Digital technology has expanded commerce, communication and access to financial services, but it has also created opportunities for deception at scale. Online fraud occurs when digital systems, electronic communications or internet-based services are used to obtain money, property, services, credentials or another advantage through deception. Identity offences involve the unlawful acquisition, use, transfer or concealment of information that identifies or authenticates a person or organisation.

These offences are not merely technical incidents. They are forms of human-directed crime. The offender usually combines technology with persuasion, urgency, impersonation, authority, or emotional manipulation. Consequently, effective cyber-law practice requires both technical awareness and legal analysis.

Laws differ between jurisdictions. Common legal approaches use offences such as fraud, obtaining property by deception, forgery, unauthorised access, misuse of personal information, identity theft, computer-related forgery, money laundering and conspiracy. The precise offence, required mental element and available penalties must therefore be determined from the applicable national or regional law.

Learning Objectives

1. The Conceptual Structure of Online Fraud

deception or manipulation → victim reliance or system misuse → transfer, access or loss → benefit to offender or harm to victim

Not every offence contains every stage in the same form. For example, an attempted phishing attack may involve deception but no completed loss. Account takeover may involve unauthorised access even before money is withdrawn. Identity-document offences may be complete when false information is created or possessed, depending on the law.

1.1 Conduct and actus reus

The external element of an offence may include sending a deceptive message, creating a false website, entering another person’s account, using a stolen payment instrument, submitting false identity information, or inducing a transfer. Evidence may include emails, message headers, browser records, access logs, payment instructions, telephone recordings, device images and witness statements.

1.2 Mental element and mens rea

Many fraud offences require intention to deceive, knowledge that information is false, dishonesty, recklessness, or an intention to obtain a benefit or cause a loss. Mere error is not normally equivalent to criminal deception. The prosecution generally must establish the required mental state beyond the applicable criminal standard of proof.

1.3 Causation, benefit and loss

Loss may be direct, such as a transferred sum; consequential, such as recovery costs; or non-financial, such as reputational injury, emotional distress and loss of privacy. Some laws also criminalise conduct that creates a serious risk even when no completed loss occurs.

2. Major Forms of Online Fraud and Identity Offending

2.1 Phishing

Phishing is a deceptive attempt to obtain credentials, payment information, personal data or access by pretending to be a trusted person or service. It may use email, text messages, social media, telephone calls or fraudulent websites. Spear-phishing targets a particular person or organisation using personalised information. Whaling targets senior executives or high-value employees.

Typical warning signs include an unexpected request, urgent language, an unfamiliar domain, a shortened link, an attachment, a request to bypass normal procedures, or a demand for a password or one-time code. However, appearance alone is not decisive: sophisticated messages may use correct branding and publicly available details.

Phishing can support several offences: fraud, attempted fraud, unauthorised access, unlawful interception, identity-data misuse, malware offences and conspiracy. The legal classification depends on the conduct and local legislation.

2.2 Business email compromise

Business email compromise (BEC) is a targeted scheme in which an offender impersonates an executive, supplier, customer or employee, or compromises a genuine mailbox. The offender then requests payment, changes bank details, demands confidential information or directs a payroll transaction.

BEC is particularly dangerous because the message may come from a legitimate account. The key control is therefore independent verification, not visual inspection alone. A payment instruction should be confirmed using a previously trusted telephone number or established channel, especially when bank details, urgency or secrecy are involved.

2.3 Impersonation

Impersonation occurs when a person falsely presents themselves as another person, organisation or authority. It may be used to obtain money, gain access, damage reputation, manipulate a transaction or evade detection. Impersonation may overlap with fraud, forgery, unauthorised use of identity credentials, harassment or unlawful representation of a public official.

A legal analysis should distinguish parody, legitimate pseudonyms, unauthorised representation and fraudulent impersonation. The decisive issues commonly include falsity, intent, harm, reliance and whether a legally protected identity or authority was misused.

