Identity Theft and Fraud Controls
Identity Theft and Fraud Controls tests how to prevent, detect, and respond to someone using another person's identity or a fabricated identity to obtain value. The exam covers account takeover, synthetic identity, new-account fraud, credential stuffing, phishing, social engineering, and insider misuse. Fraud controls must balance friction with accessibility and recovery.
Core rules and concepts
- Identity proofing establishes that a claimed identity exists and belongs to the applicant. Strength depends on evidence type, verification method, and binding to the applicant.
- Authentication controls reduce takeover: MFA resistant to phishing (passkeys or hardware tokens), device binding, risk-based step-up, and secure recovery.
- Fraud detection uses velocity checks, geo or device anomaly, behavioral biometrics, consortium signals, and rules or models. Alerts need case management and feedback.
- Synthetic identity fraud combines real and fabricated data; it often passes weak checks because no victim complains. Controls include document validation, data consistency checks, and credit or bureau signals where appropriate.
- Social engineering bypasses technology; controls include out-of-band verification, callback to a known number, employee scripts, and separation of duties for changes.
- Response includes session revocation, credential reset, account freeze, customer notification, and evidence preservation.
Worked example
A user's password is reset, then a new device logs in from another country and attempts a high-value transfer. The risk engine scores the session high because of new device, impossible travel, and recent credential change. The correct reasoning is to step up authentication, verify the transfer out of band, and hold the session; a simple password reset is insufficient because the attacker may already control the credential. If fraud is confirmed, revoke sessions, freeze the account, and preserve logs.
Traps that cost marks
Relying on knowledge-based questions; treating SMS OTP as phishing-resistant; confusing fraud detection with credit scoring; blocking a customer without a recovery path; and closing a fraud alert without documenting the decision.