I've seen de-risking first hand at a big bank. Scraping Backpage for phone numbers, then just closing the account if is associated with a customer phone number. No more investigation than that.