I85PREP
⌘ K
IIBF Cyber Crimes & Fraud study materials
IIBF Cyber Crimes & Fraud study resources

IIBF Cyber Crimes & Fraud practice questions

One question at a time. Build your IIBF Cyber Crimes & Fraud understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Crimes and Fraud Risk Management

In banking terminology, what distinguishes a 'cyber crime' from a conventional financial fraud such as a forged cheque presented at a branch counter?

  1. The act uses a computer or communication network as the means or target Correct answer.
  2. The victim must be a corporate account holder rather than an individual
  3. The offence must be committed by an employee of the bank
  4. The loss amount must exceed the bank's insurance threshold

Explanation

Cyber crime is characterised by the use of computers, networks or digital channels as the instrument or the target of the offence, whereas conventional fraud relies on physical documents or personal deception at a counter. The defining test is the role of the computing or communication system, not the size of the loss, the identity of the offender or the type of account holder.

Question 2Cyber Crimes and Fraud Risk Management

A customer receives an SMS that appears to come from the bank's official sender ID, asking them to re-verify their debit card PIN on a link. Which term best describes this attack?

  1. SIM swap fraud
  2. Cross-site scripting
  3. Phishing delivered through smishing Correct answer.
  4. Card skimming at an ATM

Explanation

When a fraudulent message is delivered by SMS to harvest credentials, the technique is called smishing, a form of phishing. The sender-ID spoofing makes the message look genuine, but the objective is to capture the PIN through a fake page.

Question 3Cyber Crimes and Fraud Risk Management

Which control most directly reduces the risk of Man-in-the-Middle interception of internet banking sessions on a public Wi-Fi network?

  1. Enforcing TLS with certificate pinning in the mobile banking app Correct answer.
  2. Increasing the customer's daily transaction limit
  3. Storing session tokens in the device's plain-text log file
  4. Disabling transaction alerts to reduce message traffic

Explanation

Man-in-the-Middle attacks depend on the attacker being able to intercept or impersonate the secure channel. Enforcing TLS with certificate pinning prevents the app from trusting a fraudulently presented certificate, closing that gap.

Question 4Cyber Crimes and Fraud Risk Management

Under typical Indian regulatory expectations, how soon after detecting a cyber incident must a bank report it to the appropriate authorities such as CERT-In?

  1. Within 72 hours of detection
  2. At the end of the financial year in the annual report
  3. Within six hours of detection Correct answer.
  4. Within 24 hours of detection

Explanation

CERT-In directions require specified cyber security incidents to be reported within six hours of noticing them. This tight window supports rapid containment and coordination with the national incident response machinery.

Question 5Cyber Crimes and Fraud Risk Management

What is the primary purpose of tokenisation in card transactions?

  1. To convert the card into a contactless-only instrument
  2. To reduce the interchange fee charged to merchants
  3. To extend the validity period of the card
  4. To replace the card number with a surrogate value so merchants never store the real PAN Correct answer.

Explanation

Tokenisation substitutes a unique surrogate, the token, for the primary account number so that merchants and payment intermediaries hold no usable card data. If a merchant database is breached, the stolen tokens cannot be reused as card numbers.

Question 6Cyber Crimes and Fraud Risk Management

A fraudster obtains a customer's card details and uses them to make several small online purchases, each just below the bank's alert threshold. Which term describes this pattern?

  1. Account takeover
  2. Chargeback abuse
  3. Card testing Correct answer.
  4. Friendly fraud

Explanation

Card testing is the practice of making low-value transactions to confirm that stolen card details are valid and active before attempting larger fraud. The sub-threshold amounts are chosen to avoid triggering alerts.

Question 7Cyber Crimes and Fraud Risk Management

Which of the following best describes 'vishing'?

  1. Intercepting Bluetooth traffic at an ATM lobby
  2. Injecting malicious SQL into a login form
  3. Using a telephone call to trick a victim into revealing confidential information Correct answer.
  4. Sending malware through a USB device left in a car park

Explanation

Vishing is voice phishing: the attacker telephones the victim, often impersonating bank staff or police, and manipulates them into disclosing credentials, OTPs or card data. The channel is the telephone call rather than email or SMS.

