Duty Without Liability: Bank Reporting Incentives and Elder Financial Exploitation

Abstract

Elder financial exploitation (EFE) has grown from a containable, small-scale problem into a systemic economic and regulatory failure. Americans over 60 reported $2.4 billion in fraud losses to the Federal Trade Commission in 2024. Still, because most fraud goes unreported, the FTC estimates the true cost that year at between $10.1 billion and $81.5 billion (Federal Trade Commission). This paper argues that EFE persists not because seniors lack financial literacy, but because the institutions best positioned to detect exploitation, banks, face no legal duty to report it. Drawing on neuropsychological research, FinCEN's Bank Secrecy Act data, and New Jersey's statutory reporting framework, the paper shows that EFE is a market failure driven by three forces: wealth concentrated among older, less digitally literate Americans; AI-enabled scams that build convincing relationships with victims at scale; and a reporting regime built around the wrong kind of observer. Under New Jersey's permissive statute, confirmed by Lucca v. Wells Fargo Bank, N.A. (2015), reporting is strictly dominated: nondisclosure carries no penalty, so silence is costless while acting is not, and no level of confidence that a customer is being exploited makes reporting privately rational. That gap is not an oversight of an older statutory scheme: New Jersey imposed a mandatory exploitation-reporting duty on broker-dealers and investment advisers in 2019, four years after Lucca, while leaving depository institutions under the permissive standard. A formal model shows the result holds for arbitrarily small positive administrative costs, and that immunity cannot fix it, since immunity lowers the cost of acting but never below zero; only a mandatory duty closes the gap between social and private incentives. The paper concludes with illustrative, clearly hypothetical statutory language giving New Jersey depository institutions hold authority modeled on the 2019 SAFE Act, attaching a mandatory notification duty to it, and enforcing that duty through supervisory examination rather than a civil penalty, then explains why the design departs from the model's first-best.

I. Introduction

Imagine receiving a call from your grandchild, panicked after a car accident and too afraid to ask their parents for help. The voice sounds exactly like them, kind and familiar, so you rush to your computer and wire the money. Days later, you learn the accident never happened: an AI-generated voice clone, built from a few seconds of audio lifted from a social media clip, had just taken your money. You have joined thousands of people your age who have been scammed the same way.

This method of stealing elders' wealth is real, increasingly common, and fairly new. For most of the digital age, EFE occurred on a small scale and was containable through law enforcement, with scammers sending bulk, poorly worded phishing emails to older, less tech-savvy targets. Around 2022, generative AI made fraud cheaper and easier to commit, producing growth that obsolete regulatory regimes have been unable to manage. The mismatch between the scale of EFE and the policy response is not simply a lack of political will. It is a failure to ask why banks, which hold the most comprehensive view of a customer's financial activity, so rarely act on what they know, since EFE has been framed almost exclusively as a financial literacy problem.

This paper argues that EFE is a market failure with three causes: wealth concentrated among a generation less equipped for digital risk, AI-enabled scams that patiently cultivate relationships with victims at scale, and permissive reporting regimes that place no obligation on the party best able to intervene. The third cause is not theoretical: New Jersey's reporting statute, tested in Lucca v. Wells Fargo Bank, N.A., lets banks report suspected exploitation but does not require it. Faced with a statute that merely permits disclosure and attaches no consequence to silence, there is no level of confidence at which reporting is the best response; nondisclosure strictly dominates. That failure is built into the statute rather than a matter for normative debate, and diagnosing EFE as its logical consequence, rather than a failure of individuals or cognition, is what makes targeted reform possible.

Sections II through V discuss why EFE has been systemic rather than case-specific: the macroeconomic reality on the ground (II), the rising magnitude of AI-driven scams targeting elderly Americans (III), the neuropsychological basis for seniors' inherent vulnerability to those scams (IV), and the fragmented nature of the regulatory framework that has lagged behind both (V). Section VI discusses the particular legal mechanism causing that failure in New Jersey, and Section VII models it within a threshold framework calibrated to show that, under the current state reporting statute, reporting is strictly dominated whatever the bank's confidence that a customer is being exploited. Section VIII uses that result to propose a tailored statutory solution, Section IX evaluates that solution against the governance tradeoffs it generates, and Section X concludes.

II. The Economics of an Aging America: Scale and Cost

This section and the three that follow establish the economic, technological, psychological, and regulatory context to which the reporting-duty model in Sections VI and VII responds.

A. Wealth Concentration and the Great Wealth Transfer

To understand why EFE has become a systemic market issue, it is first crucial to understand where people's wealth is concentrated. Modigliani and Brumberg's life cycle hypothesis posits that people save money during their working years and access it to spend during retirement. This hypothesis suggests that wealth accumulation peaks for most just before retirement; as a result, most of the wealth in the US population is held by older adults.

This is a massive economic shift, not a small one. As Baby Boomers age and retire, the nation's wealth increasingly rests in the hands of older Americans, the Great Wealth Transfer. Kim et al. situate this within the broader relationship between population aging, financial development, and wealth inequality, finding that demographic aging shapes how the gains from financial development are distributed: never before has so much wealth concentrated among generations now being forced to navigate a digital world they did not grow up with.

B. What Fraud Actually Costs the Economy

There is also a major fiscal impact: as seniors' savings decrease due to fraud, applications for Medicaid, housing assistance, and SSI rise, converting private losses into public spending, a direct transfer to state and federal coffers that Gunther recognizes but does not quantify. Gunther, using a methodology developed with NORC at the University of Chicago, estimates annual EFE losses to Americans over 60 at $28.3 billion, of which roughly three-quarters, or $20.3 billion, is attributable to perpetrators known to the victim, and describes that figure as conservative once publicly funded programs for victims who have exhausted their own resources are counted. That source matters for Section V: most measurable losses stem from trusted-relationship transactions that SARs are least capable of identifying.

C. The Compliance Cost Burden on Community Banks

EFE is causing negative institutional impacts in the banking sector, thereby increasing financial risk for seniors. Under the Bank Secrecy Act, FinCEN receives over 155,000 reports related to EFE annually, with approximately $27 billion in suspicious activity (FinCEN, "Elder Financial Exploitation"). The record $1.3 billion penalty against TD Bank for Anti-Money Laundering (AML) failures in 2024 prompted institutions to increase spending to combat this (FinCEN, "TD Bank Enforcement"). This financial burden falls primarily on small banks.

