Financial-Crime Typologies and Sector Exposure

Introduction and context

Financial crime is not a single offence but a family of activities through which individuals, firms, public officials, criminal networks, or sanctioned actors obtain, move, conceal, or use value unlawfully. It may involve theft from an employer, manipulation of financial statements, bribery of a public official, abuse of confidential information, fraudulent insurance claims, cyber-enabled payment deception, or the laundering of proceeds from organised crime.

For banking, finance, and insurance professionals, typologies matter for three reasons. First, different crimes create different indicators and require different controls. Secondly, one offence often enables another: identity crime may facilitate payment fraud; corruption may generate proceeds requiring laundering; and sanctions evasion may use trade misrepresentation and shell companies. Thirdly, exposure is shaped by the institution’s products, customers, delivery channels, jurisdictions, and third-party relationships. A bank offering correspondent banking services faces a different risk profile from a motor insurer or a securities exchange.

A useful distinction is between the predicate offence, which generates illegal proceeds, and money laundering, which disguises or uses those proceeds. Fraud, corruption, tax crime, and trafficking can be predicate offences. Money laundering is therefore frequently an associated process rather than a separate commercial purpose.

Learning objectives

By the end of this chapter, students should be able to:

1. Define and distinguish major financial-crime typologies.
2. Explain how products, sectors, channels, and jurisdictions create different exposure.
3. Apply the fraud triangle and a risk-based approach to practical situations.
4. Identify common red flags without treating them as proof of misconduct.
5. Analyse the interaction between cyber risk, fraud, corruption, sanctions, and organised crime.
6. Recommend proportionate governance, prevention, detection, investigation, and reporting measures.

A framework for understanding financial-crime typologies

A typology describes a recurring method, pattern, or mechanism of financial crime. Typologies can be classified by the principal objective, the victim, the mechanism, or the point in the financial system where value is extracted.

The fraud triangle, associated with Donald Cressey’s analysis of occupational fraud, identifies three conditions that commonly support fraud: pressure or incentive, opportunity, and rationalisation. Modern analysis often adds capability, producing a fraud diamond. Pressure may include debt, financial targets, or gambling losses. Opportunity arises from weak segregation of duties, excessive system privileges, or ineffective review. Rationalisation may involve beliefs such as “the firm owes me.” Capability includes technical skill, authority, confidence, and the ability to conceal conduct.

The model is not a predictive law. Many people experience pressure without committing fraud, and serious fraud can occur without an obvious personal financial crisis. It is a structured way to examine conditions that increase vulnerability.

A second framework is the risk-based approach. Risk is assessed by considering threats, vulnerabilities, likelihood, and impact. A simple conceptual expression is:

Here, likelihood is the estimated chance of a harmful event within a defined period, and impact is the magnitude of financial, legal, operational, customer, or reputational harm. The expression is a prioritisation aid, not a universally precise probability model. Institutions should define scales consistently and recognise that low-frequency events may still demand attention when their impact is extreme.

Core financial-crime typologies

Asset misappropriation

Asset misappropriation is the theft or unauthorised use of an organisation’s resources. It includes cash theft, false expense claims, payroll fraud, inventory theft, unauthorised transfers, procurement fraud, and misuse of corporate assets. It is often associated with occupational fraud because the offender has legitimate access to systems or assets.

Common schemes include:

• Skimming, in which cash is taken before it is recorded;
• Cash larceny, in which recorded cash is later stolen;
• Billing fraud, involving fictitious vendors, inflated invoices, or duplicate payments;
• Payroll fraud, involving ghost employees, false overtime, or altered pay rates;
• Expense fraud, involving fabricated or inflated business expenses; and
• Theft of non-cash assets, such as inventory, customer data, or securities.

Exposure is high where one person can create a supplier, approve an invoice, release payment, and reconcile the bank account. Controls include segregation of duties, vendor verification, payment limits, independent reconciliations, exception reporting, mandatory leave, and protected whistleblowing channels.

Corruption and bribery

Bribery involves offering, promising, giving, requesting, or accepting an improper advantage to influence a decision or action. Corruption is broader and includes abuse of entrusted power for private benefit. Facilitation payments, kickbacks, conflicts of interest, embezzlement by officials, and procurement manipulation may fall within corruption risk, depending on applicable law.