Question 8Cyber Crimes and Fraud Risk Management

In an ATM 'jackpotting' attack, what is the fraudster attempting to achieve?

  1. Diverting the ATM's CCTV feed to a remote server
  2. Cloning the customer's magnetic stripe to make a duplicate card
  3. Changing the receipt paper to capture card details
  4. Forcing the machine to dispense cash without a valid transaction authorisation Correct answer.

Explanation

Jackpotting involves installing malware or hardware on the ATM so that it dispenses cash on command, bypassing normal authorisation by the host system. It attacks the machine's dispensing logic rather than customer credentials.

Question 9Cyber Crimes and Fraud Risk Management

A bank wants to detect unusual transactions in real time without stopping genuine customer payments. Which approach is most appropriate?

  1. Reviewing transactions only during the monthly reconciliation
  2. Increasing all customers' daily limits to reduce false declines
  3. Scoring each transaction against behavioural rules and machine-learning models, then stepping up authentication for high scores Correct answer.
  4. Blocking all international transactions permanently

Explanation

Real-time risk scoring combines rules and models to rank each transaction by likelihood of fraud, allowing the bank to apply proportionate friction such as step-up authentication instead of blanket blocking. This balances fraud loss against customer experience.

Question 10Cyber Crimes and Fraud Risk Management

Which of the following is the strongest indicator of a possible SIM swap fraud in progress?

  1. The customer's card is used at a merchant in the same city
  2. The customer's mobile number suddenly stops receiving OTPs while a new device registers for mobile banking Correct answer.
  3. The customer requests a higher transaction limit at a branch
  4. The customer's email address is updated in the CRM after a branch visit

Explanation

SIM swap fraud works by porting the victim's number to a SIM controlled by the attacker so that OTPs go to the fraudster. Loss of OTP delivery combined with a new device enrolment is therefore a strong warning signal.

Question 11Cyber Crimes and Fraud Risk Management

During a ransomware incident, a bank's first priority should be to:

  1. Notify all customers before assessing the scope
  2. Delete encrypted files to free up storage
  3. Isolate affected systems, preserve evidence and activate the incident response plan Correct answer.
  4. Pay the ransom immediately to restore services

Explanation

Containment and evidence preservation come first so the infection does not spread and forensic analysis remains possible, guided by the pre-approved incident response plan. Paying the ransom is discouraged because it funds criminals and does not guarantee recovery.

Question 12Cyber Crimes and Fraud Risk Management

What is the principal risk created by 'credential stuffing' attacks against a bank's internet banking portal?

  1. Corruption of the core banking database indexes
  2. Interception of ATM cash cassettes
  3. Use of leaked username-password pairs from other breaches to log in where customers reuse credentials Correct answer.
  4. Physical damage to the data centre

Explanation

Credential stuffing exploits password reuse: attackers replay large volumes of stolen credentials from unrelated breaches against the bank's login page. Controls such as breached-password screening, rate limiting and device fingerprinting reduce the risk.

Question 13Cyber Crimes and Fraud Risk Management

A customer claims they never authorised a series of UPI transfers made from their phone. Investigation shows the transfers occurred after the customer installed a screen-sharing app at a caller's request. What is the most likely modus operandi?

  1. Cross-site request forgery on the bank's website
  2. Insider collusion by branch staff
  3. Remote-access social engineering that captured the UPI PIN Correct answer.
  4. ATM skimming

Explanation

Fraudsters persuade victims to install remote-access or screen-sharing software, then observe or control the device to capture the UPI PIN and approve transfers. The customer's own device and credentials are used, which is why the transfers appear genuine to the system.

Question 14Cyber Crimes and Fraud Risk Management

Which measure best mitigates the risk of 'man-in-the-browser' malware altering a payee's account number during an online transfer?