III. How Fraud Techniques Outran the Framework

A. From Phishing Emails to Synthetic Credibility

Technological advances have outpaced the infrastructure built to respond to them. For most of the digital age, elder fraud relied on mass, uncoordinated efforts: scammers blasted seniors with thousands of phishing emails knowing only a few would respond, and those letters were poorly worded and obvious to most recipients. No longer. Since late 2022, generative AI has been weaponized to script deepfake phone calls, personalized emails, and convincingly urgent technical-support chat interfaces, and the noisy fingerprints that once made scam attempts easy to spot have largely been scrubbed. Scammers can now establish deceitful-but-legitimate relationships with seniors at scale instead of one manpower-intensive victim (mark) at a time (Blackbird.AI). Voice cloning is one major reason: McAfee testing found cloned voices matched their source with about 85 percent accuracy using just three seconds of sampled audio (McAfee). That finding is vendor research, not peer-reviewed. Still, the underlying point, how little audio is now required, is not seriously contested. With audio routinely available from social media, deepfake impersonation has become one of the most lucrative scam techniques that existing law does little to combat.

B. Pig-Butchering: Patience as a Fraud Strategy

The most significant and growing AI-powered scam technique in EFE beyond deepfakes is pig-butchering, also called a romance scam: named for fattening animals before slaughter, it has scammers spend days or weeks building relationships with seniors through social media before leading them into fraudulent, usually crypto, investments. Unlike traditional scams, it is slow-moving and emotionally driven, exploiting seniors' loneliness late in life (DeLiema).

The cost of this problem ranges from unbelievable to terrifying. Researchers at the University of Texas at Austin followed blockchain transfers from victims and discovered that pig-butchering groups funneled over $75 billion worldwide into scam crypto wallets from 2020 to 2024 alone (Griffin and Mei). Keep in mind that these statistics account for losses incurred by people of all ages; the researchers did not parse their findings by demographic, so consider the total more as a measure of how widespread the scheme has become than as an estimate of losses specific to seniors.

IV. Why Senior Citizens Are Structurally Vulnerable

A. What the Brain Science Shows

Seniors' vulnerability to financial fraud is not a matter of a lack of care or attention to detail. It can be rooted in biology. Older adults experience a steady cognitive decline, with thinning of brain structures that help regulate how the brain processes and responds to threats, which predisposes them to vulnerability in the digital age (Fenton et al.).

Timing matters for policy. Nicholas et al. looked at credit-report data for 81,364 Medicare beneficiaries. They found that patients later diagnosed with Alzheimer disease and related dementias missed bill payments up to six years before diagnosis and began accruing subprime credit scores about 2.5 years before diagnosis more often than non-diagnosed controls; no similar pattern preceded arthritis, glaucoma, or hip-fracture diagnoses, suggesting the effect is specific to cognitive decline. The analysis is observational, and the sample excludes many multi-person households. Still, the policy implication is clear: financial risk starts years before diagnosis, so protections triggered by a diagnosis, conservatorship, or age limit arrive after the period when they would matter most.

B. Isolation, Trusted Perpetrators, and the Trust Trap

Social and demographic circumstances shape cognitive vulnerability in older adults, who commonly face increased isolation and loneliness that can bring on depression and mild cognitive impairment. DeLiema links this to EFE: scammers exploit that loneliness to draw seniors into online "relationships" with strangers who are, in fact, exploiting them, and shrinking social connections compound the risk.

Another piece of the puzzle is who the fraudster was. According to FinCEN's threat-pattern analysis, about 20 percent of elder-financial-exploitation BSA reports involved elder theft, defined as the misuse of an older adult's funds by someone the victim knows and trusts. In nearly 40 percent of elder theft incidents, the adult child committed the crime (FinCEN, "Elder Financial Exploitation"). Betrayal trauma theory explains why this form of EFE is both unexpected and unusually damaging: exploitation by caregivers and relatives inflicts greater financial harm and worse psychological injury than the same loss at a stranger's hands, because the cognitive machinery people use to sustain close relationships resists recognizing abuse within them. The institutional deficiency is that standard regulatory action and fraud-awareness campaigns ignore this form of scam entirely, increasing risk for victims.

C. Why Financial Education Is Not Enough

The instinct is to address EFE through financial literacy programs. Still, the evidence does not support this as an effective policy solution: financial knowledge and aptitude do not reduce the risk of online scams, while social advocacy and support for seniors is far more effective at preventing financial loss and protecting cognitive welfare (Gotelaere and Paoli; Button and Cross; Cross and Kelly; Prenzler).

Lachs and Han's concept of age-associated financial vulnerability supports this: they attribute financial vulnerability in older adults to four domains, cognitive/emotional, medical/functional, psychosocial, and environmental/societal, that financial literacy interventions can remedy only a small fraction of. Instruction in the recognizable markers of earlier-generation scams (implausible premises, poor spelling, unfamiliar senders) addresses a threat generative AI has already eliminated. The emotions today's scams exploit (urgency, family love, reciprocal trust) are not things money skills improve.

V. The Regulatory Landscape and Where It Falls Short

A. Too Many Agencies, No Clear Leader

Regulatory action against EFE falls short despite rising budgets, because no single agency is responsible for combating it: FinCEN handles Bank Secrecy Act reporting, the CFPB regulates financial products, the SEC covers financial advisers within BSA, the FTC handles fraud prosecutions, state agencies handle criminal enforcement, and Adult Protective Services handles the social side. In December 2024, seven federal and state regulators issued a joint statement setting out risk-management practices institutions "may consider." What is most telling about the statement is what it is not: a coordinated expression of supervisory expectations. It explicitly includes "no new mandates" and assigns "no primary agency responsibility" (Interagency Statement on Elder Financial Exploitation), underscoring how fragmented this landscape really is.