A commercial bribe may be hidden as a consultancy fee, success commission, charitable donation, hospitality expense, or inflated subcontract. Public-sector corruption is especially significant because it can distort licensing, procurement, tax assessment, customs, and public spending. Financial institutions may face exposure through customers operating in high-risk sectors, politically exposed persons, government contracts, intermediaries, and cross-border payments.

Effective anti-bribery programmes require senior commitment, risk-based due diligence on agents and distributors, approval of gifts and hospitality, conflict-of-interest declarations, accurate books and records, training, monitoring, and investigation. A payment may be legally or commercially described as a “commission” but still be corrupt if its real purpose is to influence a decision improperly.

Accounting fraud and financial-statement manipulation

Accounting fraud is the intentional misstatement or omission of financial information. It can inflate assets or revenue, conceal liabilities, defer expenses, manipulate provisions, recognise revenue prematurely, or create fictitious transactions. Techniques include round-tripping, channel stuffing, improper capitalisation, false journal entries, and manipulation of estimates.

The consequences extend beyond the company. Lenders may grant credit on false information, investors may purchase securities at distorted prices, regulators may receive inaccurate reports, and employees may lose pensions or employment. Warning signs include unusually strong performance compared with peers, unexplained end-of-period transactions, large manual journal entries, rapid growth in receivables, frequent changes in accounting estimates, and resistance to independent audit procedures.

Prevention depends on a strong control environment, independent audit committees, appropriate authorisation, reconciliations, journal-entry controls, accounting estimates supported by evidence, related-party disclosure, and protection for employees who raise concerns. Auditors provide assurance within a defined scope; an audit is not a guarantee that all fraud will be detected.

Market abuse

Market abuse is conduct that undermines fair, orderly, and efficient markets. It commonly includes insider dealing, unlawful disclosure of inside information, market manipulation, false or misleading statements, spoofing, wash trades, marking the close, and dissemination of misleading information. The precise legal definitions vary by jurisdiction.

Market manipulation can be conducted through trading, orders, communications, social media, or coordinated activity. In a wash trade, transactions are arranged to create artificial volume without a genuine change in beneficial ownership. In spoofing, orders are entered with an intention to cancel them before execution in order to create a false impression of supply or demand.

Securities firms and exchanges use surveillance systems to examine unusual price movements, order patterns, concentration, cancellations, timing around announcements, and relationships among accounts. Detection is difficult because legitimate trading can resemble manipulation. Investigation therefore requires contextual analysis, communications review, beneficial-ownership information, and evidence of intent where the legal test requires it.

Insider dealing

Inside information is generally non-public, precise or sufficiently specific information that would be likely to influence the price of a financial instrument if made public. Insider dealing occurs when a person trades while possessing such information, recommends or induces another person to trade, or unlawfully discloses it, subject to applicable legal rules and exemptions.

Exposure is concentrated among issuers, investment banks, asset managers, advisers, lawyers, accountants, rating agencies, exchanges, and employees involved in mergers, earnings announcements, restructurings, or major contracts. Controls include restricted lists, watch lists, information barriers, deal-team access controls, pre-clearance, personal-account dealing rules, disclosure calendars, wall-crossing procedures, and surveillance.

Possession of information alone does not automatically establish every form of legal liability in every jurisdiction. Students and practitioners must distinguish ethical concerns, internal policy breaches, civil market-abuse rules, and criminal offences.

Tax crime

Tax crime includes deliberate evasion, false returns, concealed income, fraudulent deductions, false invoices, abusive refund claims, and assistance in hiding taxable assets. It differs from legitimate tax planning, which uses lawful choices within the tax system. Aggressive avoidance may be lawful in one jurisdiction, prohibited under another rule, or challenged under anti-avoidance doctrines.

Financial institutions can be used to conceal beneficial ownership, move undeclared funds, create fictitious trading activity, or process payments through opaque structures. Relevant controls include customer tax information, beneficial-owner verification, transaction monitoring, suspicious-activity reporting, records retention, and cooperation with lawful information requests. Tax secrecy is not a justification for helping a customer evade tax.

