes objections that compliance teams have used for years to decline.

The guidance grants a permission. It does not supply the evidence that permission operates on.

Section 314(b) lets institutions exchange what they hold. In an authorized push payment scam, what an institution holds is a payment that looks legitimate, because the customer authorized it. The part worth sharing, the approach itself, never enters the institution's systems. It arrives on the customer's phone.

DAY 0
THEN
HOURS OR WEEKS
BEFORE THE PAYMENT
PAYMENT DAY
The first message
A reply
Trust, then pressure
Coaching
The payment
WHAT THE CUSTOMER HAS
A text or call
A friendly reply
Mounting urgency
Told what to say
A transfer they believe in
WHAT THE INSTITUTION SEES
Nothing
Nothing
Nothing
Nothing
An authorized payment
The gap: everything that happens before the payment

• 1 What the guidance says
  Fraud is in scope, and sharing can be live.
• 2 The gap it leaves
  The best evidence exists before the payment.
• 3 The layer that is missing
  Consumer-sourced, pre-transaction, timely.

Section one

What the June 2026 guidance actually says

Four provisions matter. Each is quoted from the fact sheet.¹

1 Fraud is in scope, without qualification

“Fraud offenses are SUAs for money laundering offenses.”

Specified unlawful activity is the predicate that brings conduct inside 314(b). Naming fraud offenses explicitly closes an argument that has been used to keep fraud teams out of the mechanism.

2 You do not have to prove laundering first

The institution “need not have identified specific proceeds of fraud being laundered to trigger the protections.”

This removes the circularity. The practical reading had been that you must finish the investigation before you may ask for the information that would let you do it.

3 The information need not concern your own customer

Institutions may share “even if the entity sharing the information has no reason to believe the information relates to any specific customer, account, or transaction of the financial institution receiving the information.”

The least appreciated provision and the most consequential. It permits sharing a pattern or a typology with no identified counterparty at the receiving end.

4 It can happen live

Institutions “may share information in writing or verbally, as well as through electronic platforms” and “may share information in real time as activity is occurring.”

Real time is named. Not same day, not next business day.

What has not changed. The safe harbor still requires registration through FinCEN's FI Portal, confirmation that the receiving institution is also registered, procedures that protect the confidentiality of what is shared, and use of the information only for AML/CFT purposes.

One prohibition is unchanged and absolute. “Section 314(b) does not authorize financial institutions to share SARs or reveal their existence.”

¹ FinCEN, Section 314(b) Fact Sheet, issued 12 June 2026.

Section two

Why this matters now

Three months after the 314(b) guidance, FinCEN put a number on what persuasion-led fraud is doing to institutions and their customers.²

$12.7B
in financial activity tied to suspected digital asset investment scams
33,904
BSA reports filed between 8 September 2023 and 31 December 2025
3 Sep
2026: the date FinCEN published the analysis

FinCEN states the method plainly: “Criminals use fake personas and social engineering tactics to manipulate victims.”

Read the number carefully

The $12.7 billion covers one category of scam. It is not a total fraud figure and should not be cited as one. It is already being quoted as though it were.

Every dollar in that figure moved because a person was persuaded to move it.

The mechanism of loss is manipulation, not system compromise. This is the category that transaction monitoring is structurally worst at, because the transaction itself is genuine: the right customer, on the right device, with the right credentials, sending money they believe they should send.

Authorization cannot be the control that catches it, because authorization is exactly what the scammer has obtained.

² FinCEN, FinCEN Identifies Nearly $13 Billion Linked to Suspected Digital Asset Scams Operated by Overseas Scam Centers, 3 September 2026.

Section three

The problem the permission does not solve

Consider an authorized push payment scam from the institution's point of view.

A customer receives a message. Then a call. Over hours, days or weeks they are moved from curiosity to trust to urgency. At some point they are persuaded to send money. They authorize the payment themselves, from their own device, to a destination they believe is legitimate.

The institution's first sight of any of this is the payment instruction. By construction it is authorized, in pattern, and from a known device. Everything that would have made it recognizable (the grooming, the impersonation, the script, the escalation) happened in a channel the institution cannot see and has no right to see.

THE CUSTOMER'S PHONE
The first text
The calls
The coaching
the evidence
no access
Institution A
the customer's bank
SECTION 314(b): A WIDE-OPEN, REAL-TIME CHANNEL
1 authorized payment
empty space
Institution B
registered, ready
The channel is open. It can only carry what Institution A holds, and A does not hold the evidence.

Section 314(b) governs the exchange of held information. In manipulation-led fraud, the institution holds almost nothing until it is too late for the information to be worth exchanging.

The permission is real and welcome. On its own, it is a pipe with very little going through it.