B. The BSA's Blind Spot

The BSA's SAR system is our main systemic safeguard against EFE, and it was not designed for the problem we ask it to solve. The SAR detects suspicious account activity, such as large wire transfers to new businesses, which works well for outbound scamming and poorly for exploitation inside trusted-relationship transactions. When the daughter of an older adult wires money out of her mother's account, the transaction passes every test on paper. That is the SAR's blind spot. FinCEN reports outbound scamming makes up 80% of EFE BSA filings while trusted-relationship fraud accounts for the remaining 20% (FinCEN, "Elder Financial Exploitation"). The gap is larger than that percentage indicates: elder theft accounts for only about a fifth of BSA reports but roughly three-quarters of total EFE losses, based on Gunther's back-of-the-envelope calculations. That is because only about 12.5 percent of elders scammed by someone they know report the crime, compared to 67 percent of otherwise similar victims tricked by a stranger.

In short, the category most likely to slip through the SAR pipeline is the category where most of the money is actually stolen, which is why it matters for the recommendation in Section VIII. A reporting duty acts only on suspicions that already exist; it cannot help a bank detect a suspicious transfer in the first place, but it does control behavior once exploitation is detected. For trusted-relational fraud specifically, reporting is the only way to reach someone who can intervene: if a bank witnesses this kind of fraud, the kind least likely to trigger a federal SAR, its only recourse is referral under state law. The mandate therefore hits the most expensive type of abuse the hardest.

C. The Financial Exploitation Prevention Act's Permission Problem

The most notable federal legislative response to EFE is the Financial Exploitation Prevention Act (H.R. 2478 and S. 2840), which would let open-end investment companies and their transfer agents delay the redemption of securities when they reasonably believe a customer is being financially exploited. A prior version of the bill passed the House 419 to 0 in 2023 but expired without Senate action; the current H.R. 2478 passed the House 414 to 2 on June 25, 2026, and its Senate companion, S. 2840, remains pending in the Banking Committee. Even with that delay, the concept is promising: pausing a suspicious redemption buys time to identify exploitation before funds leave the account.

The bill's legality is still being negotiated, and for obvious reasons: it invades the rights of consenting adults to manage their own finances fully, and fails to define adequately what constitutes "suspicious activity." This same void, a reporting mechanism that is not designed to identify the kind of trusted-relationship abuse described above, exists at the state level in New Jersey's very own statutory language, which Section VI addresses head-on.

VI. The Duty Gap: The New Jersey Case Study and the National Default

New Jersey is one of the handful of states that lacks an omnibus statute governing reports of suspected elder financial exploitation. Instead, we have four discrete reporting regimes, enacted at different times and addressing different actors. Together, however, they have the (perhaps unintended) effect of both particularizing and, we argue below, privatizing the problem: singling out the actor with the most frequent and comprehensive access to a customer's finances, the depository bank, as the only relevant observer without a duty to report what it witnesses.

Regime 1: N.J.S.A. 17:16T-1 to -4. New Jersey's original regime is this statute. It regulates banks directly. Passed in 1998, it allows but does not require "a financial institution [to] disclose the financial records about a customer's account to a law enforcement agency, a county adult protective services agency, or both" where the suspected victim is a bank's elderly customer or vulnerable adult customer. Immunity from suit attaches on disclosure or, in good faith, refusal to disclose. The statutory text does not itself specify which institutions the section covers, but the legislative history resolves that ambiguity: "financial institutions." This bill "would provide financial institutions the legal comfort necessary to make that decision."

Regime 2: The Adult Protective Services Act before its 2009 amendment, N.J.S.A. 52:27D-409(a). Passed in 1993 as P.L. 1993, c. 249, APSA preceded N.J.S.A. 17:16T-1 to -4 by five years, and its initial reporting provision used the same permissive construction later applied to the financial sector: every "person who has reason to believe that a vulnerable adult is an abuse victim," professional or otherwise, "may" report. Because APSA predates 17:16T-1 to -4, the borrowing runs the opposite direction from what a casual reader would assume: 17:16T quotes APSA's earlier permissive language.

Regime 3: APSA as amended in 2009, which introduced tiers: certain professionals ("health care professionals," "law enforcement officer," "firefighter," "paramedic," "emergency medical technician") got mandatory "shall report" language, while everyone else ("any other person") kept the original voluntary "may report." Banks were left out of the mandatory tier not because the Legislature overlooked them, but because the professions selected work closely with people at risk of immediate physical harm, not financial harm, and have less comprehensive customer information than a nurse or officer would.

Regime 4: The Safeguarding Against Financial Exploitation Act, N.J.S.A. 49:3-84 to -89. In 2019, the Legislature returned to financial exploitation a fourth time and, for the first time, imposed a mandatory duty on a financial-sector actor. Under the SAFE Act, P.L. 2019, c. 340 (effective April 2020), a qualified broker-dealer employee or agent who "reasonably believes that financial exploitation of an eligible adult... may have occurred, may have been attempted, or is being attempted shall promptly notify the bureau and the applicable county adult protective services provider" (N.J.S.A. 49:3-86(a)); "eligible adult" means a person 65 or older, or one covered by APSA. The notice requirement carries immunity for good-faith reports made with reasonable care and permission to delay a transaction or disbursement where exploitation is suspected (N.J.S.A. 49:3-88(a) to (c)).

The SAFE Act matters for three reasons. First, it shows the Legislature knows how to draft a mandatory exploitation-reporting obligation for a financial intermediary, and did so as recently as 2019. Second, it did so four years after Lucca publicly explained the permissive nature of N.J.S.A. 17:16T-1 to -4. The exclusion of depository institutions from the mandatory tier was therefore a choice the Legislature made and then kept, not an oversight. Third, and most useful here, the SAFE Act supplies a drafted, enacted New Jersey starting point for the amendment proposed in Section VIII: it need not be built from scratch, only adapted from Title 49 to fit Title 17.

Two caveats bear mentioning. The SAFE Act's duty runs to the Bureau of Securities and county APS, enforced through the Bureau's oversight powers rather than a private right of action, so its liability benchmark is regulatory rather than civil, a distinction Section VII addresses directly. And it applies to securities intermediaries, who see a narrower swath of a customer's finances than a depository institution does. Neither limitation undercuts the point that Section VIII's drafting problem has already been solved once in this jurisdiction.

