Bank fraud is an illegal activity that works to steal money or other property from a financial institution or its customers. Historically, bank fraud consisted of physical acts like cashing a fraudulent check or stealing a credit card. But with the rise of digital banking, attacks have become increasingly sophisticated.
It's important to understand different kinds of bank fraud examples in order to prepare your institution for prevention and protect your customers.
Types of Bank Fraud
Account Takeover
Banks are at high risk for account takeover (ATO) fraud. This is when an unauthorized user gains access to a customer's account using their login credentials. Account takeover can be accomplished using a number of different strategies.
Phishing Attacks
Login credentials can be obtained through phishing attacks, such as fake emails, texts, or phone calls. Usually, the account holder is targeted and tricked into giving out their account information to someone posing as a bank employee.
But bank employees are also at risk of phishing attacks. For instance, call center fraud is a growing problem. Instead of the attacker posing as the bank and contacting the account holder, they pose as the account holder and try to obtain account details from the bank's call center.
Credential Stuffing
Credential stuffing is a strategy used by fraudsters who have purchased stolen credentials off the dark web. Usually, the data is incomplete. So from there, they use computer programs to stuff usernames and passwords into different websites in large quantities, hoping for a match. Success rates are low, but attackers work with large volumes of data to achieve access to compromised accounts.
Session Hijacking
Session hijacking occurs in the middle of the user journey, rather than at the login stage. The attacker uses stolen session cookies to take over a customer's existing session. The stolen data is usually obtained using third party browser extensions, malware-infected devices, or public WiFi networks. The hijacker can view information being sent and received, including financial details of an online bank account.
Social Engineering
With social engineering, attackers exploit human psychology in order to gain access to user account credentials. There are many possible tactics, including:
- Impersonating an executive and emailing employees for information
- Baiting a customer to prevent a fake emergency scenario, such as account suspension
- Bribing employees to bypass authentication practices
Social engineering overlaps with other bank fraud tactics and can impact customers and employees.
Password Spraying
Instead of trying to gain accurate login credentials, bad actors may attempt password spraying by pairing a large number of usernames with common passwords. By using bots to act at scale, attackers can eventually find accurate combinations and gain account access.
New Account Fraud
Existing accounts aren't the only ones at risk in the banking industry. New account fraud is another threat that has many implications. They may use someone else's identity to open a new account, or they may combine both real and fake identities to create a false account.
Know Your Customer (KYC) regulations help banks prevent new account fraud by verifying the individual's identity both when the account is opened and as the banking relationship continues.
Fraudulent Documents
Fake documents can be used as part of a new account fraud scheme. It's a way to make identity theft look real by using fake IDs, email addresses, or checks. Alternatively, cybercriminals may also create fake bank statements in order to get approved for a loan or other type of financing, either under a stolen identity or a false identity.
Check Fraud
Check fraud can occur in a few different ways. The most common type is fraudsters creating counterfeit checks. They look real and can be used either to make purchases or to withdraw funds from someone else's account. Check washing is another type of bank fraud that involves erasing ink from a stolen check (often from the mail). New payee details are then entered before the criminal goes to cash the check.
There are also mobile check deposit scams in which fraudsters give victims a fake check to deposit. The victim is then asked to return a portion of the funds (usually by money order, wire transfer, or gift card), before the check is ultimately flagged as fraudulent.
Money Laundering
Banks are responsible for anti-money laundering (AML) policies to curb criminals from using their bank accounts to house and transfer illegal funds. In addition to Know Your Customer requirements, banks must also incorporate customer due diligence (CDD), customer and transaction screening, and suspicious activity reporting. There are regulatory requirements in place to help reduce the risk of money laundering.
Authorized Push Payments
An authorized push payment (APP) is when a fraudster tricks the account holder into making a payment that is difficult to reverse. They may pose as a business offering goods or services, or create a false scenario involving an advance fee in exchange for a prize or investment. This is an example of how social engineering combines with digital tactics to take advantage of victims and convince them to send money to someone assuming a false identity.
Real-time Payment Fraud
Real-time payments are making transactions faster than ever, which means they're easy to exploit without the proper prevention methods in place. As criminals implement authorized push payment fraud, it's harder for financial institutions to identify these transactions and reverse them, since there is often no way to recall a real-time payment.
And because real-time payments often take place over smartphones and WiFi connections, fraudsters also have the opportunity to hijack sessions and steal credentials for future use.
Wire Fraud
Wire transfer scams are common, largely because fraudulent wires are difficult to reverse. Criminals use multiple strategies to convince individuals to wire money. There are several scenarios bank customers may come across.
While assuming a fake identity, fraudsters may solicit account numbers by calling or emailing individuals, all while posing as government agencies like the IRS or even family members.
Another element of wire transfer fraud is called "money muling." Unsuspecting individuals not involved with the money laundering scheme have their financial information or accounts used as the landing place for receiving the wired funds. Then the money is moved to the criminal's account, which offers some shielding and makes the stolen funds harder to track.
Many fraudsters also impersonate bank officials once a wire transfer takes place. The goal is to slow down the customer from reporting the transaction to the real bank, making it more difficult to recover the stolen money.
Bill Discounting Fraud
Bill discounting is a sophisticated scheme involving criminals who open a business account at a bank. They get the bank to bill the business's clients, who are also part of the scheme. The clients pay at first to establish a positive banking history.
After a while, however, the business asks the bank to credit the bills to their account — since there is a history of payment. Once those credits are made, the fake business owner drains the account, the clients never pay, and the bank loses the funds to this scheme.