Section four

Where the evidence actually lives

The evidence exists. It sits on the customer's phone, and it exists before the money moves.

DAY 1
Hi Alex, sorry, wrong number? I meant to text Mia about Saturday.
Wrong number, no worries!
Funny, your area code is where I grew up. Are you in Denver?
DAY 12
The new tier closes tonight. Send $8,000 and I'll walk you through it.
If your bank calls, say it's a family matter. They don't understand investing.
Okay, doing it now.
Payment sent: $8,000
Illustrative example
DAYS 3 TO 11 OMITTED
Eight days of daily messages build rapport, trust and a first small “win”.
WHAT THE CUSTOMER HOLDS
The text they were sent
The number that called
The link they did not quite trust
The screenshot they took because something felt wrong
The instruction to hide it from the bank
WHAT THE INSTITUTION HOLDS
Nothing, until the payment instruction
THE WINDOW
Scams unfold over hours, days or weeks. The institution is absent from all of it.

When a person is uncertain, the most common thing they do is capture what is in front of them and look for somewhere to send it. The text. The screenshot. The number. The link.

Closing the gap is not a monitoring problem or a model problem. It is a sourcing problem.

The signal has to be collected where it lands, which is with the customer, and it has to reach the institution while the window is still open.

Section five

What this implies for the category

The June guidance quietly creates demand for a layer that does not yet have a settled name. Call it pre-transaction, consumer-sourced fraud intelligence.

TIME
THE LAYER IN QUESTION
Pre-transaction, consumer-sourced signal
Collected from the person being targeted, while they are still deciding.
EXISTING
Scam detection at the payment rail
Acts at the moment of payment. The transaction is already authorized.
EXISTING
Transaction monitoring
Structurally weakest here, because the transaction is genuine.
EXISTING
Case management and investigations
Engaged after the loss, when the money has gone.

Four properties that set it apart

Sourced from the consumer

That inverts the normal vendor data relationship, and creates consent obligations that an institution-sourced product never faces.

Pre-transaction

Its value is highest before anything reaches a payment rail, which is where most of the existing stack starts paying attention.

Only useful if timely

A monthly feed of scam typologies is a different, lower-value product. The guidance contemplates real time, and real time is where this layer works or does not.

Adjacent to 314(b)

Institutions will use 314(b) to share among themselves. This layer supplies what none of them currently hold to that conversation.

Where Flggd sits

Flggd is a scam intelligence company, and this is the layer we build: pre-transaction, consumer-sourced fraud intelligence.

Section six

What it looks like in practice

Flggd builds protection for the person being targeted, and gives the institution that serves them a view it has never had.

SafeLine is Flggd's institutional product: an institutionally sponsored text-message service. A member who receives something suspicious forwards it, receives an assessment, and keeps their money. The sponsoring institution sees that one of its members is being targeted.

THE MEMBER'S SIDE
THE INSTITUTION'S SIDE
1
Something feels off
A text, a link or a number the member does not quite trust.
2
They forward it
By text message to the institution's SafeLine number.
3
They get an answer
An assessment of the message, while they are still deciding.
4
The institution sees
That its member is being targeted, before any payment instruction.
Because it works over text message, SafeLine does not require integration with the institution's core systems.

Try it yourself. A self-serve SafeLine demonstration shows the member experience and what the institution sees: demo.flggd.com/safeline

What this changes for the institution

For the first time, the institution has a dated signal that a member is being approached, at the stage where intervention is still possible: a conversation, a warning, a call. That is evidence the institution did not have to infer, and it is the input section 314(b) sharing has been missing.

A note on evidence

This paper cites no detection or loss-avoided figures for any provider, ours included. Be cautious of any vendor that offers them without a method. Ask how the number was measured, on what population, and by whom.

Section six, continued

The whole gap, not one point in it

Manipulation does not stay in one channel, and a fraud team's view should not either.

A scam moves from a lure to a click to an exposure of personal data to a payment, often across several channels. SafeLine is how an institution brings its members into that view. Flggd is built to gather evidence across the gap, from the victim's side and from the scammer's, and each surface shown feeds the same record.

THE CUSTOMER'S SIDE
BEFORE THE LURE
Prepare people
Scam School and Learning Arcade teach people the patterns before they meet them.
LIVE
THE MESSAGE ARRIVES
Text, email, voicemail, friend requests
Flggd app and SafeLine: forward it, get an assessment. Email Scan: assessed automatically.
LIVE
THE CLICK
Web links and sites
Browser Shield: a warning before the click, on desktop browsers.
BETA
DATA EXPOSURE
What scammers hold
Exposure Shield: shows a person what of theirs is already exposed.
BETA
THE PAYMENT
The final step
SafeHold: a human-decided, audited protective hold on a vulnerable member's payment.
ALPHA
One evidence record
Every surface feeds the same record, so an institution sees the whole gap, not one point in it.
THE SCAMMER'S SIDE
Colloquy
ALPHA
Built to engage scammers through a synthetic persona, record the whole conversation, and produce a structured intelligence artefact for investigators.

