Banking Threat Landscape and Fraud Typologies

Introduction

Banking institutions operate within a hostile and rapidly changing environment. They hold valuable financial assets, process high volumes of transactions, maintain sensitive identity data, and provide services through interconnected digital channels. These characteristics make banks attractive to organised crime groups, nation-state actors, opportunistic attackers, dishonest employees, professional fraud networks and individual scammers.

Cybersecurity and fraud are closely related but not identical. Cybersecurity primarily protects the confidentiality, integrity and availability of systems and information. Fraud concerns intentional deception or abuse designed to obtain financial or other unlawful advantage. A single incident may involve both: a criminal may compromise a customer’s device, impersonate the customer and then initiate fraudulent payments. Effective banking risk management therefore requires an integrated view of technology, human behaviour, transactions, identity, governance and criminal organisation.

This chapter analyses the principal actors, motivations and attack chains affecting banking. It then examines major fraud typologies, including phishing, malware, ransomware, account takeover, payment and card fraud, application fraud, synthetic identity, authorised push-payment scams, mule networks and insider fraud. The emphasis is not merely on identifying individual schemes, but on understanding how they connect across the fraud lifecycle.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Classify major banking threat actors and explain their motivations.
2. Analyse cyberattack and fraud attack chains from preparation to monetisation.
3. Distinguish major banking fraud typologies and identify their indicators.
4. Explain how identity compromise, social engineering, malware and payment abuse interact.
5. Evaluate the role of transaction monitoring, authentication, behavioural analytics and intelligence sharing.
6. Assess governance, ethical and regulatory issues in fraud prevention.
7. Recommend proportionate controls for customers, banks, payment providers and employees.

1. The banking threat landscape

1.1 Why banks are targeted

Banks combine four characteristics that increase their attractiveness to criminals:

• Value concentration: deposits, credit facilities, payment instruments and securities are valuable targets.
• Information concentration: banks hold identity, account, salary, credit and transaction data.
• Connectivity: mobile applications, APIs, payment networks, cloud services, fintech partners and telecommunications systems create many interdependencies.
• Trust and urgency: customers expect rapid service and often respond quickly to messages that appear to come from their bank, employer, supplier or family member.

The attack surface includes customer devices, online and mobile banking, call centres, branches, ATMs, payment terminals, card processors, application programming interfaces, third-party vendors, employee accounts and internal administrative systems. Risk is consequently systemic: a weakness at a telecommunications provider, identity broker or software supplier may affect many institutions simultaneously.

1.2 Threat actors

Threat actors differ in capability, access, objectives and tolerance for risk. The categories overlap; a criminal group may purchase access from one actor and use another group to launder the proceeds.

Threat intelligence should examine not only who attacks, but also the division of labour. Modern criminal ecosystems may separate initial access, credential harvesting, account takeover, payment initiation and laundering. This specialisation lowers the technical barrier to entry and increases scale.

1.3 Motivations and risk trade-offs

Financially motivated actors usually seek a reliable conversion of access into cash. They may prefer low-noise attacks, such as manipulating a small number of high-value payments, or high-volume automated attacks against many accounts. Nation-state actors may value persistence and intelligence more than immediate theft. Insiders may exploit legitimate access because it reduces the need to bypass technical controls.

Attackers also manage operational risk. They may test stolen credentials on low-value services, avoid unusual login times, use legitimate remote-access tools, or divide proceeds among many accounts. Consequently, a single indicator rarely proves fraud. Detection requires combining signals across identity, device, behaviour, transaction context and network relationships.

