Fraud: A definitive guide

Financial fraud

Financial fraud is an umbrella term for scams that involve deceptive practices or criminal activity to steal assets. Financial fraud can include ATM scams, HELOC fraud, credit card fraud, IRS scams, wire fraud (including wire transfer fraud), insurance fraud, mortgage fraud, Ponzi schemes, ransomware, and embezzlement.

While some fraud schemes are quite straightforward, others can be difficult to detect. For example, salami fraud involves stealing small amounts, as little as fractions of a cent, from multiple transactions over time. Fraud techniques evolve constantly, leading to new threats like P2P fraud, enabled by peer-to-peer technology and, increasingly, blockchain.

Identity theft fraud

Identity theft is a serious and common offense. It happens when someone obtains your personal information, such as your name, credit card number, or Social Security number, and uses it without your knowledge or permission to commit fraud or other crimes. But it doesn’t just affect individuals — businesses can also fall victim. For example, in second-party fraud, a type of Identity theft fraud, the service provider’s employee uses their access to customer data to enrich themselves. Identity theft fraud mostly occurs online through phishing or cyberattacks, but it can also occur through social engineering and even mail.

Mail fraud

What is mail fraud, and how does it work? Mail fraud letters arrive in your mailbox and will ask you to send your personal information or money to receive a “gift” or other item. Mail fraud letters appear legitimate, but what they offer is fake. Examples of mail fraud can include letters for vacations, sweepstake winnings, prizes, and other rewards or valuable offers.

Business fraud

Business fraud commonly refers to fraudulent activities that occur within a company or organization. Businesses may use false or misleading information to commit fraudulent behavior. Examples of business fraud (also known as corporate fraud) include financial statement fraud, securities fraud, embezzlement, skimming, conflicts of interest, payroll fraud, diversions, bribery, tax fraud, and disbursement fraud.

On the other hand, businesses can also fall victim to business fraud. The CEO, as the most powerful person in the organization, is commonly targeted in cyberattacks. But, in CEO fraud, scammers will impersonate the CEO and other high-level executives to target the company's employees and customers.

Medical fraud

Medical fraud, also known as health care fraud, is fraud committed by patients, medical providers, or others. It aims to deceive the health care system and obtain illegal payments or benefits. Medical fraud includes identity theft or swapping, fake marketing, upcoding, unbundling, double billing, and phantom billing.

Consumer fraud

A business can experience fraud when scammers file deceptive claims, false disputes, or unauthorized chargebacks. Some cases of consumer fraud are quite straightforward and don’t involve hacking into systems or stealing credentials. For example, in friendly fraud, a customer makes a legitimate purchase but later disputes the charge with their bank. They may falsely claim that they’ve never received the product or that the transaction was unauthorized.

E-commerce fraud

In cases of e-commerce fraud, scammers exploit online marketplaces, auctions, and shopping platforms to trick buyers. For example, an auction fraud involves scammers posting fake listings for products they don’t own and certainly never intend to ship. This particular type of fraud then can utilize various techniques and tactics , such as bidding to inflate the price (shill bidding) and contacting the loser of the auction to give them another chance (second-chance scam).

A more advanced version of fraud compared to auction fraud is triangulation fraud. In this case, scammers set up fake online stores and offer goods at a discount. When a buyer places an order, the criminals use stolen payment information to purchase the item and send it to the buyer. This way, criminals end up with money, but the true cardholder is left to deal with fraudulent charges.

Because everyone now uses online transactions, cybercriminals have developed fraud into a business. Known as fraud as a service, it is a business model where scammers build and sell hacking tools, stolen payment information, and anything else needed to commit fraud. These resources allow virtually anyone to commit criminal activities, even if they don’t have the technical skills.

Unusual payment activity

When a cybercriminal steals credit card information, they’ll usually do one of two things: they'll either rush to redeem as many gift cards as they can or make a series of small payments with a variety of vendors. This tactic, called card testing, is a way to verify a card with small purchases before making a big one. If you ever get alerted about multiple transactions from unknown merchants, block your card immediately.

Suspicious login attempts

Online services use device identifiers to know which devices to trust. But that doesn’t stop cybercriminals from trying. In what’s known as credential harvesting attacks, they’ll steal or purchase user credentials to access their accounts. If a service detects a login attempt from an unrecognized device, you’ll usually receive a notification. If this happens, change your password immediately and enable multi-factor authentication (MFA).

Unexpected account changes

If a scammer ever gets into your account, they’ll likely want to change your account details first, such as your primary email, password, phone number, or payment method. It makes it harder for you to recover your account. Keep an eye out for notifications about sudden account changes you didn’t make. But stay vigilant — scammers also like to send fake alerts about account changes to steal your credentials.

Something that’s too good to be true

From the earliest days of the internet, fake jackpot alerts lulled users into forgetting they’ve never even played the lottery. These same tricks still work today. If an offer seems too good to be true, it probably is.

Your gut says so

While not scientifically measurable, intuition can be a valuable tool in spotting fraud. Sometimes, a website or email may appear normal, but something feels off. For example, the website looks fine, but you suddenly feel a sense of unease. You can’t pinpoint the difference, but it feels like it is. Your gut feeling is often based on subtle cues your brain has picked up — listen to it. If something doesn’t feel right, take a step back and double-check before proceeding.