CFE Exam Study Guide: Payment Fraud
1. Overview of Payment Fraud
Definition:
Payment fraud refers to any deceptive or unauthorized activity aimed at unlawfully
obtaining money or financial benefits through payment systems, instruments, or platforms.
It includes manipulating checks, cards, online transactions, and electronic transfers.
Common Schemes:
• Check fraud (forgery, counterfeiting)
• Credit/Debit card fraud (skimming, unauthorized use)
• Electronic funds transfer (EFT) fraud
• Account takeover fraud
• Mobile and prepaid card fraud
• Person-to-person (P2P) payment fraud
Characteristics:
• Usually involves impersonation or manipulation of payment credentials.
• Can occur internally (by employees) or externally (by cybercriminals).
• Often uses social engineering or technology exploitation.
• Targets both organizations and individuals.
How to Detect Fraud:
• Monitor transaction anomalies (unusual amounts or times).
• Use fraud detection software with AI analytics.
• Conduct reconciliation of bank statements regularly.
• Review access logs and device usage patterns.
2. Check Fraud
Concept:
Check fraud involves the unauthorized alteration, forgery, or counterfeiting of checks to
obtain funds illegally.
Schemes:
• Forged/Counterfeit Checks: Creating fake checks or forging signatures.
• Advance Payment Fraud: Convincing victims to send money via check under false
pretenses.
Red Flags:
• Altered handwriting or erasure marks.
• Mismatch between check number and payment history.
• Sudden increase in check payments.
• Unknown payees or endorsements.
Prevention/Detection:
• Use tamper-evident check stock.
• Enable positive pay verification with banks.
• Educate employees on check fraud schemes.
• Reconcile accounts frequently.
3. Credit/Debit Card Fraud
Concept:
Credit or debit card fraud occurs when criminals use stolen or counterfeit card information
to make unauthorized purchases or withdrawals.
Schemes:
• Unauthorized Use: Stolen physical cards used for purchases.
• Stolen Card Numbers: Data breaches exposing card details.
• Skimming/Shimming: Devices copying magnetic or chip data.
• Spoof Sites: Fake e-commerce portals collecting card data.
• Prepaid Card Fraud: Fraudsters exploiting anonymous prepaid cards.
Red Flags:
• Unusual spending patterns.
• Multiple failed transaction attempts.
• Small test charges before large purchases.
• Discrepancy in location of purchase.
Prevention/Detection:
• Implement two-factor authentication.
• Use EMV chip-enabled cards.
• Monitor transactions in real time.
• Educate customers about phishing.
4. Electronic Funds Transfer (EFT) Fraud
Concept:
EFT fraud involves the unauthorized electronic transfer of money from one account to
another using digital banking systems.
Schemes:
• Fake Billing: Fraudulent invoices leading to transfers.
• Account Misuse: Insiders misdirecting company funds.
• Hacking Aggregators: Cyberattacks on payment processors.
• Insider Fraud: Employees manipulating payment instructions.
Prevention/Detection:
• Use dual authorization for transfers.
• Verify vendors and invoices independently.
• Implement strong access controls and audit trails.
• Monitor high-value transfers for anomalies.
5. Account Takeover Fraud
Concept:
Account takeover fraud happens when fraudsters gain control of a legitimate customer or
company account and use it for unauthorized transactions.
Methods:
• Phishing emails and fake login portals.
• Credential stuffing using leaked passwords.
• Malware or keylogging software.
• SIM swapping or social engineering.
Tactics:
• Change contact information.
• Add new payees or cards.
• Initiate unauthorized transfers.
Prevention/Detection:
• Enable two-factor authentication.
• Monitor for unusual login attempts.
• Use behavioral biometrics.
• Educate users on phishing awareness.
6. Mobile Payment Fraud
Concept:
Mobile payment fraud involves exploiting vulnerabilities in mobile wallets or apps to
conduct unauthorized transactions.
Vulnerabilities:
• Weak app security.
• Unsecured Wi-Fi or device access.
• SIM card hijacking.
• Lack of transaction verification.
Strengths:
• Tokenization of payment data.
• Device-based authentication.
• Encryption and biometric access.
Prevention/Detection:
• Regularly update apps and OS.
• Use only trusted mobile wallets.
• Enable biometric verification.
• Monitor transactions frequently.
7. Prepaid Debit/Gift Card Fraud
Concept:
Fraudsters exploit prepaid debit or gift cards by stealing activation codes, cloning cards, or
tricking victims into paying with them.
Attractiveness:
• Easy to obtain and use anonymously.
• Hard to trace once funds are spent.
• Often used in scams (e.g., IRS or tech support scams).
Prevention/Detection:
• Purchase cards only from reputable sources.
• Keep activation receipts.
• Monitor usage immediately after activation.
• Retailers should secure card racks and codes.
8. Person-to-Person (P2P) Payment System Fraud
Concept:
P2P payment fraud occurs when fraudsters exploit direct payment platforms (e.g., PayPal,
Venmo, Google Pay) to scam users or launder funds.
Uses:
• Legitimate instant transfers between individuals or small businesses.
Fraud Risks:
• Sending money to scammers posing as friends or merchants.
• Fake refund or overpayment scams.
• Account takeover or social engineering attacks.
Prevention:
• Verify recipient identity before sending.
• Avoid sending to unknown parties.
• Enable transaction alerts.
• Use platform security features like PINs or 2FA.