2. The attack chain in banking fraud

A useful analytical model views an incident as a sequence rather than an isolated event:

1. Target selection: identifying a bank, customer segment, employee, merchant or supplier.
2. Reconnaissance: collecting names, roles, phone numbers, account details, social-media information or technical data.
3. Initial access: phishing, credential stuffing, malware, exploitation of a vulnerability, insider assistance or fraudulent application.
4. Persistence and discovery: maintaining access and learning account balances, payment limits, beneficiaries and authentication procedures.
5. Trust manipulation: impersonating a bank, executive, supplier, relative or customer.
6. Action: changing contact details, adding a beneficiary, applying for credit, withdrawing cash or initiating a transfer.
7. Monetisation: moving funds through mule accounts, cryptoasset exchanges, cash withdrawals, purchases or international transfers.
8. Concealment and adaptation: deleting evidence, abandoning accounts, changing infrastructure or disputing the transaction.

This chain can be interrupted at multiple points. Strong authentication may reduce unauthorised access, but it may not prevent a customer from authorising a scam payment. Transaction monitoring may detect the payment, while beneficiary intelligence may identify the mule account. Recovery controls may freeze funds after the transaction, even when preventive controls failed.

A practical distinction is between unauthorised fraud and authorised fraud. In unauthorised fraud, the genuine customer did not approve the transaction, such as a criminal using stolen credentials. In authorised fraud, the customer technically approves the payment but does so because of deception, coercion or manipulation. The distinction is important for investigation, customer treatment, liability and regulatory reporting.

3. Social engineering and phishing

3.1 Phishing

Phishing is the use of deceptive communications or interfaces to induce a person to disclose information, install software, surrender control or make a payment. It may occur through email, text message, telephone, social media or counterfeit websites. Smishing refers to SMS-based phishing, while vishing refers to voice-based phishing.

A typical banking phishing sequence is:

• a criminal obtains or guesses customer information;
• the customer receives an urgent message about a blocked account, suspicious transaction or expiring security process;
• a link leads to a counterfeit login page or the victim is directed to a telephone operator;
• credentials, one-time passwords or card details are captured;
• the criminal accesses the account or persuades the customer to approve a transaction.

Modern phishing increasingly uses accurate branding, cloned websites, domain names resembling legitimate institutions and personal information gathered from data breaches. Multi-factor authentication reduces some forms of credential abuse but does not eliminate phishing, particularly where criminals use real-time relay techniques or persuade the victim to disclose an approval code.

3.2 Business email compromise

Business email compromise targets organisations rather than only retail customers. An attacker may compromise an executive’s mailbox, imitate a supplier or create a lookalike domain. The criminal then requests a change of bank details, an urgent payroll payment or a confidential transfer. The payment may pass normal technical authentication because an authorised employee initiated it.

Controls include independent verification using a trusted contact route, segregation of payment preparation and approval, payment-limit governance, anomaly detection for new beneficiaries and staff training focused on realistic scenarios rather than generic warnings.

4. Malware, ransomware and destructive attacks

4.1 Banking malware

Banking malware is malicious software designed to steal credentials, manipulate browser sessions, capture keystrokes, intercept messages or alter transactions. Mobile malware may exploit accessibility permissions, overlay legitimate applications or intercept notifications. The objective is often not simply to steal a password but to control the entire transaction process.

Indicators may include unusual device permissions, installation from unofficial sources, changes in device integrity, remote-control software, abnormal application behaviour and simultaneous access from inconsistent locations. Detection must be balanced against false positives because customers legitimately use new devices, travel and change networks.

4.2 Ransomware

Ransomware encrypts or otherwise disrupts systems and demands payment. In contemporary attacks, criminals often exfiltrate data before encryption and threaten disclosure, creating a double-extortion model. For a bank, ransomware can affect core services, branches, call centres, payment operations, treasury, customer data and third-party providers.

Ransomware is primarily an availability and confidentiality threat, but it can become a fraud threat when attackers alter payment instructions, compromise privileged accounts or exploit operational confusion. Resilience requires tested backups, network segmentation, privileged-access management, endpoint protection, incident response and continuity arrangements. Paying a ransom does not guarantee deletion of stolen data or reliable restoration and may create legal, sanctions or ethical concerns.

