IIBF Cyber Crimes & Fraud flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Fraud Triangle

Model of fraud causation: pressure (financial motive), opportunity (weak controls), and rationalisation (justification). Banks reduce fraud mainly by shrinking opportunity through preventive and detective controls.

Residual Risk

The risk remaining after controls are applied, calculated as inherent risk (likelihood times impact) reduced by control effectiveness. Residual risk above the board-approved appetite must be treated or formally accepted.

Mule Account

A bank account opened or used to receive and quickly move proceeds of fraud. Indicators include bulk low-value credits, immediate transfers, shared KYC addresses, and dormancy followed by sudden activity.

SIM Swap Fraud

Fraud where the criminal obtains a duplicate SIM so OTPs and alerts reach them instead of the customer. Mitigation includes SIM-change cooling periods and out-of-band verification before reactivating mobile banking.

Account Takeover

Unauthorised control of a customer's account through stolen credentials, malware, or social engineering. Detection relies on device fingerprinting, geolocation anomalies, and behavioural velocity checks.

Zero Liability Rule

Under RBI customer-protection norms, a customer bears zero liability for unauthorised electronic transactions caused by bank negligence or third-party breach, provided the bank is notified promptly.

Multi-Factor Authentication

Authentication using factors from at least two distinct categories: knowledge, possession, or inherence. Two passwords are not MFA because both are knowledge factors.

Hashing Versus Encryption

Hashing is one-way and proves integrity without providing confidentiality; encryption is reversible with a key and provides confidentiality. Passwords are stored as salted hashes, never as encrypted text.

DMARC

Email authentication policy built on SPF and DKIM that tells receiving servers what to do with mail failing alignment, and reports results to the domain owner. It reduces phishing spoofing.

Network Segmentation

Splitting the network into zones so that cardholder-data and critical systems are isolated from the corporate network. It limits lateral movement and reduces PCI DSS scope.

Incident Response Lifecycle

Structured phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Digital evidence must be preserved with documented chain of custody.

Chain of Custody

A documented, unbroken record of who handled digital evidence, when, and how, from seizure to court. Gaps in the record can render forensic evidence inadmissible.

Man-in-the-Browser Attack

Malware inside the customer's browser alters transaction details after the OTP is validated, so the customer authorises one payment while another executes. Mitigation is out-of-band confirmation of payee and amount.

RTO and RPO

Recovery Time Objective is the maximum tolerable downtime for a service; Recovery Point Objective is the maximum tolerable data loss measured in time. Both are defined per critical digital service.

Third-Party Risk

Outsourcing does not transfer accountability. Contracts must include audit rights, breach-notification timelines, data return or destruction, and controls over sub-contracting and offshoring.

DPDP Act 2023

India's data protection law requiring purpose limitation, consent, data minimisation, breach notification to the Data Protection Board, and erasure on withdrawal of consent for digital personal data.

Synthetic Identity Fraud

A fabricated identity combining real and fictitious data, used to open accounts and build credit. Detection uses device fingerprinting, document verification, and cross-checking against bureau and negative databases.

Change Management Control

Rules ensuring no code reaches production without testing, developer-deployer segregation, approval, and rollback plans. Uncontrolled change is a leading cause of digital banking outages.

Customer Due Diligence

Minimum KYC elements: identify and verify the customer, identify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring proportionate to risk.

Beneficial Owner Threshold

For legal entities and arrangements in India, the beneficial owner is the natural person holding 10% or more of shares, capital, or profits, or exercising control by other means.

Politically Exposed Person

A senior political figure, family member, or close associate. PEPs require enhanced due diligence, senior-management approval, and continued risk assessment after they leave office.

Suspicious Transaction Report

A report filed with FIU-IND when a transaction appears linked to proceeds of crime or lacks apparent economic rationale. Tipping off the customer about the report is prohibited.

Tipping Off

Disclosing to a customer or third party that a suspicious transaction report has been or will be filed. It is a prohibited act because it can defeat the investigation.

Record Retention Under AML

CDD records and transaction records must be retained for at least five years after the business relationship ends or after the transaction was conducted, and produced to regulators on demand.

Sanctions Screening

Checking customers and payments against UNSC, OFAC, and domestic lists at onboarding and on every list update. Name matches generate false positives requiring documented adjudication.

Maker-Checker Control

Two-person control where one official initiates and another independently authorises a transaction. It fails when the checker rubber-stamps without genuine verification of the underlying details.

Job Rotation

Mandatory periodic transfer of staff in sensitive roles such as cash, treasury, credit, and IT operations. It breaks frauds that depend on one person's continuous, unchallenged presence.

Dormant Account Controls

Inactive accounts must not be debited without reactivation and re-KYC, and reactivation must be authorised above the branch operator level to prevent insider misuse of forgotten balances.

Whistle-Blower Channel

A confidential, protected reporting route for staff to flag misconduct without retaliation. It is the primary detection mechanism for insider collusion that controls cannot see.

Fraud Monitoring System

The RBI reporting system to which banks submit fraud cases in the prescribed format and timeline. Fraud classification also triggers provisioning and staff-accountability consequences.

Red-Flagged Account

A borrower account marked in the caution registry for fraud, restricting access to fresh credit across the banking system. Marking and removal require documented, authorised decisions.