2.4 Identity theft and identity fraud

Identity theft is the acquisition or possession of another person’s identifying information without lawful authority. Identity fraud is the use of that information to deceive or obtain a benefit. Information may include a name, identification number, address, date of birth, biometric identifier, account credential or digital token.

Identity information is valuable because it can be reused across services. A single stolen password may expose email, financial accounts, stored documents and recovery channels. Identity offences may be committed through data breaches, discarded documents, malware, insider misuse, social media research or deception of customer-support staff.

2.5 Payment fraud

Payment fraud includes unauthorised card transactions, fraudulent electronic transfers, fake payment confirmations, alteration of payment details and misuse of mobile-payment accounts. Some cases involve stolen credentials; others exploit weaknesses in approval procedures or persuade an authorised employee to make a transaction.

The legal consequences can affect the payer, recipient, bank, payment processor and intermediary accounts. Prompt notification is important because financial institutions may be able to recall or freeze funds, preserve records and protect other customers.

2.6 Account takeover

Account takeover occurs when an offender gains control of a victim’s online account. Common routes include password reuse, credential stuffing, phishing, malware, SIM-swap abuse, stolen session tokens and manipulation of account-recovery procedures.

The consequences may include unauthorised purchases, theft of stored funds, access to private communications, impersonation of the victim and attacks against the victim’s contacts. Account takeover is often both an access offence and a means of committing further fraud.

2.7 Auction and marketplace scams

Auction scams exploit online marketplaces. Examples include non-delivery after payment, counterfeit goods, false bidding, overpayment schemes, payment outside the platform, fake escrow services and requests for gift cards or cryptocurrency. A seller may misrepresent ownership, condition or availability; a buyer may send a fraudulent payment notice or reverse a payment after receiving goods.

The presence of a marketplace does not automatically establish that the platform is legally responsible for the fraud. Responsibility depends on the platform’s role, representations, terms, statutory duties and knowledge. Users should preserve the listing, messages, payment records, delivery information and account identifiers.

2.8 Social engineering

Social engineering is the manipulation of human behaviour to obtain information, access or action. Techniques include pretexting, baiting, quid pro quo, intimidation, authority claims, scarcity, romance fraud and technical-support scams. Social engineering is a method that may be used in many offences rather than a single universal offence.

The offender may exploit cognitive shortcuts: people tend to trust authority, respond to urgency, reciprocate favours and follow familiar routines. Training should therefore develop verification habits, not merely teach users to identify suspicious graphics.

3. A Framework for Analysing an Alleged Offence

Question	Evidence to consider
Identity	Who sent, received, controlled or benefited from the communication or account?
Representation	What fact, authority or identity was asserted?
Falsity or lack of authority	Why was the representation false, misleading or unauthorised?
State of mind	What shows knowledge, intention, dishonesty or recklessness?
Reliance and action	Did the victim or system act because of the deception?
Result	What property, access, information, benefit or risk resulted?

This framework prevents premature conclusions. A suspicious message may be an attempted offence, a harmless error, a policy violation or evidence of a wider conspiracy. Classification must follow evidence and legal elements.

4. Victim Harm and Wider Impact

The immediate financial loss may be only one part of the harm. Victims can experience:

Organisations may face regulatory scrutiny, contractual claims, notification duties and loss of trust. Small businesses are particularly vulnerable because payment approval may depend on a few individuals and recovery resources may be limited.

Victim-blaming is inappropriate. Fraud succeeds through deliberate offender behaviour and often through system weaknesses. A victim’s error may be relevant to prevention or civil recovery, but it does not by itself excuse criminal conduct.

5. Prevention and Basic Controls

5.1 Individual controls

Individuals should use unique passwords with a reputable password manager, enable multi-factor authentication, apply updates, avoid entering credentials through unsolicited links, and verify unusual requests through an independent channel. They should review account alerts, limit public exposure of personal details and avoid sending identity documents unless the recipient and purpose are verified.