5. Account takeover

Account takeover (ATO) occurs when an unauthorised party gains control of a legitimate customer or employee account. Common routes include credential stuffing, password reuse, phishing, malware, SIM-swap fraud, call-centre manipulation and theft of authentication tokens.

The ATO lifecycle often includes:

1. acquisition of credentials or identity information;
2. testing of access and assessment of account value;
3. modification of email, phone number or password;
4. addition of a beneficiary or request for a card replacement;
5. transfer, withdrawal or application for credit;
6. laundering and abandonment.

High-risk indicators include a new device followed by a password reset, a sudden change of contact details, unusual navigation behaviour, new payees, rapid movement of funds and a transaction inconsistent with the customer’s history. No single signal is conclusive. A robust decision should combine identity confidence, device reputation, behavioural consistency, transaction risk and customer confirmation.

Authentication strength is also contextual. A static password provides weak assurance. A possession factor, biometric factor or cryptographic device-bound credential can improve assurance, but a strong authentication event does not prove that the transaction itself is legitimate if the customer has been deceived.

6. Payment and card fraud

6.1 Payment fraud

Payment fraud includes misuse of credit transfers, instant payments, direct debits, cheques, wallets and other payment instruments. Risks are amplified by speed and irrevocability. The shorter the time between initiation and settlement, the less opportunity exists for manual review or recovery.

Common forms include:

• unauthorised account transfers;
• beneficiary impersonation and invoice redirection;
• fraudulent direct-debit mandates;
• cheque alteration or counterfeit cheques;
• refund and overpayment scams;
• manipulation of payment files or APIs;
• cash-out through newly created or compromised accounts.

Controls should operate before, during and after payment. Pre-payment controls include beneficiary verification, confirmation of payee, velocity limits and risk-based friction. Post-payment controls include rapid recall processes, interbank collaboration, mule-account identification and customer notification.

6.2 Card fraud

Card fraud may be card-present, such as counterfeit or lost-card use at a terminal, or card-not-present, such as online purchases using stolen card details. Attacks include skimming, phishing, data-breach exploitation, merchant compromise, enumeration of card numbers and social engineering of card issuers.

Chip-based authentication and tokenisation reduce counterfeit risk, while dynamic authentication and merchant risk controls reduce some online fraud. Nevertheless, criminals may attack account recovery, exploit weak merchants or use stolen cards to purchase goods that can be resold. Fraud analytics should consider merchant category, transaction amount, location, device, delivery address, velocity and relationships among cards, accounts and merchants.

7. Application fraud and synthetic identity

7.1 Application fraud

Application fraud occurs when an applicant deliberately provides false, manipulated or misleading information to obtain a financial product. Examples include falsified income, altered documents, undisclosed liabilities, fabricated employment, stolen identity details and collusion with intermediaries.

Application fraud differs from credit risk. A genuine applicant may default because of economic circumstances, whereas a fraudulent applicant misrepresents information or identity at origination. The distinction affects investigation, provisioning, customer treatment and model design.

Controls include document verification, database checks, income and employment validation, device and network intelligence, application velocity monitoring, identity consistency checks and manual review for high-risk cases. Excessive friction can exclude legitimate customers, so controls should be proportionate and explainable.

7.2 Synthetic identity fraud

Synthetic identity fraud combines real and fabricated information to create an apparently legitimate identity. For example, a criminal may use a genuine national identifier with a false name, address or telephone number. The identity is gradually “seasoned” through low-risk activity before the criminal seeks credit or conducts a bust-out, in which available credit is exhausted and the account is abandoned.

Synthetic identities are difficult to detect because they may not correspond to a single stolen person. Useful signals include inconsistent identity attributes across institutions, improbable address or telephone histories, shared devices among apparently unrelated applicants, unusual patterns of credit building and relationships to known fraudulent identities.