Lucca v. Wells Fargo Bank, N.A., 441 N.J. Super. 301 (Law Div. 2015) litigated the real-world application of these two regimes to a depository institution. Wells Fargo processed twenty-seven wire transfers, totaling nearly $300,000 over six months, to overseas accounts at the instruction of an 82-year-old customer. A representative who suspected the transfers told the customer she was being scammed and logged an internal elder-abuse report after each transaction, but never notified police or APS. The customer sued for failure to report.

The trial court found no legal duty to report because N.J.S.A. 17:16T-1 to -4 "does not impose a duty on a financial institution to notify the authorities of a suspected scam"; the permissive language showed the Legislature intended this to be optional, and without a duty, there can be no breach. A bank that flagged the fraud internally and never referred to it externally was held not liable, since it owed no duty to release the funds. Lucca is not an outlier: the default rule of American commercial law is that a receiving bank that properly executes an authorized payment order owes no duty to any party beyond what statute or contract specifically imposes (U.C.C. section 4A-212). Courts nationwide have unanimously declined to impose a duty on depository institutions to stop authorized transfers even where fraud is known. See In re Cook, 2023 WL 3467209 (E.D. Va. 2023); Scott v. Branch Banking & Trust Co., 588 F. Supp. 2d 667 (W.D. Va. 2008). Lucca simply held that New Jersey's anti-exploitation statute did not implicitly repeal that default. That matters here because the model's independent variable is not one state's statutory choice, but the default legal treatment of authorized transfers across most states, which is exactly why Section VIII's proposed carve-out generalizes.

The court's reasoning is as significant as its holding. In the same passage, the court explains why the gap persists: the Legislature could have amended N.J.S.A. 17:16T-1 to -4 to require financial institutions to disclose suspected financial exploitation, but it did not. The Legislature opted instead to amend APSA to create a separate tier of professionals who are mandated to report abuse of vulnerable adults. "Other persons or entities who have reasonable cause to believe a vulnerable adult is subject to exploitation," the court tells us, "such as the bank here," "are not under that mandate. They may report the information, but are not required to do so."

That is New Jersey's duty gap, stated this time in clinical rather than statutory terms. FinCEN sees over 155,000 SAR filings related to EFE per year, totaling $27 billion in suspicious activity (FinCEN, "Elder Financial Exploitation"); no occupation newly designated as a mandatory reporter under APSA will encounter that many victims. Of the four mutually exclusive legal frameworks governing who must report suspected exploitation in New Jersey, the statute covering the entity best situated to detect it, the depository bank, imposes no duty at all. Lucca's relationship to the model below should not be overstated: no single trial-level opinion could prove the model's prediction. Its role is narrower and antecedent: it establishes one of the model's parameters as a matter of law. Because a statute's grant of permission forecloses any cause of action for nondisclosure, the probability that silence creates liability is not merely low; it is zero, and everything that follows depends on that point of law together with the assumption that the bank minimizes expected cost.

VII. Duty Without Liability: Modeling the Bank's Reporting Decision

We can formalize this intuition about duties. Suppose a bank compliance officer receives an alert that triggers a suspicious activity report regarding the account of an elderly bank customer. She forms belief q in [0,1] that the transaction resulted from bona fide abuse. She may then either report that belief to a county adult protective services agency (or law enforcement) or not; acting here means notifying an outside agency. The model isolates notification because it is the least invasive intervention capable of reaching an actor empowered to investigate, which lets us show that not even the least-invasive response available to the bank is privately rational under a permissive regime. Section VIII bundles notification with intervention in the transaction itself; the model applies to the notification component of that design and need not price the intervention.

Acting is costly. Investigation will cost the bank some administrative expense c_a per referral; each referral takes up employee time whether the suspicion is valid or otherwise. Further, the bank may face litigation. The bank is sued either because it placed a wrongful hold on an account not actually being exploited (probability 1 - q) or because it improperly denied a customer access to her funds. Such a suit is actually filed with probability s, and in either case the bank must spend some amount D defending against it. Inaction, by contrast, costs the bank nothing except if the customer was actually being exploited and the bank is sued for failure to report (probability π), in which case it pays a statutory penalty H. We can now write expected costs as:

E[cost of acting] = c_a + (1 - q) × s × D

E[cost of silence] = q × π × H

In general, a utility-maximizing bank chooses to report whenever the expected cost of acting is no greater than the expected cost of silence, and where π × H > 0, that comparison pins down an interior private reporting threshold. The general expression is preserved below because it becomes meaningful once π × H > 0, the range Section VIII makes the case we should be pushing the law towards operating in, and because it lets us later determine algebraically what magnitude of penalty is necessary to close the gap between private and social incentives:

q_private = (c_a + s × D) / (π × H + s × D)

New Jersey's statute contains no enforcement provision whatsoever: H = 0 by the plain terms of N.J.S.A. 17:16T-1 to -4, so π × H = 0 regardless of the value of π. Lucca provides the other half of the equation, foreclosing any private right of action for failure to report to confirm that π itself is zero on this channel. Grounding the result in statutory silence on penalties, rather than in Lucca by itself, also matters: Lucca was issued at the trial level, and the paper's main empirical claim should not hinge on one plausibly distinguishable decision.

Because π × H = 0, E[cost of silence] = q × π × H = 0 for every value of q, while E[cost of acting] = c_a + (1 - q) × s × D, which is at least c_a > 0 for every value of q. Silence thus weakly dominates acting for every value of q in [0,1], not merely below some threshold, because the bank's belief about whether its customer is being cheated does not affect the comparison. The general threshold formula above offers no interior solution here. There is no q_private for it to locate, since dominance holds identically at every point on [0,1] rather than pivoting on some cutoff belief.

This also deflates the response that comes to mind first. Grant banks absolute immunity and s × D falls to zero, collapsing the cost of acting from c_a + (1 - q) × s × D to c_a. It cannot go lower: while the statute is permissive and the penalty zero, c_a is the floor. Behavior therefore does not change, not through some perverse effect of immunity but because the friction immunity removes never mattered. Immunity lowers the cost of acting relative to inaction, and where no duty to act exists, inaction already costs nothing. Rules that impose an affirmative duty and attach a real sanction to its breach are therefore not one reform among many; they are the precondition for any of the others to have any effect.

