The Conventional Wisdom
Fraud prevention teams often blame privacy regulations for their inability to share scam intelligence quickly. They argue that laws like PIPEDA in Canada, GDPR in Europe, and state-level privacy laws in the US prevent banks from informing telecoms about scam-related phone numbers. Telecoms can't alert social platforms about accounts running scams. The common refrain is that "regulatory constraints" allow fraudsters to outpace defenders.
Jennifer Quaid, executive director at the Canadian Cyber Threat Exchange, noted that privacy and regulatory environments hinder real-time information sharing among banks, telecoms, and platforms. The Canadian Anti-Scam Coalition attempts to bridge these sectors, but participants still struggle with what they can legally share.
The narrative is simple: privacy laws protect criminals. If we could just loosen those rules, we'd stop more scams.
Why We Disagree
Privacy regulations aren't the main obstacle to effective scam prevention. Organizational inertia is.
Most institutions haven't fully utilized what they can share under current frameworks. You don't need to share full customer profiles to exchange fraud indicators. You can share:
- Phone number hash values that match across systems without exposing the actual number
- Transaction pattern signatures that flag anomalies without revealing account details
- Domain reputation scores and URL patterns from phishing attempts
- Device fingerprints and IP ranges associated with account takeover attempts
These methods are compliant today. Yet most fraud prevention teams still rely on emailing spreadsheets with redacted data and waiting 48 hours for a response while scammers move on.
The real barrier isn't legal. It's technical debt, procurement timelines, and risk committees that won't approve API connections between institutions. It's fraud analysts who've never collaborated with telecom counterparts. It's the lack of standardized data formats that would allow a bank's fraud signal to automatically update a payment provider's risk score.
The Evidence
Consider where cross-sector intelligence sharing works. Financial Intelligence Units receive Suspicious Activity Reports from thousands of institutions and redistribute sanitized intelligence back to the field. They operate within existing privacy frameworks by focusing on patterns and indicators, not raw customer data.
The FS-ISAC operates a global threat intelligence platform where banks share Indicators of Compromise without exposing customer information. Participants exchange malware signatures, phishing domains, and attack methodologies in near real-time. No privacy law prevents this.
The problem Quaid identifies is real: AI is scraping social media to create personalized fraud schemes, and fraudsters adapt faster than institutional partnerships can form. But that's a speed problem, not a permission problem.
When institutions say they "can't share" scam data, they often mean they haven't built the infrastructure to share it safely. They haven't tokenized phone numbers into searchable hashes. They haven't implemented secure multi-party computation that lets two organizations query overlapping data without either side seeing the other's full dataset. They haven't agreed on taxonomy, one institution's "account takeover" is another's "unauthorized access event," and systems can't reconcile the difference.
What to Do Instead
Start with indicator-level sharing, not identity-level sharing. Your fraud team should be able to answer: "Have we seen this device fingerprint before?" without needing to know whose account it touched at another institution.
Build a shared threat taxonomy with your immediate counterparties. If you're a bank working with a telecom, agree on 15 scam types you'll both track the same way. Define what constitutes a "confidence score" for a fraud indicator. Standardize the data structure so automated systems can ingest signals without human translation.
Implement privacy-enhancing technologies that already exist:
- Homomorphic encryption lets you query encrypted datasets without decrypting them
- Secure enclaves process sensitive matching operations without exposing data to either party
- Differential privacy adds mathematical noise that preserves statistical patterns while protecting individuals
None of these require regulatory reform. They require budget allocation and executive sponsorship.
Join or form a sector-specific information sharing organization. If you're in payments, the Canadian Anti-Scam Coalition and similar groups in other jurisdictions provide legal frameworks for sharing threat intelligence. These consortiums have already negotiated the privacy boundaries, you don't need to reinvent them.
Measure your intelligence latency. How long does it take from when your fraud team identifies a new scam pattern to when that intelligence reaches your partner institutions? If the answer is "we don't know" or "more than 24 hours," you have an operational problem, not a legal one.
When the Conventional Wisdom Is Right
Privacy regulations do create legitimate constraints in specific scenarios. You can't share a customer's transaction history with a telecom just because the customer called from a suspicious number. You can't pool raw call detail records with bank transaction logs without explicit consent and a clear legal basis.
Cross-border sharing gets complicated fast. A Canadian bank sharing fraud data with a US payment processor needs to navigate PIPEDA's adequacy requirements. A European institution faces GDPR's restrictions on transfers outside the EEA. These aren't trivial obstacles.
And some scam prevention really does require identity-level coordination. If you're trying to stop a money mule network, you need to know that the same person opened accounts at three banks using different addresses. Privacy-preserving techniques can't solve every use case.
The conventional wisdom is right when institutions have already implemented indicator-level sharing, exhausted privacy-enhancing technologies, and still hit regulatory walls on specific high-value intelligence. But most organizations aren't there yet. They're still treating fraud intelligence like classified documents instead of building systems that share signals automatically.
If your fraud prevention strategy depends on regulatory reform before you can share scam data effectively, you're giving fraudsters an 18-month head start while you wait for laws to change. Build the pipes now. Use the permissions you already have. Then advocate for expanded authority from a position of demonstrated capability rather than hypothetical need.