Network analytics is particularly valuable. Instead of evaluating an application independently, an institution can examine links among identifiers, devices, addresses, employers, merchants, beneficiaries and prior applications. However, legitimate households and shared workplaces also create links; relationship evidence must therefore be interpreted carefully.

8. Authorised push-payment scams

An authorised push-payment (APP) scam occurs when a customer is deceived into authorising a transfer to an account controlled by, or associated with, a criminal. Common variants include:

• impersonation scams: the criminal pretends to be a bank, police officer, government agency or family member;
• purchase scams: the victim pays for goods or services that do not exist;
• investment scams: false investment opportunities promise high returns;
• romance scams: emotional relationships are used to solicit money;
• invoice or supplier scams: payment instructions are redirected;
• safe-account scams: the victim is told to move funds to a supposedly secure account.

APP scams challenge traditional fraud controls because the customer may pass authentication and provide a plausible explanation. Effective intervention combines warnings designed around the specific scenario, confirmation of payee, cooling-off periods for unusual transfers, trained contact-centre intervention, recipient-account intelligence and rapid recovery processes.

Warnings must be carefully designed. Generic warnings are often ignored through habituation. Excessive warnings may cause customers to dismiss legitimate security messages. Behavioural research and controlled testing can improve wording, timing and escalation.

9. Mule networks and laundering

A money mule is a person or entity used to receive, transfer or withdraw criminal proceeds. Some mules knowingly participate; others are recruited through fake employment, romance, investment or online advertising scams. Mule networks may involve layers of accounts, payment institutions, cash withdrawals, gift cards, cryptoasset services and international transfers.

A bank should distinguish the originator, intermediate mule, cash-out account and ultimate beneficiary, while recognising that identities may be obscured. Indicators include rapid incoming and outgoing payments, many unrelated senders, newly opened accounts, payments inconsistent with stated occupation, round-dollar transfers, repeated cash withdrawals and links to previously reported accounts.

A simplistic policy of closing every account with a suspicious indicator may create financial exclusion and harm victims. Proportionate responses include enhanced monitoring, transaction restrictions, customer outreach, temporary holds, law-enforcement referral and carefully documented account closure decisions.

10. Insider fraud and abuse of privilege

Insider fraud is committed or enabled by employees, contractors, agents or trusted service providers. It may involve unauthorised transfers, manipulation of customer records, disclosure of confidential data, suppression of alerts, collusion with external criminals or misuse of privileged technical access.

The insider threat may be malicious, negligent or coerced. Risk increases where one person can create and approve a transaction, access sensitive data without a business need, modify logs or administer security controls without independent review.

Core controls include least privilege, segregation of duties, joiner-mover-leaver processes, privileged-access management, immutable logging, independent reconciliation, mandatory leave, conflict-of-interest controls and confidential reporting channels. Employee monitoring must be lawful, transparent and proportionate. Behavioural analytics should support investigation, not make unsupported judgements about personal character.

11. Fraud analytics and integrated detection

11.1 From rules to risk-based decisioning

Rules remain useful for clear conditions, such as blocking a known compromised card or limiting repeated password-reset attempts. However, static rules are vulnerable to evasion and may generate excessive false positives. Modern banking detection commonly combines:

• deterministic rules;
• statistical anomaly detection;
• supervised machine learning using labelled outcomes;
• unsupervised or semi-supervised methods for emerging patterns;
• graph and network analytics;
• device, behavioural and biometric signals;
• human investigation and intelligence sharing.

A conceptual risk score may be represented as:

where R is the assessed risk, I represents identity and authentication signals, D device and channel signals, B behavioural consistency, T transaction characteristics, N network or relationship evidence, and C contextual information such as customer vulnerability or known intelligence. This is a conceptual model, not a universal scoring formula. The function f must be validated for the institution’s products, data quality, population and regulatory environment.