One wrinkle remains, without which this conclusion may seem at odds with the aggregate reporting numbers in Section II. Banks are not silent: they file over 155,000 BSA reports relating to elder exploitation alone each year. The resolution is simple: that mandatory channel is not the reporting channel the model here describes. Banks must file SARs; they must report suspicious transactions that might evidence criminal conduct. Filing a SAR is a federal mandate backed by prudential supervision, and the penalties on that channel are neither nonexistent nor inconsequential, as the recent $1.3 billion settlement with TD Bank suggests. Except under unusually aggressive treatment of SAR reporting, the expected π on that channel is very much greater than zero.

Here, the channel is different. Specifically, it is the state-mandated referral to law enforcement or a county APS agency under N.J.S.A. 17:16T-1 to -4. It is only on that channel where π, and by extension the cost of silence, equals zero according to Lucca. Lucca illustrates why this distinction matters. Wells Fargo detected the scam, notified the customer, and filed an internal elder-abuse report after each of the twenty-seven transfers, but never referred the matter to law enforcement or county APS, the only actors with authority to intervene. Against a backdrop where referral is mandatory on one channel and costless to omit on another, optimal strategy dictates silence: 155,000 referrals there, silence here.

If law enforcement already receives SAR data, what does state referral add? Three things: SAR filings arrive weeks after the transactions they describe, once funds have cleared; they go to federal law enforcement rather than the county APS agencies with statutory responsibility to evaluate capacity and existing relationships with vulnerable adults; and they involve no interaction with the customer at all. Notification under the statute modeled here is the only currently available way to trigger intervention by an actor with both the authority and the relationship to investigate capacity while the transaction is still live.

To close: continuing to think about private action versus the social optimum, what would q be if a social planner decided? The social planner would act if the expected value of intervening exceeded its cost, acting whenever q × r × L > c_a + (1 - q) × c_f. Notice the addition of r, the portion of L that would be saved by intervening early, and of c_f, the cost to the consumer of a false positive referral: the cost of losing privacy, of disrupting a transaction through an APS investigation predicated on nothing more than a suspicious transaction that was legitimate. Solving for q as above:

q_social = (c_a + c_f) / (r × L + c_f)

Calibrating with L = $21,902, r = 0.72, c_a = $150, and c_f = $400 gives q_social = 3.40%. Society wants the bank to act whenever it is at least 3.40% confident that exploitation is occurring. Recall that allowing the bank to choose lets it always prefer silence, regardless of its degree of confidence.

How much leeway is there in the 3.40% baseline number? Allowing L to range from roughly half to nearly seven times its baseline value, r from about one fifth to just above its baseline, and c_a from about a quarter to three times as high produces social thresholds ranging from 0.51% to 14.92%. The private threshold cannot be breached, because given current law there is nothing to breach. Strictly positive c_a guarantees silence dominates acting, and no values of L, r, s, or D can change that fact. The resulting gap between private and social thresholds is not sensitive to uncertainty about the parameters on which they both depend. It is an invariant of any legal regime where π = 0. Neither raising the cost to customers of a referral (c_f), nor lowering c_a to a value still comfortably within the plausible range, nor both together, closes the gap.

The calibration below answers a different question than "what threshold does the bank use under current law," since the preceding paragraphs show there is none: dominance holds at every q. It instead asks what penalty would convert the bank's problem from a dominance game into a genuine interior-threshold game whose threshold matches q_social. That reframing matters beyond notation: it clarifies that a mandatory-duty-plus-penalty regime does not merely raise the cost of silence at the margin; it converts the decision's structure, from one in which the bank's belief about exploitation is irrelevant to one in which that belief becomes decision-relevant. The minimum sanction that accomplishes this conversion can be found by setting q_private = q_social and solving for H:

H_min = [(c_a + s × D) / q_social - s × D] / π

Notice what happens when π = 0: the expression is undefined, because a penalty is divided by a probability of ever paying it that equals zero. No positive value of H seals the wedge, which is precisely why choosing a penalty structure cannot change a bank's incentives as long as New Jersey stays in its current regime. Plug π = 0.15 into the expression and grant banks perfect impunity from wrongful-hold suits (set s = 0), and you get H_min = $29,399. This is not a number I would suggest anyone put into a statute. It is meant only to convey scale.

That magnitude does not depend on the paper's least defensible parameter. When s = 0, the expression above reduces to H_min = c_a / (q_social × π), and since q_social falls as r rises, a smaller recovery share raises q_social and hence lowers the sanction needed to bring about that deterrence level. At r = 0.15, the lowest value examined in the paper, q_social = 14.92% and H_min is approximately $6,701. The paper concludes that the penalty needed to align private and social incentives perfectly is small and non-punitive, so it does not rely on the assumed value of r being accurate; it applies even more strongly if r is too high, as the Methods Appendix suggests.

As π approaches zero, increasingly large penalties will be required to close the wedge, which is another way of stating a familiar result from the economics of law enforcement. Because violations that are unlikely to be detected can be expected to escape punishment more often than not, the optimal penalty for such violations must be very large to deter would-be offenders (Becker). The reverse is also true. If a jurisdiction wants the duty to remain effectively optional, it does not need to grant matching absolute immunity; it only needs to pair the duty with a sufficiently low and believable chance of enforcement.

VIII. Toward a Statutory Fix

The Financial Exploitation Prevention Act (H.R. 2478/S. 2840), cited in Section V, allows open-end investment companies and transfer agents to delay redemptions when they reasonably believe a customer is being exploited. But it does not acknowledge or solve the reporting responsibility gap described in this paper. It provides extra authority to a party who is not lacking permission.

A. What the model requires and what a workable design would supply

An implication of this model that bears on the enforcement design below is that a first-best would be a mandatory duty backed by an expected sanction large enough to exceed the cost of acting. Proposition 1: A mandate changes behavior if and only if π × H > c_a. The design sketched below imposes no fixed civil penalty. The departure is not an oversight. Three facts about the world drive it.

First, the model leaves open the source or sources of π's nonzero probability; it reflects only the probability that silence will be costly if attempted, not how many sources those costs stem from (see supra Section VII's discussion of the Bank Secrecy Act channel). Financial institutions already operate under regimes whose weight derives entirely from prudential supervision rather than a state-imposed penalty; an enforcement regime built the same way provides π through routine examination. Notification records subject to examiner review and required to be retained have independent value to the institution, creating a reason to comply absent any posted penalty, since exam findings themselves cost money. Proposition 1 says nothing about how high that cost must be beyond exceeding c_a, which is probably on the order of $150.

