Ex-FBI turned Wings Credit Union sleuth on fraud: ‘It boils my potatoes’

Brad Lynch started his 21-year career in the FBI chasing bank robbers, but he found his “sweet spot” as a special agent in the white collar crime unit.

His latest calling: Protecting Apple Valley-based Wings Credit Union and its accountholders from fraud.

“It boils my potatoes when some punk is trying to steal money from a senior citizen who’s worked all their life,” said Lynch, the Minnesota credit union’s director of fraud investigations and recovery.

Criminal wire fraud, mortgage fraud and bank fraud cases trained Lynch to study patterns, identify anomalies and ask critical questions. Those skills apply in his current role, where he directs a team that responds to red flags on members’ accounts.

Lynch said deposit fraud, like an altered paper check, is the biggest type of fraud in terms of actual and attempted losses. But financial institutions are increasingly on the front line of defense against evolving and more sophisticated scams.

In 2024, U.S. residents lost $16.6 billion to a range of computer- and technology-assisted fraud, like malicious software and spoofed emails, according to the FBI’s latest report.

In addition to his role directing fellow investigators, Lynch teaches how-to-avoid-a-scam classes, mostly to seniors. Though younger people still report high volumes of fraud, those 70 years of age and older tend to lose much greater sums, according to Federal Trade Commission data.

I oversee a team of analyst investigators. The supervisor works with me. And basically, we get alerts. Some of those are computer alerts, some of those are human alerts. And we look into them, whether it’s ACH, or automated clearing house, fraud, whether it’s deposit fraud, check fraud, elder abuse, those type things.

So, we have different things set into the system, and they let us know, “Hey, we think something’s going on here.” And then we take a look at it and compare that against, maybe, prior transactions. How long have they been a member? Those kind of things. And then, take next steps.

Some of those we just know, “OK, no, this isn’t fraud. We’re aware of this activity here. We’ve spoken to the member before.”

And then sometimes it’s like, “No, we’ve got to call this person.” They live here in Minneapolis. Were they really in Raleigh, N.C., buying $500 worth of gear at wherever?

The kind of ham-handed approach are the fake checks. So, somebody opens up an account, they go in, they bring in some lousy, fake, out-of-state checks for $5,000, or right around there. And then they have some baloney story: They did work for them, or they have an invoice, or they got it from their cousin. “I got this check as part of a job offer, and so I had to cash this.” ... There are all kinds of stories.

So those are a little more complicated. Sometimes we end up telling members, “Hey, either get your laptop or your phone, take it somewhere, get it looked at, cleansed, reset, whatever you need to do.” Because that’s probably the quickest way to get rid of it. Maybe they put a virus on there.

I would tell you that everybody is a potential target. I mean, I’m not trying to make anybody paranoid.

But we work a lot of cases throughout the year, hundreds. And we see people from every age and stage, every background. We see younger people. We have some teenagers under 18, who are getting co-opted into this card-cracking scheme, up to every age along there — whether it’s deposit fraud, whether it’s ACH fraud, whether it’s some other scheme that’s going on — going up into the senior citizen ages.

The senior citizens, I would say, they’re more vulnerable. Part of it is because they are, for lack of a better term, technologically disadvantaged.

Some of them haven’t made that transition. Like, do you know what Google Authenticator is? Well, grandma might not, right?

Two, change your password every so often. Because even in this world that we live in, you know, everybody comes up with a fantastic password. Unfortunately, there have been breaches to email servers. Right? Whether it’s Yahoo, whether it’s Comcast, there are other ones.

Everybody kind of relies on their email being secure, but that may not be the case. Technologically, the best way to do it is by using something like other apps out there to keep your password.

Another tip [if you think you might be involved in a scam] might be just to have somebody else trusted that’s in your life that you can bounce something off of. You don’t have to live in a gaslit world.

When somebody’s trying to make you do something because one of the other scams is, your grandson, your granddaughter is in jail for whatever thing, they got picked up on a speeding ticket in Wisconsin ... and they demand cash payment or some sort of payment right there.

There are several different reasons for why there’s pressure. But in all those situations, invite somebody else in that you know and trust.