Sanctions evasion

Sanctions are restrictions imposed by states or international bodies on persons, entities, goods, services, sectors, or jurisdictions. Sanctions evasion seeks to bypass those restrictions through concealment, falsified documents, intermediaries, transshipment, front companies, changes in ownership, or manipulation of payment messages.

A typical risk pattern may involve goods exported to an apparently permitted country, transferred through several intermediaries, and ultimately diverted to a restricted end user. Other methods include removing identifying information from payment messages, using complex ownership chains, or misdescribing goods. Banks, insurers, freight companies, commodity traders, and payment firms are particularly exposed.

Sanctions compliance requires current screening, customer and beneficial-owner checks, geographic and product risk assessment, payment filtering, escalation of potential matches, trade-document review, and controls over updates and overrides. Screening is not sufficient by itself: a name match may be a false positive, while an evasion scheme may use a name that does not appear on a list.

Insurance fraud

Insurance fraud is an intentional deception designed to obtain an improper insurance benefit or cause an insurer to avoid a legitimate payment. It may be committed by policyholders, claimants, intermediaries, service providers, employees, or organised groups.

Examples include staged accidents, inflated repair invoices, false claims for non-existent property, deliberately caused losses, application misrepresentation, premium evasion, and healthcare-provider billing fraud. Life insurance may be exposed to identity fraud, beneficiary manipulation, and fabricated death claims. Commercial insurance may be affected by collusion among brokers, insured firms, adjusters, and contractors.

Indicators include repeated claims with similar circumstances, unusual claims immediately after policy inception, inconsistent accounts, shared contact details among unrelated claimants, suspicious repair networks, and documentation that cannot be independently verified. Investigation must be fair: an indicator is not proof, and legitimate claimants should not be denied solely because they belong to a statistical risk category.

Payment fraud

Payment fraud targets the initiation, authorisation, routing, or receipt of funds. Types include card fraud, unauthorised account transfers, cheque fraud, direct-debit fraud, business email compromise, invoice redirection, mobile-payment fraud, and authorised push-payment scams.

In business email compromise, an attacker compromises or imitates an executive, supplier, or lawyer and requests an urgent payment or change of bank details. The technical method may be phishing, malware, mailbox takeover, or social engineering. Controls include strong authentication, device and session monitoring, payment confirmation through an independent channel, beneficiary-change verification, transaction limits, cooling-off periods for unusual payments, and customer education.

A key distinction is between an unauthorised transaction, made without the account holder’s permission, and an authorised but deceived transaction, where the customer is manipulated into approving it. Liability, reimbursement, and reporting obligations differ across legal systems and payment schemes.

Identity crime

Identity crime involves the acquisition, use, production, or sale of identity information for unlawful purposes. It includes identity theft, synthetic identity creation, account takeover, impersonation, and use of fraudulent documents. Synthetic identities combine real and invented information, making detection difficult because the identity may pass basic checks.

Identity crime affects account opening, lending, insurance underwriting, mobile communications, benefits, and digital wallets. Controls include document and biometric verification where lawful and proportionate, liveness testing, device intelligence, database checks, behavioural analytics, step-up authentication, and recovery procedures. Organisations must balance fraud prevention with privacy, accessibility, data minimisation, and non-discrimination.

Scams

A scam is a deceptive scheme designed to cause a victim to surrender money, credentials, or personal information. Common forms include investment scams, romance scams, impersonation scams, advance-fee fraud, employment scams, cryptocurrency scams, and technical-support scams. Scams are frequently psychologically sophisticated and may use urgency, authority, fear, greed, or social trust.

Banks and insurers increasingly use customer-facing warnings, confirmation-of-payee controls, transaction friction, behavioural detection, rapid recall processes, and intelligence sharing. However, excessive friction can inconvenience customers and drive them to less regulated channels. Effective intervention should be risk-sensitive and preserve legitimate customer autonomy.

Organised financial crime

Organised financial crime involves structured or networked groups that coordinate offences for continuing financial benefit. Activities may include money laundering, human trafficking proceeds, drug trafficking, cybercrime, corruption, counterfeit goods, illegal gambling, and sanctions evasion. Networks may use professional enablers, shell companies, nominee directors, informal value-transfer systems, virtual assets, trade-based laundering, and corrupt insiders.