Second, depository institutions are partly regulated by state charter, splitting enforcement authority between state and federal regulators. A default civil penalty wielded by the Commissioner would apply directly only to state-chartered institutions; compliance by national banks would first require deference from their primary federal regulator, treating a non-uniform population of institutions as though it were uniform. Supervisory review avoids that problem by operating seamlessly across both charters, since each already has a designated primary examiner.

Third, any workable design must enlarge the action set available to institutions rather than reprice a fixed one. Notification alone does not stop funds from being paid out; intervention does. Pairing notification with hold authority gives institutions independent reason to comply with the notification duty, because the hold authority would be worth exercising on its own terms, a point outside this paper's static framework, which treats the action set as given.

B. The Design and Its Statutory Language

The design below picks up where the model leaves off. It has three elements, which the model shows must be added in the order listed.

Mandatory. Until the duty is mandatory, π = 0, and neither immunity nor enforcement consequences matter for the institution's decision-making.

Absolute. Until the enforcement consequence of notifying (or not) is stated in absolute terms, good faith remains in play. Leave the "s" term above in place, and you leave open the question of what happens to be litigated after the fact.

Some. The duty must carry some enforcement consequence, whether stated in terms of money (penalty) or job (supervisory jeopardy). Anything less is a mandate only in name: expected cost of silence remains zero, and we are right back to the baseline problem statement.

Examination-based enforcement can satisfy that third condition without posting a civil penalty. See discussion supra. But it must strictly exceed c_a, so Proposition 1 tells us the resulting expected sanction associated with failing to notify only needs to exceed $150 to change behavior. Below is calibrated but deliberately unstyled statutory language sketching what such a design would look like, cribbed loosely from the Legislature's own statutes imposing (but not calibrating) very similar duties on broker-dealers and investment advisers at N.J.S.A. 49:3-86 to -88.

a. Temporary hold. A financial institution may place a temporary hold on a transaction or disbursement involving a senior customer or vulnerable customer where a qualified employee reasonably believes the transaction may result in financial exploitation of the customer. A hold placed under this subsection need not be conditioned on the completion of an internal review process and may be placed immediately.

b. Notification to the Department and adult protective services. A financial institution that places a hold under subsection a. of this section shall, within [x] days of placing the hold, notify the Department of Banking and Insurance and the applicable county adult protective services provider of the following information: (1) the fact that a hold has been placed; and (2) the reason suspected exploitation was believed to have occurred. Absent the placement of a hold pursuant to subsection a. of this section, any notification by a financial institution to adult protective services regarding suspected exploitation shall be permissive.

c. Notification to the customer. A financial institution that places a hold under subsection a. of this section shall notify the customer on whom the hold is placed of the following information within [x] days of the placement of the hold: (1) the fact that a hold has been placed on a transaction involving that customer; and (2) the reason the hold was placed. A financial institution need not provide notice under this subsection to any person that the financial institution reasonably believes is involved in the suspected exploitation.

d. Immunity. From and after the date of enactment of this act, a financial institution and any officer or employee thereof shall be immune from civil and administrative liability arising from the action of that institution or individual in placing a hold, making or declining to make a notification, or declining to place a hold under this section, provided that the individual completed training as prescribed by the Commissioner.

e. Condition of deposit. Without imposing a new condition of deposit, the Department of Banking and Insurance shall review compliance with this section in the ordinary course of examination.

f. No private right of action. Nothing in this section shall create any civil penalty or private right of action.

C. What a design of this kind would not do

Two caveats. First, this design preserves institutional discretion over the triggering act: nothing compels intervention or creates a duty to police exploitation, and notice remains optional wherever no hold is placed. On the facts of Lucca itself, an institution that detected exploitation, logged it internally, and placed no hold still would not have been required to refer, exactly as the model predicts; if the triggering act stays optional and unenforced, π × H on that channel remains zero, and Section VII's analysis carries through unchanged. What the design changes is the payoff to the optional act itself, by giving institutions an authority they lack today, one Wells Fargo had no lawful means to exercise in Lucca. How often that authority would actually be used is an empirical question this paper cannot answer.

Second, one response suggests itself since the Lucca defendant was a national bank: the National Bank Act preempts state laws that "impair" or "significantly interfere" with a national bank's powers, as construed by Barnett Bank of Marion County, N.A. v. Nelson, 517 U.S. 25 (1996), and narrowed by Dodd-Frank section 1044 to state laws whose discriminatory effect or interference is specific to that state law. A statute like the one sketched above is a poor preemption candidate: it reaches all financial institutions, not just national banks; grants authority rather than removing it; creates no private right of action; and yields to federal law and the primary federal regulator for federally chartered institutions, while preserving SAR confidentiality entirely. This jurisdictional asymmetry means that the Bureau of Securities can supervise state intermediaries directly while depository supervision is split, which may also explain why the Legislature reached broker-dealers in 2019 but left depositories untouched.

IX. Key Governance Tensions and the Future Trajectory

A. Two Tensions That Must Be Resolved

Two core tensions underlie the future trajectory for EFE policy: how much to protect seniors versus preserve their autonomy, and how to regulate compliance costs without pushing seniors toward less-regulated, riskier alternatives.

Autonomy vs. Protection: The central question is whether to interfere with seniors' freedom of choice in order to protect them from fraud. Thaler and Sunstein propose a middle ground, using nudge theory to offer a protective service through government or healthcare providers that a senior may opt out of, with third-party monitoring of arrangements the government contracts. That preserves both protection for those who want it and freedom for those who find it intrusive. Disability rights advocates argue strenuously against any default protective system, contending that treating seniors as incompetent by default reinforces institutional ableism.

Compliance Costs vs. Financial Inclusion: Serving senior customers carries regulatory obligations that raise costs. If those costs mount, banks will curtail services to older people, leaving seniors with prepaid cards, wire services, and crypto, so regulation meant to protect them would leave them more exposed.