Important performance measures include precision, recall, false-positive rate, detection latency, prevented loss, recovered loss and customer-friction impact. A model with high detection but unacceptable false positives may cause customers to abandon legitimate transactions. A model with low friction but poor recall may expose the bank to substantial loss.

11.2 Supervised learning and governance

Supervised fraud models learn from historical labels such as confirmed fraud, legitimate transactions and investigator decisions. Labels may be incomplete or delayed. Confirmed cases are not a complete representation of fraud because undetected fraud is absent from the training data. Models may therefore reproduce historic investigation priorities or disadvantage certain customer groups.

Governance should include documented purpose, data lineage, feature rationale, validation, monitoring for drift, threshold approval, explainability appropriate to the decision, access controls and human escalation. Generative AI may assist investigators by summarising cases or identifying relationships, but it should not be allowed to invent evidence, expose confidential data or make irreversible customer decisions without controls.

12. Applied case: coordinated APP fraud and mule activity

Background

This illustrative case concerns a retail bank experiencing a rise in instant-payment losses. Customers reported calls from individuals impersonating the bank’s fraud department. Victims were instructed to move funds to “secure accounts.” The recipient accounts were often less than three months old.

Problem

Traditional authentication controls were functioning. Customers logged in with valid credentials and approved payments using their normal devices. A rule blocking unusual devices therefore detected few cases. The bank needed to distinguish legitimate urgent payments from deception without imposing broad delays on all customers.

Analysis

The fraud team combined payment data, call-centre records, beneficiary history, device information and interbank intelligence. Several patterns emerged:

• payments were made shortly after a call or attempted call from a spoofed number;
• first-time beneficiaries received funds and rapidly distributed them to several accounts;
• recipient accounts had multiple unrelated incoming payments;
• victims used familiar devices but exhibited unusual navigation and unusually high payment amounts;
• some mule accounts shared telephone numbers, devices or addresses with previously closed accounts.

The analysis demonstrated why the incident could not be classified solely as account takeover. The customer account was not technically compromised; the principal mechanism was social engineering followed by authorised payment and mule-network laundering.

Approach and solution

The bank introduced a layered response:

1. scenario-specific warnings before a high-risk first payment;
2. confirmation of the beneficiary name and account details;
3. a short delay for selected high-risk payments rather than all payments;
4. trained staff scripts for customer callbacks using trusted contact data;
5. recipient-account risk scoring and rapid interbank notification;
6. graph analysis of shared devices, phone numbers and payment flows;
7. post-incident support for vulnerable customers and structured recovery attempts.

Outcome

The intervention reduced the time available for mule accounts to distribute funds and improved the bank’s ability to identify linked accounts. Some legitimate payments were delayed, so the bank monitored customer complaints, completion rates and false-positive outcomes. The case illustrates that effective fraud prevention requires cooperation between cybersecurity, fraud operations, customer service, payments, analytics, legal teams and external institutions.

Learning points

• Authentication does not establish that a payment is free from deception.
• Recipient intelligence is as important as payer intelligence.
• Time-sensitive intervention is critical in instant-payment environments.
• Network relationships can reveal organised activity that individual-account rules miss.
• Customer protection must include respectful treatment and recovery assistance, not only blocking.

13. Governance, ethics and regulatory considerations

Fraud controls affect access to essential financial services. A bank must therefore balance loss prevention with privacy, fairness, accessibility and due process. Relevant principles include data minimisation, lawful processing, purpose limitation, secure retention and controlled sharing of personal information.

Automated decisions should be explainable at a level appropriate to the decision. A customer may need to understand why a payment was delayed and how to seek review, even when the bank cannot disclose sensitive detection logic. Models should be tested for disparate impact and calibrated across relevant customer populations. Special care is needed for elderly customers, people with disabilities, digitally excluded customers and victims of coercive control.

Institutions should maintain clear accountability for outsourced services. A vendor’s model or cloud platform does not remove the bank’s responsibility for risk management, resilience, incident reporting and customer outcomes. Governance should define ownership, escalation, audit rights, service-level expectations, data location and exit arrangements.