Organised groups often separate roles: one participant recruits victims, another controls technology, another receives funds, and another launders proceeds. This separation complicates attribution. Financial institutions should use network analysis, beneficial-ownership intelligence, transaction-link analysis, cross-institutional cooperation, and typology-led monitoring rather than examining transactions in isolation.

Sector exposure and control priorities

Exposure depends on the interaction of inherent risk and control effectiveness. The following comparison is illustrative rather than exhaustive.

A mature programme combines preventive, detective, and responsive controls. Preventive controls reduce the chance of occurrence; detective controls identify suspicious activity; responsive controls contain loss, recover assets, investigate, report, and remediate weaknesses. Controls should be proportionate to risk and tested for actual effectiveness, not merely documented.

Technology, data, and artificial intelligence

Technology changes both the scale of financial crime and the ability to detect it. Criminals can automate phishing, create convincing synthetic identities, exploit application programming interfaces, use deepfake audio or video, and coordinate mule accounts. Generative artificial intelligence can improve the quality and volume of fraudulent communications, although it does not eliminate traditional social-engineering weaknesses.

Institutions use rules, anomaly detection, graph analytics, supervised machine learning, natural-language processing, and biometric tools. A rule may identify a payment above a threshold; a graph model may reveal common devices, addresses, beneficiaries, or controllers among apparently unrelated accounts. Machine-learning systems can reduce false positives, but they may reproduce historical bias, be difficult to explain, or be evaded by adaptive offenders.

Governance should include data quality controls, model validation, explainability appropriate to the use case, human review, access controls, privacy safeguards, performance monitoring, and documented escalation. AI should support professional judgement rather than replace accountability. A low model score does not prove legitimacy, and a high score does not prove guilt.

Applied case: the diverted supplier payment

This is a fictional illustrative case.

Background

Northbridge Components, a manufacturing company, maintains a current-account relationship with Meridian Bank. An employee in Northbridge’s accounts-payable department receives an email appearing to come from a long-standing supplier. The message states that the supplier’s bank account has changed and requests that future payments be sent to a new account. The email uses the supplier’s logo and refers to a genuine outstanding invoice.

Problem

The employee changes the beneficiary details without calling the supplier. Two days later, Northbridge sends £185,000 to the new account. The funds are transferred through three domestic accounts and then sent overseas. The supplier reports non-payment, and Northbridge contacts the bank.

Analysis

The primary typology is business email compromise and payment fraud. Identity crime is an enabling element because the attacker impersonated or compromised a trusted identity. The rapid onward movement of funds suggests mule-account activity and possible laundering. Control weaknesses occurred at both the customer and payment-provider levels: inadequate independent verification, excessive reliance on email, and insufficient scrutiny of a new beneficiary followed by a high-value payment.

Relevant indicators include the recent change of bank details, a new beneficiary, an unusual amount, urgency, a mismatch between the supplier’s historical account and the new destination, and rapid onward transfers. None alone proves fraud, but the combination should have generated enhanced review.

Approach and solution

Northbridge should immediately contact the bank, the genuine supplier, law enforcement, and relevant payment-recovery channels. Meridian should place lawful holds where possible, trace funds, preserve logs and messages, assess linked accounts, and file required reports. Both organisations should conduct a root-cause review rather than treating the event solely as employee error.

Preventive improvements include dual approval for beneficiary changes, confirmation using a previously verified telephone number, a waiting period for new beneficiaries, transaction limits, staff training, email-domain protection, multi-factor authentication, and risk-based transaction monitoring. The bank should examine whether the receiving account shows characteristics of a mule account and whether other customers were targeted by the same campaign.

Outcome and learning points

Assume that £120,000 is recovered, while £65,000 remains unrecovered. The financial loss is significant, but the broader lessons concern control design and coordination. Fraud prevention must address the complete payment journey, not only the final transaction. The case also demonstrates why cyber risk and financial-crime risk overlap: technical compromise, social engineering, payment fraud, identity crime, and laundering can occur in one sequence.

Governance, ethics, and regulatory practice

Financial-crime management is both a legal and ethical responsibility. Senior management and the board should approve risk appetite, allocate resources, receive meaningful management information, and ensure that deficiencies are corrected. Compliance functions need sufficient independence, while business units remain responsible for controls in their processes.