B. How the Proposed Design Answers Them

Both tensions bear on the proposal in Section VIII. On autonomy, the proposal tilts further toward protection than the permissive status quo in two distinct ways: notice sends skepticism outside the institution for another actor to weigh, while intervention lets the institution act unilaterally on the customer's behalf, the more serious step. The design authorizes both, but bounds the second rather than leaving it open-ended: it terminates on a short, fixed schedule absent an agency request or court order, cannot be renewed indefinitely without judicial involvement, and is subject to prompt internal review.

Two features of the design respond directly to the autonomy objection: the institution must inform the customer of the hold and its reason within a short fixed period, so the person whose funds are restrained learns of the suspicion directly rather than through a failed transaction; and third-party notice is forbidden to anyone the institution reasonably believes is involved in the exploitation, addressing the trusted-relationship case Section IV identifies as the costliest and least visible form of abuse. Whether these safeguards are adequate in practice is a fair question; that the design confronts the objection rather than ignoring it is not.

On over-reporting, the model constrains the design only partially, and less precisely than a preset civil penalty would. Proposition 1 requires the expected cost of examination to exceed c_a for any interior threshold to exist, but says nothing about where between c_a and infinity it falls. Reaching q_social would take an expected cost near $4,410 at π = 0.15, well above the roughly $150 the existence condition requires. Because an examination-based design sets π through the intensity of supervisory inquiry rather than a figure legislators write down, over-reporting protection cannot be pinned down as tightly here. That limitation errs toward safety: across the range between $150 and $4,410, an incompletely specified examination regime is likelier to generate too little expected cost than too much, so its dominant risk runs toward under-reporting.

Two further features bound whatever over-reporting risk remains. First, the social threshold already reflects the cost of a Type I error, since c_f enters q_social directly; even a regime that hit the social threshold precisely would not be "too protective" by this model's own accounting. Second, the design does not tie examination frequency to an institution's propensity to place holds, the mechanism by which over-reporting could compound within an institution over time, a point beyond this static framework. Supervisors implementing the design should nonetheless watch for it.

Regarding compliance cost, that concern is valid, and this paper is agnostic. Smaller firms will find the new requirement most burdensome, and, as Section II.C notes, may also be the firms whose customer relationships make detection most likely, so a clumsy mandate risks suppressing the very transactions it means to surface. Any enacted statute should pair the duty with a safe harbor or a tiered compliance schedule keyed to asset size, a design question this paper leaves open.

X. Conclusion

EFE is not a failure by seniors to stay informed, nor simply a failure of financial guardians. It is a systemic failure with a known legal cause: banks have no duty to report elder financial abuse. New Jersey's statute, and the Lucca decision construing it, makes that concrete rather than hypothetical. The model shows this is not a near miss but a hole in the system itself, one no enforcement effort will plug on its own and that broader immunity will not fix. Any solution faces two tensions: protecting seniors against respecting their autonomy, and controlling compliance costs without pushing seniors toward unregulated predatory services. Closing the reporting-duty gap will not end EFE, but it does resolve the part lawmakers can solve outright.

Research into the biology of EFE explains individual harm; economic research shows broad economic losses; and regulatory analysis shows that existing policy and infrastructure require drastic reform. Taken together, these perspectives make clear that EFE is a systemic issue, not an individual one that financial literacy can fix.

Methods Appendix

Measuring Reporting Incentive Through a Calibrated Threshold Model

This paper models a bank's reporting decision as a function of its exposure to statutory liability that the reader can directly observe. I follow Becker in thinking of deterrence as a function of the probability and magnitude of enforcement. Two threshold values were calculated for each of three counterfactual liability regimes, and are reported in Table A2: New Jersey's baseline permissive regime with good faith immunity and no penalty; New Jersey's baseline regime with absolute immunity replacing good faith immunity; and a mandatory-duty regime with absolute immunity and a statutory penalty. (These are variations on the parameters of the liability model, not the four statutory regimes described in Section VI. Those regimes are discussed there at length as a matter of law, rather than modeled separately.) It is the difference between the private and social thresholds, rather than either threshold value by itself, that is the subject of this paper.

Parameter Selection

Six inputs (L, r, c_a, c_f, s, D) and one legal fact (π) enter the model. Each is footnoted in the workbook's Sources tab with its citation, page number where available, and its status as sourced or assumed. The value of π is cited to the holding in Lucca. The other six were checked against primary sources (FinCEN reporting, FTC and AARP loss reporting, AML compliance-cost reporting) before being designated as assumptions.

Sourcing Rule

A parameter is marked sourced only if a primary source reports that exact number, not a loosely related or directionally consistent one; the rule was fixed before any parameter search began. Otherwise it is marked an assumption and bounded in the sensitivity analysis rather than left unlabeled. A directly reported figure still counts as an assumption when used as a proxy for something else. The recovery share r illustrates this: it is set to reported asset-recovery rates, the best available proxy for loss avoided through early intervention, but those rates condition on a recovery effort having started while r does not. That mismatch likely overstates r, so r is marked an assumption (proxy). A lower r would raise q_social and shrink the wedge, but leaves q_private and the central claim at π = 0 untouched, since r does not enter the private threshold.

Sensitivity Rule

L, r, and c_a were each swept independently over ranges fixed before the calibration was run: L from roughly half to nearly seven times its baseline value, r from about one-fifth to just over baseline, and c_a from about one-quarter to just over three times baseline. The wrongful-hold cost, c_f, was held at baseline rather than swept; because it appears in both the numerator and denominator of q_social, varying it shifts the social threshold without changing its sign, and it does not affect the paper's central finding at all, since that finding rests on the private threshold, whose ratio does not include c_f.

General Limitations

Four limitations bear on these results. First, litigation cost is assumed to fall privately on the bank rather than on society; if it carries a deadweight component, mandatory duty paired with absolute immunity becomes more attractive still, so the assumption is conservative. Second, the compliance officer's belief q is taken as given: the paper addresses how a rational bank behaves once it forms that belief, not how well banks form it. Third, the model is static, so it omits reputational effects, repeat play with regulators, and supervisory pressure exercised outside this liability regime.

Fourth, and most consequential for the size of the wedge, the model assumes the bank captures none of the loss that early intervention would prevent. There is no r × L term in the private expected-cost expression, reflecting current law that a receiving bank owes no duty to absorb losses from a duly authorized payment order, even one procured by fraud. If banks instead internalized some fraction of r × L, whether by statute or scheme rule, the private threshold would fall by that amount, closing part of the gap through a different mechanism than the reporting duty modeled here. That possibility is not modeled.

