IIBF Cyber Crimes & Fraud key terms

A social engineering attack in which a fraudster sends an email or message that imitates a trusted bank, regulator or merchant, tricking the recipient into revealing credentials, card data or OTPs, or into approving a fraudulent transfer.

Voice-based phishing where a caller impersonates bank staff, police or a regulator to extract confidential data or pressure the customer into transferring funds, often using spoofed caller IDs to appear genuine.

Phishing conducted through SMS or messaging apps, typically delivering a malicious link or a fake alert about account blocking, reward points or KYC expiry to harvest credentials or install malware.

Manipulating a person into breaking normal security procedures by exploiting trust, fear, urgency or authority, rather than attacking technical systems directly. It underlies most customer-side payment fraud.

A fraud in which the criminal obtains a duplicate SIM for the victim's mobile number, usually through impersonation at a telecom outlet, so that OTPs and transaction alerts reach the fraudster instead of the customer.

Unauthorised control of a customer's bank or payment account obtained through stolen credentials, malware, SIM swap or insider help, after which the fraudster changes contact details and moves funds out.

An automated attack that replays username and password pairs leaked from one service against banking or payment logins, relying on customers reusing the same passwords across sites.

A single-use code delivered by SMS, email, token or app and valid only for a short window, used as a second factor. Fraudsters defeat it through SIM swap, phishing or malware that reads the SMS.

Login protection requiring two or more independent evidence types, such as something known, held or inherent. Regulators expect it for digital banking, and its strength depends on factors that cannot be intercepted or replayed.

Binding a cryptographic challenge to the specific payee, amount and currency of a payment so that an authentication code approved by the customer cannot be reused for a different transaction.

An attack where the criminal secretly relays or alters communication between customer and bank, for example by injecting a different payee into a session so funds go to the attacker's account.

Malicious software such as trojans, keyloggers, banking overlays or ransomware that compromises a customer or bank device to capture data, alter screens or block access until payment.

Malware that encrypts files or systems and demands payment, often in cryptocurrency, for restoration. For a bank it is both an operational resilience incident and an extortion crime requiring regulator notification.

Flooding a bank's internet-facing service with traffic from many compromised devices so genuine customers cannot transact. It is often used as cover while another fraud or data theft proceeds.

Systematically trying many passwords or PIN combinations until one works. Effective controls are lockouts, rate limiting, CAPTCHA and monitoring of repeated failed authentication attempts.

The documented process of detecting, containing, eradicating and recovering from a cyber incident, with defined roles, escalation paths, evidence preservation and communication to customers and regulators.

Notifying the regulator, CERT-In or other authorities of a cyber incident within prescribed timelines, covering the nature of the incident, affected systems, customer impact and remedial steps taken.

Documented arrangements, including backups, alternate sites and manual fallbacks, that let a bank keep critical services running or restore them quickly after cyber, fraud or disaster disruption.

A bank account opened or rented by a person who lets fraudsters route and withdraw illicit proceeds, often a student or low-income individual paid a small commission, concealing the money trail.

The process of disguising the origin of criminal proceeds through placement, layering and integration so they appear legitimate. Banks are obliged to detect and report suspicious activity.

Raising, moving or using funds for terrorist acts or organisations, which may involve small legitimate-looking amounts, so behaviour and links matter more than transaction size.

The set of legal, regulatory and institutional measures a bank applies to prevent funds reaching terrorist entities, including screening, reporting and targeted financial sanctions compliance.

The mandatory process of identifying a customer, verifying identity and address with reliable documents, and understanding the purpose of the relationship before and during account operation.

Ongoing identification, verification and risk profiling of a customer, plus monitoring of transactions, so the bank understands who it is dealing with and whether activity fits the profile.

Heightened measures applied to higher-risk customers such as politically exposed persons or cash-intensive businesses, including senior approval, source-of-funds checks and more frequent review.

The natural person who ultimately owns or controls an account or legal entity, or on whose behalf a transaction is made, and who must be identified even where a company is the named customer.

A person entrusted with prominent public functions, and their family members and close associates, who presents higher corruption risk and therefore attracts enhanced due diligence and senior sign-off.

An entity with no real operations, employees or assets, often used to hold accounts or layer funds while hiding the true owner. It is a recognised red flag in trade and corporate banking.

Assigning each customer a low, medium or high risk rating based on factors such as occupation, geography, product, channel and behaviour, which then determines the intensity of due diligence and monitoring.

Checking customers, beneficial owners and payment parties against regulatory and internal lists of designated persons and entities, at onboarding and on each transaction, to block prohibited dealings.

A confidential report a bank files with the financial intelligence unit when it knows, suspects or has reason to suspect that a transaction or activity involves proceeds of crime or terrorist financing.

Automated and manual review of customer transactions against rules and behaviour baselines to spot unusual patterns, such as rapid layering, structuring or activity inconsistent with the declared profile.

Splitting cash or transfers into amounts just below reporting thresholds to avoid triggering reporting obligations. It is itself a red flag and may be an offence even if the source funds are lawful.

Disclosing to a customer or third party that a suspicious transaction report has been or will be filed, which is prohibited because it can destroy evidence and undermine the investigation.

An indicator or warning sign, such as unusual transaction patterns, reluctant document provision or inconsistent customer behaviour, that signals possible fraud or money laundering and prompts further enquiry.

A rules- and analytics-based mechanism that flags accounts or branches showing emerging stress or fraud indicators, such as sudden dormant-account activation or unusual debit patterns, for preventive action.

Proactive supervision by staff and auditors to identify control gaps, collusion or process weaknesses before they become losses, through surprise checks, segregation of duties and staff accountability.

Splitting incompatible tasks, such as initiating, authorising and reconciling a transaction, among different people so that no single employee can commit and conceal a fraud alone.

A control in which one employee prepares or enters a transaction and a second, independent employee verifies and authorises it, preventing unilateral entry of payments, account changes or overrides.

A control requiring two authorised individuals to review and approve a decision or transaction, ensuring independent scrutiny and reducing the chance that a single person can commit or hide a fraud.

The structured examination of a suspected fraud, covering evidence collection, interviews, document and data analysis, quantification of loss, identification of control failures and recommendations for disciplinary or legal action.

An investigation-focused audit that examines records, electronic trails and documents to establish whether fraud occurred, quantify the loss and gather evidence suitable for disciplinary or court proceedings.

A chronological, tamper-evident record of system and user activity, including logins, data changes and approvals, that allows investigators to reconstruct who did what and when.

The requirement to keep system, access and transaction logs for a defined period so that investigations and audits can reconstruct events long after they occurred, as mandated by regulators.

Timely and accurate submission of prescribed returns, fraud data and incident notifications to the central bank or other authorities, with consequences for late, incomplete or incorrect filings.

A structured method for identifying the underlying process, people or system failure that allowed a fraud or incident, so that corrective action addresses the cause rather than only the symptom.

A card transaction reversal initiated by the issuer on the cardholder's dispute, which shifts the loss to the acquirer or merchant unless the merchant can prove the transaction was genuine and authorised.

Fraud using card details without the physical card, as in online or telephone purchases, where stolen data from phishing, skimming or breaches is used to buy goods or services.

Bank-led awareness efforts that teach customers to protect credentials and OTPs, verify links and callers, and report fraud quickly, reducing losses from social engineering and account takeover.