  1. Transaction signing with out-of-band confirmation of the payee and amount on a separate device Correct answer.
  2. Relying solely on the password entered on the login page
  3. Displaying the payee details only on the infected browser
  4. Increasing the session timeout to several hours

Explanation

Man-in-the-browser malware can modify what the customer sees and submits within the browser, so any confirmation rendered in that same browser is untrustworthy. Out-of-band transaction signing on a separate trusted device lets the customer verify the actual payee and amount before authorisation.

Question 15Cyber Crimes and Fraud Risk Management

In the context of card-not-present fraud, why is the CVV considered a weak control when a merchant stores it?

  1. Because the CVV changes with every transaction
  2. Because storing the CVV alongside the PAN means a breach exposes everything needed to counterfeit online transactions Correct answer.
  3. Because the CVV is verified only by the issuer's branch
  4. Because the CVV is printed only on the card's magnetic stripe

Explanation

The CVV is a static verification value, so if a merchant retains it with the card number, a single breach hands attackers a complete, reusable data set for online fraud. PCI DSS therefore prohibits storing the CVV after authorisation.

Question 16Cyber Crimes and Fraud Risk Management

What does a 'money mule' account typically look like to a bank's monitoring system?

  1. A salary account with a single monthly credit from a registered employer
  2. A joint account used only for utility bill payments
  3. A dormant account that suddenly receives many small credits from unrelated parties and forwards them rapidly abroad Correct answer.
  4. A fixed deposit that matures after one year

Explanation

Money mule accounts are used to layer and move criminal proceeds, so they show rapid in-and-out flows, multiple unrelated counterparties and immediate onward transfers, often across borders. Such behaviour is inconsistent with the account's stated profile.

Question 17Cyber Crimes and Fraud Risk Management

Which of the following best explains why 'deepfake' voice or video impersonation raises the risk of authorised push payment fraud?

  1. It encrypts the payment message so the bank cannot read it
  2. It convinces the victim that a trusted person is instructing the payment, so the victim authorises it voluntarily Correct answer.
  3. It bypasses the bank's firewall to reach the core system
  4. It exploits a flaw in the payment switch's routing table

Explanation

Authorised push payment fraud succeeds because the customer genuinely authenticates and instructs the payment themselves. Deepfake audio or video removes the victim's doubt about the caller's identity, so no technical control on the bank's side is breached.

Question 18Cyber Crimes and Fraud Risk Management

A bank's fraud team observes that a single device fingerprint is associated with 40 newly opened accounts, all receiving government subsidy credits within a week. Which typology is most consistent with this pattern?

  1. Synthetic identity fraud using a shared device to open mule accounts Correct answer.
  2. Card skimming at a single ATM
  3. Insider trading in the bank's securities arm
  4. Distributed denial of service against the portal

Explanation

Synthetic or mule account rings often reuse the same device, IP range or contact details to open multiple accounts that then receive credits for rapid withdrawal. Device-linkage analytics expose the shared infrastructure behind apparently unrelated customers.

Question 19Cyber Crimes and Fraud Risk Management

Which practice most effectively reduces insider fraud risk in a core banking environment?

  1. Allowing staff to disable audit logging during peak hours
  2. Giving all operations staff a single shared login to simplify audits
  3. Rotating staff between branches without any access review
  4. Enforcing least privilege with maker-checker authorisation and immutable audit logs Correct answer.

Explanation

Least privilege limits what any single employee can do, maker-checker prevents unilateral action, and immutable logs ensure activity can be traced. Together these controls make insider manipulation of accounts or limits detectable and harder to accomplish.

Question 20Cyber Crimes and Fraud Risk Management

In the context of cyber insurance and fraud loss allocation, why do banks insist on strong customer authentication for high-value payments?

  1. Because it eliminates the need for anti-money-laundering monitoring
  2. Because it guarantees that no fraud can ever occur
  3. Because it removes the bank's obligation to report incidents
  4. Because it shifts liability for unauthorised transactions to the party that failed to apply the required authentication Correct answer.