Multi-factor authentication is valuable but not invulnerable. Attackers may steal session cookies, persuade users to approve a fraudulent login, intercept recovery processes or exploit weak fallback methods. Stronger methods, such as phishing-resistant security keys, provide better protection for high-risk accounts.

5.2 Organisational controls

Email authentication technologies can reduce domain spoofing, but they do not prevent compromise of a legitimate mailbox or deception through look-alike domains. Controls should therefore be layered.

5.3 Incident response

When fraud is suspected, the organisation should preserve evidence, contact the bank or payment provider immediately, secure affected accounts, revoke sessions and tokens, reset credentials, identify related victims and report to the appropriate authority. Investigators should avoid altering devices unnecessarily and should document who collected each item, when it was collected and how it was preserved.

A response should balance containment with evidence preservation. Disconnecting a device may stop ongoing harm but can also affect volatile evidence. Technical decisions should be made by competent personnel and documented.

6. Evidence, Investigation and Jurisdiction

Digital evidence is fragile, duplicable and distributed across jurisdictions. Relevant material may include message metadata, authentication logs, IP records, device artefacts, cloud-provider records, payment trails, cryptocurrency exchange records, CCTV and witness accounts. An IP address usually identifies a connection or service, not automatically a particular human offender.

Investigators must consider authenticity, integrity, relevance, reliability, lawful collection and continuity of possession. Screenshots can be useful but may omit metadata and context. Original records or properly obtained provider records are generally stronger.

Cross-border cases may require preservation requests, mutual legal assistance, production orders or cooperation with service providers. Delay can result in deletion under retention policies, movement of funds and further victimisation.

7. Regulatory, Ethical and Governance Issues

Fraud prevention involves personal data and behavioural monitoring. Organisations should collect only information necessary for a legitimate purpose, restrict access, retain records for an appropriate period and protect them from secondary misuse. Monitoring that is excessive, discriminatory or opaque can create legal and ethical problems.

Organisations should communicate incidents honestly, avoid concealing material facts and provide practical support to affected people. Automated fraud systems may produce false positives or disproportionately affect particular groups. Human review, explanation, appeal and periodic testing are important safeguards.

Artificial intelligence can help identify unusual transactions, generate realistic phishing messages and imitate voices or images. Deepfakes and generative AI increase the credibility of impersonation, but they do not remove the need for independent verification. AI-generated content should be treated as potentially synthetic, and AI detection tools should not be regarded as conclusive evidence.

8. Illustrative Case Study: The Changed Supplier Account

Background

A medium-sized importer receives an email apparently from a long-standing supplier. The message states that the supplier has changed banks and requests that the next invoice be paid into a new account. The email uses the supplier’s logo and correct invoice number.

Problem

An accounts employee updates the payment record without calling the supplier. The company transfers the equivalent of 18,000 currency units. Two days later, the genuine supplier reports non-payment.

Analysis

The facts suggest BEC or a look-alike-domain attack. Investigators should examine the sender domain, message headers, login records, mailbox rules, forwarding settings, endpoint activity and the bank-account trail. They should determine whether the supplier’s or importer’s mailbox was compromised, whether the employee acted under a false representation, and whether the offender intended to obtain the money.

The conduct may support fraud, unauthorised access, identity misuse, money-laundering or conspiracy charges, depending on the jurisdiction. The employee may have breached internal policy, but an honest mistake is not automatically criminal. The legal analysis must distinguish negligence from intentional participation.

Approach and outcome

The importer immediately contacts its bank, requests a recall, freezes affected accounts, preserves email records and reports the matter. It then introduces mandatory callback verification and dual approval for changed payment instructions. The bank recovers part of the funds before onward transfer. A forensic review finds that the attacker created a mailbox forwarding rule after obtaining a password through a targeted phishing message.

