True Cost of Fraud 2026: What the Multiplier Means

Trade press coverage of a LexisNexis study reports that every $1 of fraud now costs U.S. financial services firms $5.47 in total, up from $4.00 in 2021. The figure is a multiplier, not a loss rate. It counts fees, interest, replacement costs, customer acquisition and crisis management on top of stolen money. Use the study to justify controls on the digital channels where it says losses now sit, and measure your own multiplier before you quote it to a board.

What the study says

This article draws on trade press coverage of the study. We did not review the primary LexisNexis release, so every figure below is as reported.

The study surveyed 319 risk and fraud professionals across financial services and lending. Of them, 251 were in the United States and 68 in Canada. About 65 percent of respondents worked at mid-sized and large organizations with annual revenue of $10 million or more. Coverage of the methodology lists the institution types in scope: commercial banks, payment service providers, credit unions, investment and wealth management firms, consumer and auto lenders, mortgage providers, fintechs and digital banks. The coverage we reviewed does not say how many respondents came from each type.

The report also finds that websites and mobile apps account for 69 percent of fraud losses. Coverage attributes the rise to AI-generated attack techniques and a near-total shift of fraud to digital channels.

Organizations reported effects beyond the loss itself. Customer trust was affected for 49 percent, compliance workload for 47 percent and brand reputation for 39 percent. More than half, 56 percent, said their fraud prevention strategies increased customer churn.

What the multiplier includes

The $5.47 figure is a ratio of total cost to direct loss. The coverage we reviewed breaks the total into two parts:

• About 48 percent is recovery and reimbursement costs and direct liabilities, such as chargebacks.
• The remaining 52 percent includes fees and interest, customer acquisition, and crisis communications.

Replacement costs are part of the multiplier too, but the coverage does not say which of the two buckets they fall in. Ask for that breakdown before you copy the split into your own paper.

That split changes how you should use the number. A bank that must replace customers after account takeovers, or that pays a large crisis response bill, may see a higher multiplier than a bank with sticky deposits and little churn. The figure describes the average respondent, not your institution.

Four checks before you quote it

A Head of Model Risk or an audit committee will test the number. Four points need to be stated before the figure goes into a board paper.

1. It is a survey. The figures come from a survey of 319 professionals, with 68 in Canada. The study is useful as a benchmark, not as an input to a loss forecast. The coverage we reviewed does not report sample sizes by segment, so ask for them before you rely on any single segment figure.
2. It is vendor research. LexisNexis is a commercial vendor that publishes the study. That does not make the study wrong, but it means the framing may favor spending on fraud tools. Say so when you cite it.
3. Populations differ. Trade press coverage cites separate LexisNexis studies. One covers retail and ecommerce and reports a multiplier above $5 per $1 of direct loss (cyberdaily.au, September 23, 2026). The other covers SNAP agencies and reports $4.29, based on 150 agency leaders (The Center Square, September 29 and October 21, 2026). We did not review either study. Do not mix the figures. Each is a different population with a different cost base.
4. The multiplier is not a direct-loss ratio. A bank should not budget as if every $1 of stolen funds becomes $5.47 of spending. Use the component split to see which costs you control.

How to present the figure to a board

A board paper that uses this number should say four things in order. First, what the figure is: a total-cost multiplier from a vendor survey, not a loss rate. Second, where it comes from, with the sample size and the date of the release. Third, what it means for this institution, stated as a question for management to answer with its own data. Fourth, what the institution is measuring itself, with the method written down.

Keep the LexisNexis figure in the benchmark column. Put the institution’s own multiplier, built from its own records, beside it.

Build your own multiplier

You can calculate your own figure from incident records you already keep. Use the last twelve months of confirmed fraud events, grouped by channel.

Keep the method fixed from year to year, or the trend will mean nothing. Write down which costs you counted and why, so a reviewer can rerun the calculation.

Where the controls belong

The study points to digital channels, and the risk sits on the actions that move money or change a customer’s details. Three controls are worth testing first.

• Step-up verification for money movement. Require a fresh check, such as a one-time code or an in-app approval, for transfers, new payees and limit changes. Apply it on every channel, including sessions that began in an app or an assistant.
• Call center verification. Staff should verify the customer directly before any account change requested by phone, especially where the caller says an outside tool is acting for them. The AI voice cloning fraud risk assessment covers the impersonation side of this path.
• Friction you can measure. The study reports that 56 percent saw churn rise after prevention. Track false declines and step-up abandonment alongside fraud losses, so you can see when a control costs more than it saves.

The same channel shift is the reason agent access to customer accounts needs its own policy. A login that a customer shares with an outside tool passes authentication and skips the customer’s intent. The AI agents in customer bank accounts article sets out the access controls to test first.

Questions for the vendor

Before the figure goes into a paper, ask LexisNexis for the following. The coverage we reviewed does not answer them.

• The primary release and full methodology. We have not reviewed the release itself.
• The sample size for each segment and each institution type.
• Which bucket replacement costs fall into, and how the 52 percent splits.
• Whether the 2021 baseline of $4.00 used the same method.

A 30-day plan

1. Week 1. Build the multiplier worksheet for the last twelve months and record the method.
2. Week 2. Split fraud losses by channel. Confirm how much sits on web and mobile.
3. Week 3. Test step-up verification on one money movement path, and record the result from a scripted session.
4. Week 4. Put the multiplier, the method and the control results in one paper for the risk committee. Label the LexisNexis figure as a benchmark from a vendor survey.

Questions buyers ask

Is $5.47 our expected cost of fraud? No. It is an average across survey respondents. Use it as a benchmark and calculate your own multiplier from your own records.

Can we compare our bank with the 319 respondents? Only in broad terms. The respondents are risk and fraud professionals across institution types. The coverage we reviewed does not report segment sample sizes. Compare your multiplier with the benchmark only after you have written down how both were built.

Does the study show that AI caused the fraud losses? Coverage says AI-generated attack techniques are pushing losses higher. The coverage we reviewed does not isolate AI’s share of losses, so do not attribute a specific dollar amount to AI in a board paper.

How do we justify fraud spend to the CFO? Use your own multiplier. Show the direct loss, then each cost component, and state which components the new control reduces. A control that cuts direct loss but raises churn needs both numbers.

Does this belong in an AI governance program? Yes, where the fraud comes through an AI-enabled channel, such as an agent acting for a customer or a synthetic voice on a call. Govern the action, not only the model.

Which control should we fund first? Step-up verification on money movement and payee changes, because it limits loss on every channel at once. Measure its effect on abandonment before you expand it.

For the wider program, see banking AI governance. The reasoning behind the controls above also applies to the wider AI security assessment that many banks start with.