14. Contemporary developments and best practices

The threat landscape is being influenced by generative AI, deepfake voice and video, automated phishing, malware commoditisation, instant payments, open banking, cloud concentration and synthetic media. AI can improve fraud detection and investigation, but it also lowers the cost of creating persuasive messages and impersonations. Banks should assume that language quality and visual branding are no longer reliable indicators of legitimacy.

A mature programme should:

• maintain an enterprise fraud taxonomy and incident register;
• map controls to the complete attack chain;
• use layered authentication and transaction risk assessment;
• protect privileged accounts and monitor access;
• integrate cyber, fraud, AML and customer-service intelligence;
• test detection models for drift, bias and operational impact;
• rehearse ransomware, payment fraud and data-breach scenarios;
• establish rapid recall and customer-contact procedures;
• share intelligence lawfully with relevant institutions and authorities;
• measure both prevented loss and customer harm;
• educate customers and employees through realistic, current scenarios.

No single control is sufficient. Resilience emerges from defence in depth, rapid detection, informed human judgement, trustworthy customer communication and effective recovery.

Chapter Summary

Banking threats arise from the interaction of valuable assets, interconnected technology, trusted relationships and fast payment processes. Threat actors include organised criminals, insiders, state-linked groups, fraud specialists and opportunistic offenders. Their attack chains commonly progress from reconnaissance and initial access through trust manipulation, transaction execution, monetisation and concealment.

Phishing, malware, ransomware and account takeover frequently support fraud but are not themselves identical to every fraud outcome. Payment and card fraud exploit payment instruments; application and synthetic-identity fraud target origination and credit processes; APP scams manipulate customers into authorising payments; mule networks convert and conceal proceeds; and insider fraud abuses legitimate access. Integrated analytics combines rules, machine learning, device and behavioural signals, transaction context and network relationships. Effective governance must address privacy, fairness, explainability, resilience, outsourcing and customer protection.

Key Terms

Account takeover: Unauthorised control of a legitimate customer or employee account.

Authorised push-payment scam: A deception that causes a customer to approve a transfer to a criminal-controlled or associated account.

Business email compromise: Fraud involving compromise or imitation of business email to induce payments or data disclosure.

Card-not-present fraud: Card fraud conducted without physical presentation of the card.

Credential stuffing: Automated use of stolen username-password pairs against other services.

Fraud-as-a-service: Commercial provision of criminal tools, access, credentials or laundering services.

Insider fraud: Fraud committed or enabled by an employee, contractor, agent or trusted provider.

Mule account: An account used to receive, transfer or withdraw criminal proceeds.

Phishing: Deceptive communication intended to obtain information, access, approval or payment.

Ransomware: Malicious software or activity that disrupts access to systems or data, usually for extortion.

Synthetic identity: An identity assembled from genuine and fabricated information.

Transaction monitoring: Examination of payment activity to identify suspicious or anomalous behaviour.

Vishing: Voice-based phishing.

Smishing: SMS-based phishing.

Least privilege: Granting only the access necessary for an authorised task.

Graph analytics: Analysis of relationships among accounts, devices, identities, transactions and other entities.

False positive: A legitimate activity incorrectly classified as suspicious.

False negative: Fraudulent activity not detected by a control or model.

Review Questions

Short Answer Questions

1. Why are banks particularly attractive targets for cybercriminals?
2. Distinguish unauthorised fraud from authorised fraud.
3. What is a synthetic identity?
4. Identify three indicators of account takeover.
5. What is the role of a mule account?

Long Answer Questions

1. Explain the banking fraud attack chain from reconnaissance to monetisation.
2. Compare phishing, malware and account takeover as related but distinct phenomena.
3. Discuss the operational challenges created by authorised push-payment scams.
4. Explain how graph analytics can assist in detecting synthetic identities and mule networks.
5. Evaluate the ethical and governance issues associated with automated fraud decisions.