Learning points

The genuine appearance of a message is not proof of authenticity. Payment changes require an independent channel, and account security must include monitoring for forwarding rules and unusual login activity. Early reporting improves the chance of recovery and helps prevent related attacks.

9. Limitations and Common Misunderstandings

First, no single control eliminates fraud. MFA, filtering and user education reduce risk but do not guarantee prevention. Second, not every unauthorised transaction is identity theft; the relevant offence may instead be payment fraud, access crime or breach of contract. Third, a victim’s use of a password or approval does not necessarily make the transaction authorised if the approval was induced by deception. Fourth, a successful prosecution cannot be assumed merely because money was lost; the required elements and admissible evidence must still be proved.

Chapter Summary

Online fraud and identity offences combine deception, technology and human behaviour. Phishing, BEC, impersonation, identity theft, payment fraud, account takeover, marketplace scams and social engineering differ in method but often share the goals of obtaining money, access, information or influence. Legal analysis should identify the representation, falsity or lack of authority, mental element, reliance, result and evidence. Harm includes financial loss, privacy invasion, emotional distress, reputational damage and organisational disruption. Effective prevention uses layered controls: independent verification, MFA, least privilege, payment segregation, monitoring, staff training and rapid incident response. Evidence must be preserved lawfully, and privacy, fairness and proportionality must guide fraud monitoring.

Key Terms

Phishing: Deceptive communication intended to obtain information, credentials or access.

Business email compromise: Fraud involving an impersonated or compromised business email account.

Impersonation: False representation of another person, organisation or authority.

Payment fraud: Unauthorised or deceptive activity involving a payment transaction.

Social engineering: Manipulation of people to obtain information, access or action.

Credential stuffing: Automated use of previously exposed username-password pairs.

Multi-factor authentication: Authentication using two or more distinct factor types.

Least privilege: Limiting access to what a user or system needs for its function.

Business email compromise: A targeted form of fraud using trusted business communications.

Digital evidence: Electronically stored information relevant to an investigation.

Chain of custody: Documented history of evidence collection, handling and storage.

Deepfake: Synthetic audio, image or video designed to resemble a real person or event.

Social engineering: Psychological manipulation used to influence a person’s behaviour.

Review Questions

Short Answer Questions

Long Answer Questions

Analytical / Application Questions

Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes business email compromise from ordinary mass phishing?

B. It targets a business transaction through impersonated or compromised trusted communications

Correct Answer: B. It targets a business transaction through impersonated or compromised trusted communications

Question 2

What is the best basic control when a supplier requests a change to bank details?

Correct Answer: C. Verify it through a previously trusted independent channel

Question 3

A. Identity theft concerns unlawful acquisition of identity information, while identity fraud concerns deceptive use of it

B. Identity theft always requires a financial loss, while identity fraud never does

Correct Answer: A. Identity theft concerns unlawful acquisition of identity information, while identity fraud concerns deceptive use of it

Question 4

B. Gaining unauthorised control of a victim’s email account and changing its recovery address

Correct Answer: B. Gaining unauthorised control of a victim’s email account and changing its recovery address

Question 5

B. Attackers may still exploit stolen sessions, recovery weaknesses or approval deception

Correct Answer: B. Attackers may still exploit stolen sessions, recovery weaknesses or approval deception

Question 6

Which item is most directly relevant to establishing the continuity of digital evidence?

Question 7

An online seller receives payment outside a marketplace and sends no goods. Which description is most applicable?

Question 8

Correct Answer: B. It identifies a connection or service and requires contextual evidence

Question 9

Which control best reduces the risk that one employee can redirect a high-value payment without review?

Question 10

Why should organisations be cautious when using automated fraud-detection systems?

Correct Answer: B. They may create false positives, privacy risks or discriminatory outcomes

Chapter 4 Online Fraud, Deception and Identity Offences

Online Fraud, Deception and Identity Offences

Introduction and Context