Important governance principles include:

• accurate books, records, and audit trails;
• risk-based customer and third-party due diligence;
• beneficial-ownership transparency;
• effective suspicious-activity and sanctions escalation;
• protection for whistleblowers and investigation subjects;
• confidentiality and lawful information sharing;
• proportionate customer treatment;
• documented decisions and evidence preservation; and
• independent testing and remediation tracking.

Over-reporting every unusual event can overwhelm investigators and regulators, while under-reporting can allow crime to continue. A suspicious activity report is generally an intelligence or compliance communication, not a judicial finding. Staff must avoid “tipping off” subjects where prohibited and must respect data-protection obligations.

Challenges and limitations

Typology-based control has several limitations. Criminal methods evolve faster than static procedures. Legitimate activity can resemble suspicious behaviour, creating false positives and customer friction. Data may be incomplete, identities may be opaque, and cross-border legal systems may restrict information sharing. Organisational silos can prevent a bank from connecting fraud, sanctions, cyber, and anti-money-laundering signals.

Another limitation is the danger of treating risk categories as conclusions. Geography, occupation, nationality, or product type may inform risk assessment but should not substitute for evidence. Models and thresholds must be reviewed as criminal behaviour, technology, and customer behaviour change.

Best-practice control cycle

A practical control cycle is:

1. Understand exposure: map products, customers, channels, jurisdictions, third parties, and assets.
2. Identify typologies: use internal incidents, regulatory alerts, law-enforcement intelligence, and sector experience.
3. Design controls: combine prevention, detection, investigation, reporting, and recovery.
4. Test effectiveness: conduct assurance reviews, simulations, red-team exercises, and outcome testing.
5. Respond and learn: contain losses, preserve evidence, report appropriately, discipline misconduct fairly, and update controls.

This cycle should be supported by clear ownership, measurable outcomes, staff competence, and continuous improvement. The objective is not to eliminate all risk, which is unrealistic, but to reduce exposure, detect harm quickly, and maintain trustworthy financial services.

Chapter Summary

Financial crime includes diverse but interconnected typologies. Asset misappropriation exploits access to organisational resources; bribery and corruption distort decisions; accounting fraud misrepresents financial performance; market abuse and insider dealing undermine market integrity; tax crime conceals fiscal obligations; sanctions evasion bypasses legal restrictions; insurance fraud manipulates claims or underwriting; payment fraud and scams exploit technology and human trust; identity crime abuses personal information; and organised financial crime coordinates these activities for continuing gain.

The fraud triangle provides a useful framework of pressure, opportunity, and rationalisation, while the fraud diamond adds capability. A risk-based approach considers likelihood, impact, threats, vulnerabilities, and control effectiveness. Sector exposure varies: banks face payment and laundering risks, securities firms face market abuse, insurers face claims fraud, and payment firms face identity and account-takeover risks. Effective programmes combine governance, due diligence, authentication, transaction and market surveillance, data analytics, human judgement, investigation, reporting, and recovery. Controls must be proportionate, legally compliant, privacy-aware, and continuously adapted to changing criminal methods.

Key Terms

Typology: A recurring pattern or method of financial crime.

Predicate offence: An offence that generates proceeds later laundered or concealed.

Asset misappropriation: Unauthorised taking or use of an organisation’s assets.

Bribery: Offering, giving, requesting, or accepting an improper advantage.

Corruption: Abuse of entrusted power for private benefit.

Accounting fraud: Intentional misstatement or omission in financial information.

Market abuse: Conduct that undermines fair and orderly financial markets.

Insider dealing: Trading or related conduct involving material non-public information.

Tax crime: Deliberate unlawful evasion or deception concerning tax obligations.

Sanctions evasion: Concealing activity or parties to bypass sanctions restrictions.

Insurance fraud: Deception intended to obtain an improper insurance benefit.

Payment fraud: Deception or unauthorised conduct affecting payment initiation or receipt.

Identity crime: Unlawful acquisition or use of identity information.

Scam: Deceptive conduct designed to induce a victim to surrender value or information.

Money mule: A person or account used to receive, move, or launder illicit funds.

Business email compromise: Fraud using a compromised or imitated business communication.

Beneficial owner: The natural person who ultimately owns or controls an entity or arrangement.