Analytical / Application Questions

1. A customer logs in from a familiar device and authorises a large payment to a new beneficiary after receiving a telephone call from someone claiming to be a bank employee. Analyse the likely typology, relevant risk signals and appropriate intervention.
2. A bank observes multiple new accounts receiving funds from unrelated customers and rapidly transferring the money to overseas payment providers. Design a layered investigative and control response.
3. A fraud model has high detection rates but frequently blocks legitimate payments from older customers and customers who travel internationally. Recommend a validation, fairness and operational-improvement plan.

Multiple Choice Questions with Answers

Question 1

Which characteristic most directly increases the attractiveness of banks to threat actors?

A. Banks rarely use digital systems

B. Banks combine valuable assets, sensitive information and extensive connectivity

C. Banks process only low-value transactions

D. Banks have no third-party dependencies

Correct Answer: B. Banks combine valuable assets, sensitive information and extensive connectivity

Question 2

Which event best describes an authorised push-payment scam?

A. A criminal uses a counterfeit card at a terminal without the customer’s knowledge

B. A ransomware attack encrypts a bank’s servers

C. A customer is deceived into approving a transfer to a criminal-controlled account

D. An employee accesses a database without permission but makes no payment

Correct Answer: C. A customer is deceived into approving a transfer to a criminal-controlled account

Question 3

What is the defining feature of a synthetic identity?

A. It is always based entirely on a stolen person’s identity

B. It combines genuine and fabricated identity information

C. It is created only by bank employees

D. It can be used only for card-present transactions

Correct Answer: B. It combines genuine and fabricated identity information

Question 4

Which control is especially relevant to business email compromise involving changed supplier bank details?

A. Independent verification through a trusted communication channel

B. Disabling all customer passwords

C. Removing payment approval controls

D. Allowing unrestricted beneficiary changes

Correct Answer: A. Independent verification through a trusted communication channel

Question 5

Which pattern is most consistent with a mule account?

A. A stable salary account with ordinary household spending

B. A newly opened account receiving unrelated payments and rapidly transferring funds onward

C. A dormant account with no transactions

D. A savings account receiving regular interest only

Correct Answer: B. A newly opened account receiving unrelated payments and rapidly transferring funds onward

Question 6

Why may multi-factor authentication fail to prevent an APP scam?

A. It prevents customers from using payment services

B. The customer may legitimately authenticate a payment while being deceived

C. It guarantees that every beneficiary is trustworthy

D. It removes the need for transaction monitoring

Correct Answer: B. The customer may legitimately authenticate a payment while being deceived

Question 7

Which activity is an example of insider fraud?

A. A customer forgets a password

B. A criminal sends a generic advertisement

C. An employee alters customer records to facilitate an unauthorised transfer

D. A bank performs scheduled maintenance

Correct Answer: C. An employee alters customer records to facilitate an unauthorised transfer

Question 8

What is a false negative in fraud detection?

A. A legitimate transaction incorrectly blocked

B. A fraudulent transaction incorrectly classified as legitimate

C. A transaction delayed for manual review

D. A confirmed fraud case reported to authorities

Correct Answer: B. A fraudulent transaction incorrectly classified as legitimate

Question 9

Which analytical approach is most useful for identifying links among accounts, devices and beneficiaries?

A. Graph or network analytics

B. Random sampling without relationship data

C. Deleting historical transaction data

D. Using only a single transaction amount threshold

Correct Answer: A. Graph or network analytics

Question 10

Why should fraud models be monitored after deployment?

A. Fraud patterns, customer behaviour and data distributions can change over time

B. A model becomes legally perfect after deployment

C. Monitoring eliminates the need for human oversight

D. Model outputs never depend on data quality

Correct Answer: A. Fraud patterns, customer behaviour and data distributions can change over time