Explanation

Regulatory and scheme rules allocate liability based on whether strong customer authentication was applied, so a bank that authenticates properly is better protected when a disputed transaction is assessed. Authentication also strengthens the evidentiary position in customer compensation claims.

Question 21Cyber Crimes and Fraud Risk Management

A fraudster registers a domain name that closely resembles the bank's own, using a different character set, and hosts a replica login page. Which attack does this describe?

  1. Typosquatting with IDN homograph characters for credential harvesting Correct answer.
  2. Bluejacking
  3. Session fixation on the mobile app
  4. DNS cache poisoning of the bank's authoritative server

Explanation

Internationalised domain name homograph attacks use visually similar characters from other scripts so the lookalike domain appears legitimate to the victim, who then enters credentials on the replica site. It is a phishing technique built on deceptive domain registration.

Question 22Cyber Crimes and Fraud Risk Management

An analyst finds that an attacker used valid API keys taken from a public code repository to query customer balance endpoints. Which control failure is most directly implicated?

  1. Weak ATM cash replenishment scheduling
  2. Inadequate secret management and repository scanning for exposed credentials Correct answer.
  3. Insufficient branch CCTV coverage
  4. Absence of a disaster recovery site

Explanation

Hard-coded or committed API keys in public repositories are a classic secret-management failure; automated repository scanning and key rotation would have detected or neutralised them. The attacker needed no exploit because legitimate credentials were available.

Question 23Cyber Crimes and Fraud Risk Management

Which feature of a blockchain analytics tool is most useful to a bank investigating ransomware payments linked to a customer account?

  1. Decryption of ransomware-encrypted files
  2. Generation of new wallet addresses for customers
  3. Automatic reversal of on-chain transactions
  4. Cluster attribution of wallet addresses to known criminal services and sanction lists Correct answer.

Explanation

Blockchain analytics clusters addresses and attributes them to exchanges, mixers or sanctioned entities, giving investigators traceable links between a customer's wallet and known illicit services. On-chain transactions are irreversible, so reversal is not a capability of such tools.

Question 24Cyber Crimes and Fraud Risk Management

A bank wants to reduce false positives in its anti-fraud alerting without weakening detection. Which combination is most sound?

  1. Tuning thresholds using historical alert outcomes, enriching alerts with device and behavioural data, and measuring precision and recall Correct answer.
  2. Removing all rules and relying only on customer complaints
  3. Reviewing alerts only after losses exceed a fixed amount
  4. Disabling alerts for customers who travel abroad

Explanation

Alert quality improves when thresholds are calibrated against known outcomes and alerts are enriched with context such as device reputation and behavioural baselines. Tracking precision and recall ensures detection is not traded away while noise is reduced.

Question 25Cyber Crimes and Fraud Risk Management

Why is 'account takeover' typically harder to detect than a stolen-card fraud using a cloned card?

  1. Cloned cards generate no transaction records at all
  2. Account takeover uses the genuine customer's own credentials and device context, so authentication and behavioural signals appear normal Correct answer.
  3. Account takeover transactions are always below one rupee
  4. Account takeover always involves physical intrusion into a branch

Explanation

In account takeover the attacker logs in with valid credentials, often after phishing or malware, so authentication succeeds and only subtle behavioural deviations such as a new device, unusual payee or changed contact details reveal the compromise. Cloned-card fraud, by contrast, often shows terminal or geography anomalies.

Question 26Cyber Crimes and Fraud Risk Management

Under the RBI's cyber security framework for banks, what is the primary purpose of a Cyber Crisis Management Plan (CCMP)?

  1. To define the marketing budget for digital banking products
  2. To list the names of customers eligible for chargeback
  3. To provide a documented, tested response structure for detecting, containing and recovering from cyber incidents Correct answer.
  4. To calculate the interest rate applicable to fraudulent loan accounts

Explanation

A CCMP is a documented playbook that assigns roles, escalation paths, communication lines and recovery steps so that a bank can respond to a cyber incident in a coordinated way. It must be tested through drills and updated as the threat landscape and systems change. Its focus is response and resilience, not commercial or accounting functions.

