CFCI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Placement

The first stage of money laundering, in which illicit cash is introduced into the financial system through deposits, purchases, or currency exchanges, often using structuring or smurfing to avoid reporting thresholds.

Layering

The second money laundering stage, using transfers, trades, shell companies, or conversions to obscure the audit trail and separate funds from their criminal origin.

Integration

The final money laundering stage, in which laundered funds re-enter the legitimate economy as apparently lawful assets such as real estate, investments, or business revenue.

Structuring

Deliberately breaking cash transactions into amounts below reporting thresholds to evade currency transaction reporting requirements; it is itself a criminal offense in many jurisdictions.

Suspicious Activity Report

A confidential filing by a financial institution to the financial intelligence unit reporting transactions that may involve illegal activity or have no apparent lawful purpose.

Currency Transaction Report

A regulatory filing required in the United States for cash transactions exceeding ten thousand dollars in a single business day, used to create an audit trail for large cash movements.

Beneficial ownership

The natural persons who ultimately own or control an entity; common thresholds require identification of individuals holding twenty-five percent or more ownership or control.

Fraud triangle

A model explaining fraud as the convergence of pressure or incentive, opportunity, and rationalization; the fraud diamond adds capability as a fourth element.

Trade-based money laundering

Moving value across borders through mispriced, misdescribed, or fictitious trade transactions, often detected through invoice and shipping document mismatches.

Phishing

A social engineering attack using deceptive messages that impersonate trusted parties to induce recipients to reveal credentials, authorize payments, or open malicious attachments.

Business email compromise

A fraud in which an attacker impersonates an executive or vendor to redirect payments or obtain sensitive data, often signaled by changed bank details and urgency.

Ransomware

Malware that encrypts or steals data and demands payment for decryption or non-disclosure; double extortion combines encryption with threatened data leak.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques organized by stage of intrusion, used to map detections, threat intelligence, and control coverage.

Credential stuffing

An attack that replays username and password pairs breached elsewhere against many services, exploiting password reuse; detected through distributed login bursts and high failure rates.

Command and control

Infrastructure and channels attackers use to communicate with compromised systems, often targeted in takedowns through domain sinkholing and hosting provider action.

Card-not-present fraud

Unauthorized use of payment card details without physical possession of the card, common in e-commerce and flagged by address mismatches and geolocation inconsistencies.

Vishing

Voice-based social engineering in which an attacker telephones a target while impersonating a bank, authority, or colleague to extract information or authorize transfers.

Smishing

Phishing delivered by text message or messaging app, typically containing a malicious link or a request to call a fraudulent number.

Order of volatility

A forensic collection principle ranking evidence from most to least volatile: registers and cache, memory, network state, disk, remote logs, and archival media.

Chain of custody

Documentation of who collected, handled, and transferred evidence, with dates, times, and signatures, showing an unbroken record that supports admissibility.

Write blocker

A hardware or software device that prevents write operations to a source drive during acquisition, preserving evidence integrity while a forensic image is created.

Forensic imaging

Creating a bit-for-bit copy of a storage device, verified by comparing cryptographic hashes of the source and the image before analysis begins.

Timestomping

Manipulation of file system timestamps to mislead investigators; detected when NTFS standard information and file name timestamps conflict or precede other artifacts.

File carving

Recovering files from unallocated space by identifying known file signatures and structures rather than relying on file system metadata.

Prefetch

A Windows artifact recording program execution, including executable name, run count, and referenced file paths, useful for establishing that a program ran.

PCAP analysis

Examination of captured network packets to reconstruct sessions, identify exfiltration volume and destinations, and corroborate host-based findings.

Incident response phases

Preparation, identification, containment, eradication, recovery, and lessons learned; containment decisions balance stopping harm against preserving evidence.

Mean time to detect

The average elapsed time between an incident's occurrence and its detection; a key metric distinguishing internally detected incidents from externally reported ones.

Address clustering

A blockchain analysis heuristic grouping addresses likely controlled by one entity, using common-input ownership and change-address behavior in transaction graphs.

Coinjoin

A collaborative transaction structure in which multiple parties combine inputs and outputs, obscuring direct links between senders and recipients on a public blockchain.

Stablecoin tracing

Following on-chain transfers of price-stable tokens used in fraud and ransomware payments; records include transaction hashes, block heights, addresses, and amounts.

BSA AML program

The US Bank Secrecy Act requires internal controls, a designated compliance officer, ongoing training, and independent testing as the four pillars of an AML program.