Fraud triangle: Pressure, opportunity, and rationalisation associated with fraudulent conduct.

Risk-based approach: Allocating controls and resources according to assessed risk.

Market manipulation: Conduct that creates a false or misleading impression of market activity.

Review Questions

Short Answer Questions

1. What is a financial-crime typology, and why is it useful?
2. Distinguish bribery from corruption.
3. Identify the three elements of the fraud triangle.
4. What is sanctions evasion?
5. Give two controls that can reduce business email compromise.

Long Answer Questions

1. Explain how asset misappropriation can occur through procurement, payroll, and expense processes.
2. Compare accounting fraud, market manipulation, and insider dealing.
3. Discuss the principal financial-crime exposures of retail banks, insurers, and securities firms.
4. Explain how organised financial crime uses identity crime, payment fraud, and laundering together.
5. Evaluate the benefits and limitations of artificial intelligence in financial-crime detection.

Analytical / Application Questions

1. A customer makes several urgent payments to a newly created beneficiary, followed by rapid transfers to multiple jurisdictions. Analyse the possible typologies, relevant red flags, and proportionate institutional response.
2. An employee approves invoices from a supplier owned by a close relative. Explain the governance, corruption, and accounting risks and recommend controls.
3. An insurer observes repeated claims involving the same repair firms, claimants, phone numbers, and vehicle damage patterns. Design an investigation and explain how to avoid unfairly treating indicators as proof.

Multiple Choice Questions with Answers

Question 1

Which combination represents the fraud triangle?

A. Pressure, opportunity, and rationalisation

B. Profit, liquidity, and solvency

C. Identity, authentication, and encryption

D. Audit, taxation, and insurance

Correct Answer: A. Pressure, opportunity, and rationalisation

Question 2

Which activity is most directly associated with asset misappropriation?

A. Trading on confidential merger information

B. Creating a fictitious supplier and approving its invoices

C. Submitting a lawful tax deduction

D. Publishing audited financial statements

Correct Answer: B. Creating a fictitious supplier and approving its invoices

Question 3

What is the primary characteristic of insider dealing?

A. Use of non-public information in connection with trading or related conduct

B. Failure to pay an insurance premium

C. Theft of office equipment

D. A delay in settling a legitimate invoice

Correct Answer: A. Use of non-public information in connection with trading or related conduct

Question 4

Which situation is the clearest example of sanctions evasion?

A. A customer changes a password after a phishing attempt

B. A company conceals the restricted end user of goods through intermediaries

C. An insurer rejects a claim under a policy exclusion

D. A bank reconciles its suspense account

Correct Answer: B. A company conceals the restricted end user of goods through intermediaries

Question 5

Which control most directly addresses a requested change to a supplier’s bank details?

A. Independent confirmation using a previously verified contact method

B. Removing all payment approval limits

C. Allowing one employee to create and approve the change

D. Disabling transaction monitoring

Correct Answer: A. Independent confirmation using a previously verified contact method

Question 6

A wash trade is generally intended to do what?

A. Create an artificial impression of trading activity

B. Verify a customer’s identity

C. Recover a stolen insurance payment

D. Calculate a tax liability

Correct Answer: A. Create an artificial impression of trading activity

Question 7

Why can synthetic identity fraud be difficult to detect?

A. It uses only stolen cash

B. It combines genuine and fabricated identity information

C. It occurs only in physical branches

D. It cannot involve digital accounts

Correct Answer: B. It combines genuine and fabricated identity information

Question 8

Which sector is especially exposed to claims inflation and staged accidents?

A. Insurance

B. Securities exchange

C. Central banking monetary policy

D. External auditing only

Correct Answer: A. Insurance

Question 9

In the conceptual expression Risk = Likelihood × Impact, impact refers to what?

A. The number of employees in the organisation

B. The magnitude of potential harm if the event occurs

C. The age of the customer

D. The number of transactions processed per hour

Correct Answer: B. The magnitude of potential harm if the event occurs

Question 10

Why should a suspicious activity report not be treated as proof of guilt?

A. It is generally a compliance or intelligence communication requiring further assessment

B. It is always prepared by the suspect

C. It replaces all investigation

D. It is issued only after a criminal conviction

Correct Answer: A. It is generally a compliance or intelligence communication requiring further assessment