Question 27Cyber Crimes and Fraud Risk Management

Which term describes the fraudulent practice of sending emails that appear to come from a bank's genuine domain in order to harvest internet banking credentials?

  1. Spoofing a POS terminal
  2. Pharming
  3. Phishing Correct answer.
  4. Skimming

Explanation

Phishing uses deceptive emails that mimic a trusted institution to trick recipients into revealing credentials or clicking malicious links. Pharming instead redirects users to fake sites through DNS or host-file manipulation without needing a lure email. Skimming involves copying card data at a physical terminal.

Question 28Cyber Crimes and Fraud Risk Management

A bank customer receives an SMS stating that their KYC is expiring and asking them to install an APK file sent via link to complete re-verification. What fraud typology does this represent?

  1. Cheque alteration fraud
  2. Cross-site scripting on the bank's website
  3. SIM swap fraud
  4. Android banking trojan distributed through social engineering Correct answer.

Explanation

Sideloading an APK from a link in an SMS is a classic delivery route for Android banking trojans, which then overlay fake login screens or intercept OTPs. The social-engineering pretext of expiring KYC is used to get the victim to install the malicious app. SIM swap and web application attacks operate through entirely different mechanisms.

Question 29Cyber Crimes and Fraud Risk Management

In UPI fraud investigations, what does the term 'collect request' abuse refer to?

  1. A fraudster sending a payment request that debits the victim when the victim approves it believing they will receive money Correct answer.
  2. A regulator collecting statutory returns from the bank
  3. A bank collecting KYC documents from a customer
  4. A merchant collecting card details at the point of sale

Explanation

A collect request is a pull transaction in UPI where the requester asks to be paid. Fraudsters disguise it as a refund or prize and persuade the victim to approve it, which actually debits the victim's account. The core deception is reversing the victim's understanding of the direction of money flow.

Question 30Cyber Crimes and Fraud Risk Management

Which control most directly limits the damage a single compromised employee credential can cause in a bank's payment operations?

  1. Least-privilege role design combined with maker-checker authorisation Correct answer.
  2. Publishing the internal payment approval hierarchy on the intranet
  3. Increasing the password length to twelve characters
  4. Mandatory annual leave for all staff

Explanation

Least privilege ensures an employee can only reach the functions required for the role, and maker-checker prevents one person from both initiating and approving a payment. Together they cap what a single stolen credential can achieve. Longer passwords help authentication but do not limit the scope of an authorised session.

Question 31Cyber Crimes and Fraud Risk Management

What is the principal objective of a business email compromise (BEC) attack directed at a corporate banking customer?

  1. To overload the bank's servers with traffic
  2. To trick the customer's staff into making an authorised payment to a fraudster-controlled account Correct answer.
  3. To encrypt the customer's files and demand a ransom
  4. To steal card track data from the customer's POS devices

Explanation

BEC relies on impersonation or mailbox takeover to insert fraudulent payment instructions into a genuine business conversation, so the victim authorises the transfer themselves. There is usually no malware payload and no card data involved. The fraud succeeds because the payment is validly authenticated.

Question 32Cyber Crimes and Fraud Risk Management

A customer reports that a debit appeared on their statement from a merchant they do not recognise, but the card was never out of their possession. Which fraud type should the dispute team first consider?

  1. Physical theft of the card
  2. Card-not-present fraud using data leaked from a merchant database Correct answer.
  3. Cheque forgery
  4. Counterfeit card cloning at an ATM

Explanation

When the physical card remains with the customer but unauthorised charges appear, the card data has usually been compromised elsewhere, for example through a merchant data breach, and used online. Cloning requires the data to be captured at a terminal, and physical theft would leave the customer without the card.

Question 33Cyber Crimes and Fraud Risk Management

Which of the following is a characteristic feature of a 'phishing kit' sold in criminal markets?

