Cyber Fraud, Payment Systems, and Identity Theft
Cyber-enabled fraud is where payment rails, identity, and social engineering meet. CFBE tests whether you can name the scheme, identify the control that would have stopped it, and resist assuming that technology controls replace process.
Common schemes
- Business email compromise (BEC): impersonation of an executive or vendor to redirect a payment; variants include CEO fraud, vendor email compromise, and payroll diversion.
- Account takeover: stolen credentials, MFA bypass, session hijacking.
- Phishing, vishing, smishing: harvesting credentials and payment authorisations.
- Card-not-present fraud, card testing, and chargebacks.
- Check fraud: altered, washed, forged-endorsement, and counterfeit checks.
- Synthetic identity: fabricated identities combining real and invented data, built to pass KYC and then default or cash out.
Controls that matter
Callback verification to a previously known number, never a number supplied in the request. Dual authorisation on wires by amount threshold. Positive pay and reverse positive pay for checks. ACH debit blocks and filters. Segregation between vendor master maintenance and payment release. Device and IP anomaly monitoring, velocity rules, and out-of-band confirmation of bank-detail changes.
Worked example
An AP clerk receives an email that appears to come from the CFO, with the correct display name, asking for an urgent wire to a new beneficiary before a board meeting. The domain is the company's domain plus one letter.
Reasoning: the lookalike domain, urgency, secrecy, and unusual channel are BEC indicators. The clerk should call the CFO at the number in the directory, confirm no request was made, and report to security. The control failure is that the bank-detail change process accepted an emailed instruction; the fix is a documented change process with callback and dual approval.
Traps
- Trusting caller ID or display names.
- Assuming MFA prevents takeover, when real-time phishing proxies defeat one-time passcodes.
- Treating positive pay as protection against wire fraud; it covers checks.
- Overlooking breach-notification duties when identity data is exposed, such as GDPR's 72-hour notification and varying US state laws.