Verification Limitations

The parameters in this paper were compiled and coded by a single author, without independent cross-checking, which is a genuine methodological limitation relative to a multi-coder design. Readers validating a parameter should consult the original source in Table A1 directly rather than this paper's presentation. The author can provide the underlying workbook upon request.

Falsification Condition

The paper's central finding, that social and private reporting thresholds diverge under a permissive, no-liability regime, does not depend on the calibration: setting π = 0 in the expression for q_private simplifies it to 1 + c_a / (s × D), strictly greater than one for any strictly positive c_a and s × D. Because no plausible parameterization could close that gap while the statute remains permissive, the sensitivity analysis in Table A3 tests only the size of the social threshold, not the central result; s and D were not swept for the same reason.

Only two things could overturn this finding: a specification error in the derivation of q_private, or a demonstration that an omitted cost or benefit in the private expected-cost calculation is nonzero and large enough to change the reporting decision under a permissive regime. The likeliest candidate for the latter, discussed above, is the assumption that banks capture none of the loss L that early reporting would prevent.

Appendix Tables

Tables A1 through A3 below show, respectively, the model's parameter values and sources, the privately optimal reporting threshold for each of the three modeled liability schemes, and the sensitivity of the socially optimal threshold to its inputs. These are taken from the calibrated workbook provided in this appendix.

Works Cited

Barnett Bank of Marion County, N.A. v. Nelson. 517 U.S. 25, Supreme Court of the United States, 1996.

Becker, Gary S. "Crime and Punishment: An Economic Approach." Journal of Political Economy, vol. 76, no. 2, 1968, pp. 169-217.

Blackbird.AI. "AI-Powered Obituary Scams: The New Frontier in Targeted Phishing." Blackbird.AI, 20 May 2025, blackbird.ai/blog/ai-powered-obituary-scams-targeted-phishing/.

Button, Mark, and Cassandra Cross. Cyber Frauds, Scams and Their Victims. Routledge, 2017.

Cross, Cassandra, and Michael Kelly. "The Problem of 'White Noise': Examining Current Prevention Approaches to Online Fraud." Journal of Financial Crime, vol. 23, no. 4, 2016, pp. 806-18.

DeLiema, Marguerite. "Elder Fraud and Financial Exploitation: Application of Routine Activity Theory." The Gerontologist, vol. 58, no. 4, 2018, pp. 706-18, doi.org/10.1093/geront/gnw258.

Federal Trade Commission. Protecting Older Consumers 2024-2025: A Report of the Federal Trade Commission. 1 Dec. 2025, www.ftc.gov/reports/protecting-older-consumers-2024-2025-report-federal-trade-commission.

Fenton, Laura, et al. "Lower Entorhinal Cortex Thickness Is Associated with Greater Financial Exploitation Vulnerability in Cognitively Unimpaired Older Adults." Cerebral Cortex, vol. 34, no. 9, 2024, article bhae360, doi.org/10.1093/cercor/bhae360.

Financial Crimes Enforcement Network (FinCEN). "Elder Financial Exploitation: Threat Pattern & Trend Information, June 2022 to June 2023." Financial Trend Analysis, U.S. Department of the Treasury, Apr. 2024.

Financial Crimes Enforcement Network (FinCEN). "TD Bank Enforcement: Assessment of Monetary Penalty Against TD Bank N.A. for Historic AML Failures." U.S. Department of the Treasury, 2024.

Gotelaere, Sien, and Letizia Paoli. "Prevention and Control of Financial Fraud: A Scoping Review." European Journal on Criminal Policy and Research, vol. 31, 2022, pp. 1-21, doi.org/10.1007/s10610-022-09532-8.

Griffin, John M., and Kevin Mei. "How Do Crypto Flows Finance Slavery? The Economics of Pig Butchering." Working paper, University of Texas at Austin, McCombs School of Business, 2024.

Gunther, Jilenne. The Scope of Elder Financial Exploitation: What It Costs Victims. AARP Public Policy Institute, 2023, doi.org/10.26419/ppi.00194.001.

Interagency Statement on Elder Financial Exploitation. Board of Governors of the Federal Reserve System, Consumer Financial Protection Bureau, Federal Deposit Insurance Corporation, Financial Crimes Enforcement Network, National Credit Union Administration, Office of the Comptroller of the Currency, and state financial regulators, 4 Dec. 2024.

Kim, Dong-Hyeon, et al. "Population Aging and the Nexus between Financial Development and Wealth Inequality." International Review of Finance, vol. 25, no. 4, 2025, article e70048, doi.org/10.1111/irfi.70048.

Lachs, Mark S., and S. Duke Han. "Age-Associated Financial Vulnerability: An Emerging Public Health Issue." Annals of Internal Medicine, vol. 163, no. 11, 2015, pp. 877-78, doi.org/10.7326/M15-0882.

Lucca v. Wells Fargo Bank, N.A. 441 N.J. Super. 301, Law Div., 2015.

McAfee. Beware the Artificial Impostor: A McAfee Cybersecurity Artificial Intelligence Report. 1 May 2023, www.mcafee.com/content/dam/consumer/en-us/resources/cybersecurity/artificial-intelligence/rp-beware-the-artificial-impostor-report.pdf.

Modigliani, Franco, and Richard Brumberg. "Utility Analysis and the Consumption Function: An Interpretation of Cross-Section Data." Post-Keynesian Economics, 1954, pp. 388-436.

Nicholas, Lauren H., et al. "Financial Presentation of Alzheimer Disease and Related Dementias." JAMA Internal Medicine, vol. 181, no. 2, 2021, pp. 220-27, doi.org/10.1001/jamainternmed.2020.6432.

Prenzler, Tim. "What Works in Fraud Prevention: A Review of Real-World Intervention Projects." Journal of Criminological Research, Policy and Practice, vol. 6, no. 1, 2020, pp. 83-96.

Thaler, Richard H., and Cass R. Sunstein. Nudge: Improving Decisions about Health, Wealth, and Happiness. Yale University Press, 2008.