  1. A licence to operate a payment aggregator
  2. A hardware device fitted to an ATM card slot
  3. A pre-built counterfeit login page with backend capture of entered credentials Correct answer.
  4. A physical printer for counterfeit currency

Explanation

Phishing kits package ready-made counterfeit pages, hosting templates and exfiltration scripts so that low-skilled criminals can run campaigns without writing code. Credentials entered on the fake page are relayed to the attacker or a drop mailbox. They are software artefacts, not physical devices.

Question 34Cyber Crimes and Fraud Risk Management

A bank's security team wants to detect that a customer's online session has been hijacked after login. Which indicator is most consistent with session hijacking rather than a normal login?

  1. A password reset requested by the customer through the branch
  2. A failed login followed by a successful retry with the correct password
  3. A login from the customer's usual device at the usual hour
  4. A session cookie reused from a different IP address and device fingerprint shortly after authentication Correct answer.

Explanation

Session hijacking means the attacker steals a valid session token and continues the session from their own infrastructure, so the IP address and device fingerprint change mid-session while authentication is not repeated. A normal login shows consistent device and location attributes. Failed-then-successful logins and branch password resets are routine events.

Question 35Cyber Crimes and Fraud Risk Management

In a distributed denial-of-service attack against a bank's internet banking front end, what is the most appropriate immediate mitigation?

  1. Disabling all customer accounts until the attack ends
  2. Increasing the transaction limit for affected customers
  3. Deleting the web server logs to free disk space
  4. Activating traffic scrubbing through an upstream anti-DDoS service and rate limiting Correct answer.

Explanation

Anti-DDoS scrubbing centres filter volumetric and application-layer attack traffic before it reaches the bank, and rate limiting reduces the effect of request floods. These preserve availability for genuine customers. Deleting logs destroys forensic evidence and disabling accounts harms customers without addressing the flood.

Question 36Cyber Crimes and Fraud Risk Management

An analyst reviewing a suspected mule network notices many accounts sharing a single registered mobile number and a common beneficiary set, with funds moving out within minutes of receipt. Which analytic approach best exposes the wider network?

  1. Reviewing each account's transaction history in isolation
  2. Waiting for customers to complain before investigating
  3. Link analysis across shared attributes such as device, phone number and beneficiaries Correct answer.
  4. Checking only whether each account has valid KYC documents

Explanation

Link analysis builds a graph of relationships between accounts, devices, phone numbers and beneficiaries, revealing clusters that individual reviews would miss. Shared attributes plus rapid pass-through of funds are strong network indicators. Isolated review, KYC checks and complaint-driven detection all fail to surface the connected structure.

Question 37Cyber Crimes and Fraud Risk Management

Why does tokenisation of card data reduce the impact of a merchant data breach?

  1. It encrypts the card number using a key held by the merchant
  2. It removes the need for customer authentication at checkout
  3. It transfers fraud liability entirely to the card network
  4. It replaces the card number with a surrogate value that is useless outside the intended domain Correct answer.

Explanation

Tokenisation substitutes the primary account number with a token that maps back to the real number only within a defined domain or acceptance context. A thief who steals tokens from a merchant cannot reuse them elsewhere. The real card number is never stored by the merchant, so the breach yields little usable data.

Question 38Cyber Crimes and Fraud Risk Management

A bank detects that several customers received OTPs for transactions they did not initiate, and the OTPs were delivered to a number the fraudster controls. Which attack most likely preceded this?

  1. SIM swap Correct answer.
  2. Ransomware on the core banking server
  3. SQL injection on the bank's database
  4. Cross-site request forgery

Explanation

If OTP messages reach a number controlled by the fraudster, the victim's mobile number has probably been ported to a SIM held by the attacker, which is a SIM swap. The fraudster then initiates transactions and receives the OTPs. CSRF, SQL injection and ransomware do not redirect SMS delivery.

Question 39Cyber Crimes and Fraud Risk Management

Which practice best protects against fraud arising from a compromised third-party service provider connected to the bank?