Help shape what we build next

Surfaces marked Beta and Alpha are open to design partners: institutions that tell us what evidence their fraud, financial crimes and compliance teams need, and get early access in return.

Why breadth matters to an institution

A tool that sees only a message sees one point in the gap. An institution assessing manipulation and coercion needs the sequence: what arrived, what was clicked, what was exposed and what was paid. Ask any provider which of those it can see, and how mature each is.

Section seven

Ownership and human judgment

Evidence only counts if someone owns it, and if a person can be shown to have exercised judgment on it. An examiner or board will test both.

Who owns what

Where a person should sit in the decision

• 1 Assessment
  An automated read of the forwarded message. →
• 2 Human review
  A person decides whether and how to intervene, with the authority to override. →
• 3 Decision
  Intervene, monitor or close, with a stated reason. →
• 4 Record
  What was known, when, by whom, and what was done.

A sound design treats an automated assessment as an input to judgment, not a substitute for it. Where an assessment cannot reach a confident view, the right behavior is to say so. Section 8 gives the questions to put to any provider on this.

The examiner test: five questions the record should answer

• What did we know?
• When did we know it?
• Who saw it?
• What was decided, and why?
• Could a different reviewer reconstruct it?

Section eight

Eight questions to ask any provider of consumer-sourced intelligence

A new layer needs new due diligence. These questions apply to us as much as to anyone, and a good provider should welcome all of them.

1 Where does the signal come from?

Who submits it, and on what consent? A consumer-sourced product faces obligations an institution-sourced one never does.

2 Can any pathway carry SAR content?

Can anything reveal that a SAR exists? The 314(b) prohibition is absolute, so ask whether the route is impossible or only governed.

3 Who can see record-level data?

Does information about a named person ever reach anyone other than that person's own institution?

4 Where is re-identification prevented?

In a contract clause, or in the query layer where the data is actually read?

5 What is the real latency?

From a customer's submission to something your analyst can act on. And can your team act at that speed?

6 How is performance measured?

On what population, with what method, and by whom? Treat unmeasured loss-avoided claims as marketing.

7 What happens to what it learns about a person?

Can it be used to price, restrict or score that customer adversely? It should not be.

8 Where does the evidence record live?

Who in your institution owns it, and could it be produced to an examiner or a board on request?

Why question eight matters most

Controls rarely fail with a siren. They go quiet first. The institutions best placed for the next examination will be the ones that can show, on demand, what they knew, when they knew it, and what they did.

Section nine

Four questions the industry has yet to answer

Who pays for the pre-transaction layer, and from which budget?

Fraud loss sits in one place, compliance in another, and marketing sometimes sponsors member-facing services. Different institutions answer it differently.

Does consumer-sourced intelligence scale without the consumer becoming the product?

Our position is that the consumer service stays free and the institution pays. Whether that holds at volume is not yet proven.

Will 314(b) sharing on fraud actually happen?

The permission is now clear. Institutional behavior is not. A permission that no one exercises changes nothing, and the guidance alone will not move the market.

What is the right latency?

Real time is permitted. Whether institutions can act on real time, given their own operational constraints, is a separate and harder question.

Conclusions

The June 2026 guidance makes sharing about fraud permissible and real time. It cannot create evidence the institution never holds. The evidence sits with the customer, before the payment, and the institutions that bring it in while the window is open will be the ones able to show what they knew, when, and what they did.

Sources

1. FinCEN, Section 314(b) Fact Sheet, issued 12 June 2026. fincen.gov/system/files/shared/314bfactsheet.pdf

2. FinCEN, FinCEN Issues Guidance to Help Financial Institutions Eliminate Fraud Through Information Sharing, 12 June 2026.

3. FinCEN, FinCEN Identifies Nearly $13 Billion Linked to Suspected Digital Asset Scams Operated by Overseas Scam Centers, 3 September 2026. fincen.gov/news/news-releases

4. FinCEN, Information Sharing Under Section 314(b). fincen.gov/resources/section-314b

See it for yourself

Try SafeLine, on your own time.

A self-serve demonstration shows what a member experiences, and what the institution sees. No call required.

demo.flggd.com/safeline

To talk it through with the Flggd team, book a call. We would like your hardest questions, and to hear which surface you would need first.

About Flggd. Flagged PBC, Inc. is a Delaware public benefit corporation. Our vision is every citizen an educated, empowered scam fighter, so no scam ever wins again. The consumer service is free; institutions sponsor SafeLine for their members.