The Fraud Prevention Officer Who Became the Whistleblower

The former head of scam prevention at JPMorgan Chase became a whistleblower. That is the kind of irony that doesn't usually show up in bank press releases, which is probably why it took a Wall Street Journal report today to surface it.

Christy Lillie was hired by JPMorgan in 2021 to strengthen the bank's defenses against the scam epidemic that has been eating through American bank accounts. She spent time on the problem, found what she described as serious deficiencies, raised them internally, and eventually went to the Justice Department and Treasury. Federal prosecutors in Manhattan reviewed her claims earlier this year. The WSJ reports she told them that JPMorgan executives ignored the problems she flagged and improperly denied more than $100 million in reimbursements to customers whose money was stolen.

JPMorgan, for what it's worth, says the claims have no merit. A spokeswoman told the WSJ the bank reviewed the concerns and found no evidence of wrongdoing. Prosecutors haven't alleged any wrongdoing either, and it's not clear they're still looking into it. The Trump Justice Department has pulled back from a lot of white-collar enforcement, so reviews don't automatically become indictments.

But the actual mechanism at the center of Lillie's claims is the interesting part, because it has nothing to do with whether she's right or wrong about specific managers. It's about a classification boundary that every bank in America is navigating right now, and it's worth a lot of money on one side and the other.

The basic plumbing comes from a 1978 law called the Electronic Fund Transfer Act. It requires banks to reimburse customers when unauthorized transactions hit their accounts - someone steals your account credentials and moves money without you knowing. That's fraud. The bank eats the loss.

But the law doesn't cover scams. If you are tricked into sending money yourself - even if the person on the other end is a professional criminal operating out of a call center in Southeast Asia - that's technically an authorized transaction. Under the letter of the law, the customer pays.

The problem, which Lillie's lawyer described in a February letter to multiple Senate committees, is that the boundary between these two categories is blurry in practice. A scammer might break into your account without authorization, then later convince you to voluntarily send a payment. Is that fraud or a scam? JPMorgan's practice, according to the letter, was to classify these hybrid cases as scams and refuse to reimburse. Other large banks, the letter says, have acknowledged since 2021 that they are required to reimburse customers in these situations. Lillie's internal team apparently calculated that changing JPMorgan's policy would cost at least $100 million.

The simplest model is: draw the line one way, and the bank absorbs tens of millions in losses. Draw it the other way, and the customer does. The classification isn't just an accounting exercise. It's a balance sheet decision dressed up as a legal interpretation.

This is old banking logic in a new costume. Banks have always had a category problem when the law covers one type of loss but not another. The difference now is the scale. Scammers are sophisticated, Americans lose tens of billions a year, and the losses are accelerating. The 1978 framework was built for stolen credit cards, not for romance scams and fake tech support calls that walk customers through draining their own accounts.

The whistleblower machinery around this is also worth a look. Lillie disclosed to her supervisors that she had become a whistleblower last year, was placed on involuntary paid administrative leave in October 2025, and later left the bank. She's now represented by Phillips & Cohen, one of the most active whistleblower law firms in the country. Her lawyers met for hours with the Justice Department and Treasury to walk through her disclosures.

JPMorgan has a relationship with whistleblower enforcement that predates this story by years. In January 2024, the SEC fined JPMorgan Securities $18 million for requiring retail clients to sign confidentiality agreements that effectively barred them from voluntarily contacting the SEC. The bank had put hundreds of customers in the position of choosing between getting reimbursed for a problem and being able to report potential securities violations. That was illegal under SEC whistleblower protection rules. The firm settled without admitting or denying the findings.

And going back further, the SEC paid out $50 million in whistleblower awards related to JPMorgan in 2019, including a $37 million award to one whistleblower that was the third-largest individual SEC whistleblower payout at the time. The pattern isn't unusual in the way that most banks have been hit by whistleblower actions. It's more that JPMorgan keeps finding itself on the receiving end. That doesn't prove anything about this particular case, but it does suggest the bank's internal culture around pushing back on compliance and disclosure claims is a known stress point.

Where this goes from here depends on what kind of case prosecutors think they have. The WSJ article doesn't allege that JPMorgan broke any specific law in classifying hybrid cases as scams. It's possible the legal boundary is genuinely ambiguous and different banks read it differently. It's also possible that Lillie's claims about internal cost estimates and deliberate policy choices are harder to prove than they sound.

The structural implication doesn't depend on the outcome of this investigation. The classification gap between fraud and scam is real, it's growing, and it's going to keep producing losses that the current legal framework doesn't clearly assign. Banks have been sitting in the zone between "we're not legally required to pay" and "our customers are losing hundreds of thousands of dollars on our platforms." That's an unstable place to be, even if the law hasn't caught up yet.

A few state-level lawsuits are already pushing on this - a New Jersey court recently refused to dismiss a case where a bank allegedly failed to question suspicious wire transfers totaling $390,000 from an elderly customer, and a New York judge let a case against Zelle's operator move forward on fraud-failure claims. The argument from both sides of the industry is the same as it always is: banks say customers should be more careful, customers and their lawyers say banks have a responsibility to slow things down when the red flags are obvious.

The stock is sitting around $359, near its 52-week high, up roughly 11% year-to-date. Nobody in the market is pricing this whistleblower review into the share price, and it wouldn't be the biggest risk to the bank's franchise even if the claims were fully substantiated. But the underlying mechanism - a classification boundary between fraud and scam that's worth tens of millions to one side and total loss to the other - is the kind of thing that tends to produce regulatory action eventually, not because any one bank is doing something clearly illegal, but because the gap itself becomes politically unsustainable.

The machine, stripped down: a 1978 law that covers stolen credentials but not social engineering, a legal gray zone worth at least $100 million per bank, and a former fraud-prevention executive who decided the classification system itself was the problem.