  1. Contractual security obligations, periodic assurance reviews and least-privilege integration Correct answer.
  2. Allowing the provider unrestricted network access to simplify support
  3. Sharing the bank's core database credentials with the provider for convenience
  4. Relying on the provider's self-declaration of security

Explanation

Third-party risk is managed through enforceable contractual security clauses, independent assurance such as audits or certifications, and integration that grants only the access required. Least privilege limits what a compromise at the provider can reach. Self-declaration, credential sharing and open network access all increase exposure.

Question 40Cyber Crimes and Fraud Risk Management

A customer's account shows a series of small outgoing transfers to newly added beneficiaries, each followed by immediate withdrawal at ATMs in a distant city. Which combination of indicators most strongly suggests account takeover?

  1. Regular salary credit and monthly bill payments
  2. New beneficiary addition, rapid pass-through of funds and atypical geographic withdrawal Correct answer.
  3. A single large transfer to a long-standing beneficiary
  4. Interest credit and standing instruction to a mutual fund

Explanation

Account takeover typically shows a change in the account's operating pattern: new payees, immediate cash-out and activity in locations inconsistent with the customer's history. These behavioural deviations together are far more telling than any one signal. Routine salary, bill, standing-instruction and interest entries reflect normal account behaviour.

Question 41Cyber Crimes and Fraud Risk Management

In the context of ATM security, what does 'logical jackpotting' refer to?

  1. Installing malware or connecting a device that commands the dispenser to release cash Correct answer.
  2. Cloning a customer's card at the ATM slot
  3. Physically forcing open the cash dispenser
  4. Shoulder surfing a customer's PIN

Explanation

Logical jackpotting uses software or hardware interfaces to issue dispense commands to the ATM, bypassing normal transaction controls. It differs from physical attacks on the cash safe. Cloning and shoulder surfing target customer credentials rather than the dispenser mechanism.

Question 42Cyber Crimes and Fraud Risk Management

A bank wants to strengthen authentication for high-value internet banking transfers without adding friction for low-risk logins. Which design best achieves this?

  1. Disabling transaction alerts to reduce customer calls
  2. Sending the same OTP to the registered mobile for every action
  3. Requiring a static password only
  4. Applying risk-based step-up authentication triggered by transaction value and behavioural signals Correct answer.

Explanation

Risk-based step-up keeps the customer experience light for routine activity while demanding stronger factors when value or behaviour signals elevated risk. This balances security with usability. Static passwords alone are weak, blanket OTPs add friction, and removing alerts reduces the customer's ability to detect fraud.

Question 43Cyber Crimes and Fraud Risk Management

Why is a 'money mule' recruitment scheme often difficult to prosecute as fraud against the mule themselves?

  1. Because mule accounts are always opened with forged documents
  2. Because mule accounts never use electronic channels
  3. Because the mule may genuinely believe the funds are legitimate, so intent to defraud is hard to establish Correct answer.
  4. Because mule transfers are always below reporting thresholds

Explanation

Many mules are recruited through fake job or romance pretexts and may not know the funds are criminal proceeds, which complicates proof of dishonest intent. Investigators must therefore rely on circumstantial indicators such as account turnover and instructions received. Forged documents, threshold structuring and channel type are separate issues.

Question 44Cyber Crimes and Fraud Risk Management

A bank's fraud system flags an unusually high number of genuine transactions as suspicious. Which change is most likely to reduce false positives without weakening detection?

  1. Removing all rules and relying solely on manual review
  2. Raising every threshold to the maximum permitted value
  3. Disabling alerts for customers who have complained
  4. Tuning thresholds and combining rule-based alerts with behavioural scoring and feedback from confirmed cases Correct answer.

Explanation

Threshold tuning plus behavioural scoring and analyst feedback allows the system to distinguish genuinely anomalous activity from normal variation. Confirmed-case feedback continuously refines the model. Removing rules, maximising thresholds or suppressing alerts for complainants all reduce detection capability.

Question 45Cyber Crimes and Fraud Risk Management

A fraudster compromises a bank's DNS records so that customers typing the correct web address are silently routed to a lookalike site. Which control most directly detects this type of attack?

  1. Certificate pinning or DNS monitoring with registrar lock and multi-factor registrar access Correct answer.
  2. Adding a second OTP channel for card payments
  3. Reducing the card daily limit
  4. Increasing the length of customer passwords

Explanation

DNS hijacking redirects users at the name-resolution layer, so detection requires monitoring DNS records for unauthorised changes and protecting registrar accounts with locks and multi-factor access. Certificate pinning also helps clients reject impostor sites. Password length, OTP channels and card limits do not address name resolution.

Question 46Cyber Crimes and Fraud Risk Management

An attacker submits a series of loan applications using stolen identities that pass automated KYC checks. Which control most effectively addresses this synthetic or identity fraud at onboarding?

  1. Accepting the application if the document image looks clear
  2. Relying solely on an OTP sent to the declared mobile number
  3. Increasing the loan interest rate for all applicants
  4. Cross-checking identity attributes against multiple independent data sources and liveness-verified biometrics Correct answer.

Explanation

Identity fraud is best countered by corroborating the claimed identity across independent sources, such as credit bureaus, telecom records and government databases, combined with liveness-verified biometrics that bind the applicant to the document. A clear document image or an OTP to a fraudster-controlled number proves little.

Question 47Cyber Crimes and Fraud Risk Management

A bank's SOC observes outbound connections from a teller workstation to an unfamiliar IP address at regular ten-minute intervals, with small encrypted payloads. Which hypothesis best fits these observations?

  1. A legitimate software update service
  2. A routine end-of-day batch reconciliation
  3. Command-and-control beaconing by malware implanted on the workstation Correct answer.
  4. A customer using internet banking from home

Explanation

Fixed-interval outbound connections with small encrypted payloads are characteristic of malware beaconing to a command-and-control server. Regular timing and low volume are designed to blend into background traffic. Legitimate updates usually follow vendor patterns and batch reconciliation runs on servers, not teller workstations.

Question 48Cyber Crimes and Fraud Risk Management

A ransomware group claims to have exfiltrated customer data and threatens to publish it unless paid. From a fraud risk perspective, what is the most significant concern beyond system downtime?

  1. The delay in closing the bank's annual accounts
  2. Use of the stolen customer data for identity theft and targeted social engineering Correct answer.
  3. The cost of replacing the affected servers
  4. The need to retrain staff on the new software

Explanation

Exfiltrated customer data enables identity theft, account takeover and convincing social-engineering attacks that can cause further fraud losses and reputational harm. This persists long after systems are restored. Hardware replacement, accounting delays and retraining are operational costs, not fraud risks.

Question 49Cyber Crimes and Fraud Risk Management

A bank is assessing whether to block a payment flagged by its monitoring system. Which factor most appropriately supports an immediate block rather than post-transaction review?

  1. Strong corroborating indicators of fraud with imminent and irreversible loss Correct answer.
  2. The payment amount is round-numbered
  3. The customer has been with the bank for many years
  4. The beneficiary bank is in another state

Explanation

Blocking before settlement is justified when multiple strong indicators align and the loss would be immediate and irreversible, such as a transfer to a known mule account. Longevity, round amounts and geography are weak signals that do not by themselves justify stopping a payment.

Question 50Cyber Crimes and Fraud Risk Management

A bank discovers that an employee in the trade finance department has been approving documents for fictitious shipments to accounts linked to a supplier. Which combination of controls would most likely have detected this earlier?

  1. Segregation of duties, independent verification of underlying documents and periodic reconciliation with counterparties Correct answer.
  2. Increasing the employee's system access to speed up processing
  3. Relying on the employee's self-certification of document authenticity
  4. Removing audit trails to protect employee privacy

Explanation

Insider fraud in trade finance is deterred when approval, verification and reconciliation sit with different people and when third-party confirmation of shipments is obtained. These controls create independent checks that make concealment difficult. Expanding access, removing audit trails and self-certification all weaken detection.