Common fraud schemes and how to avoid them

ATM skimming

What is ATM skimming?

It occurs when a fraudster attaches a device to an ATM that reads the magnetic stripe of banking cards and PIN codes. In such a case, scammers will replicate the card using the information they obtained to steal money.

How to protect yourself from ATM skimming

To avoid such schemes, always check that there is no additional keypad on top of the ATM's keypad, no card skimmer installed in the ATM's card slot, and no additional camera pointed at the ATM that can skim or capture your PIN and other card details.

Card-not-present fraud

What is card-not-present fraud?

This fraud type refers to criminal activity when a fraudster uses compromised or stolen banking cards. Usually, scammers try to make online purchases or money transfers to their accounts or other operations that do not require the physical presence of the actual card owner.

How to protect yourself from card-not-present fraud

Clients must be cautious and can prevent their card/card data from being stolen. They need to ensure they don't leave their cards unattended in public places or share their card data with anyone. Two-factor authentication must be in place for all card-not-present transactions. Also, it is essential to regularly monitor your transaction history to detect suspicious operations that a card owner doesn't recall. Follow the notifications regarding card transactions. If your card is lost/stolen, or if you suspect that someone has obtained your card data, you need to immediately contact the support team and block your card.

Phishing

What is a phishing scam?

In this case, malicious actors try to defraud a person’s personal information to access personal and financial accounts or steal financial data using deceptive tactics. Fraudsters who use phishing usually assume someone else's identity or operate under the guise of popular websites, especially e-commerce ones.

How to protect yourself from phishing

During phishing, scammers operate via emails - they may try to fish out personal information by asking a person to reply or click on a link in an email spam, so a person will download malware. There are also two other types of phishing - smishing (SMS phishing) and vishing (voice phishing). With the former, fraudsters contact their targets via text messages and messenger apps, and with the latter, via phone calls and voice messages. To avoid this type of fraud, you need to ignore all emails, messages, and calls from unknown sources. Be careful when opening emails, texts, or receiving phone calls - don't rush into things. Do not open attachments and links from unknown sources or sources you do not recognize. Do not enter your Genome card details on webpages you are redirected to following such links, even if they look like the Genome website. Never share personal or financial details, passwords, or other credentials via email, phone, or messages. Install antivirus software on your devices.

Wire transfer fraud

What is wire transfer fraud?

It occurs when a fraudster tricks someone into wiring money into their account. It is also known as authorized push payment fraud. Scammers often pose as bank employees and tax officials to trick people. A person may receive a letter with a fake payment request that looks legitimate, even to the business email.

How to protect yourself from wire transfer fraud

One of the basic rules for dealing with such scams is to refrain from sending funds to anyone you don't know and cannot confirm their identity. If the request comes from someone you know, verify their identity. And, as in the case of phishing schemes, do not share personal, financial information, or account credentials with a person requesting a wire transfer.

Account takeover

What is an account takeover?

This fraudulent scheme occurs when a fraudster gains access to user accounts of individuals and companies to steal sensitive data or money. Often, this happens when stolen credentials are used. Thieves change the login, password, and contact information to lock the owner out of their account. When it comes to bank account takeover, in most cases, malicious actors transfer money to other accounts, make fraudulent payments, and try to open a credit line in the victim's name.

How to prevent account takeovers

Account takeovers can be prevented if account users take safety precautions with their passwords and credentials. To do so, a person must use strong passwords that contain uppercase and lowercase letters, numbers, and special characters. Each password must be unique for every account, and you should change them regularly - once every 1 to 3 months. Don't share your credentials with anyone or store them inside your computer, phone, or other device. If you have become a victim of an account takeover, you need to notify the support team immediately.

Merchant account takeover

What is a merchant account takeover?

It occurs when criminals gain access to a merchant’s payment or business account. They may steal login details through phishing, malware, or weak passwords. Once inside, they can change payout details, view sensitive data, issue fake refunds, or use the account for fraud.

How to protect your merchant account

As with a regular account takeover, you need strong passwords and two-factor authentication first and foremost. Limit staff access rights to sensitive data. Review account activity regularly and set alerts for login attempts, profile changes, and payout updates. Train employees to spot phishing messages and suspicious links. Act quickly if account details or user permissions change unexpectedly.

Romance scams

What are romance scams?

In such fraud cases, malicious actors target people who seek socialization and romantic relationships. They primarily communicate with their victims via social media and messages and assume another person’s identity. The fraudsters’ goal is to instill trust in the person they communicate with, so they can manipulate the individual into sending them money.

How to spot and avoid romance scams

How you can recognize potential romance scammers: they will be very lively, engaging in conversation with their target at every opportunity. They will actively appeal to their target’s interests and beliefs to establish a more profound sense of connection between them. They are very likely to profess their “romantic feelings” towards the fraud victim early on during messaging. Once a scammer feels that they have gained the victim’s trust, they will ask for a funds transfer. When doing so, they will usually lie that they urgently need money because of an emergency.

Loan fraud

What is loan fraud?

This type of fraud occurs when malicious actors assume the identity of a loan firm to illegally obtain funds. The scammers try to trick individuals and companies into getting a loan of any kind and will offer lucrative deals and rush their victims into the process. Typically, they will ask for a payment in advance before the deal is even concluded. Once fraudsters receive the money transfer, they vanish.

How to protect yourself from fake loans

To avoid loan fraud, individuals and businesses must ignore emails and messages from companies that offer loans and duly check the authenticity of a business from which they want to lend money - it must have all the necessary licenses and registrations, a legitimate name, address, website, and other data. You need to carefully read through the terms and conditions, as well as the documents, before signing them.

Investment scams

What are investment scams?

In the case of this fraud type, malicious entities contact their victims and offer to invest in stocks, property, cryptocurrency, etc., to fish out their funds. This scam is more elaborate, as fraudsters will usually create websites and presentations about how much money a person can get by investing. Of course, the information on these websites and presentations is fake and blown out of proportion to make the investment deal more lucrative. Scammers will try to call and text their targets as often as possible and aggressively market their investment product. Their goal is to pressure people into making money transfers, after which the fraudsters disappear.

How to protect yourself from fraudulent investments

To protect yourself from such a scheme, ignore companies that find you first and offer investment opportunities - they may be potential scammers. It’s also easy to recognize fraudsters among investment firms if they aggressively push their product and promise that an individual will get rich in a short period of time. At first, these malicious actors may ask for a small contribution, but then start pushing clients to invest more and more. Remember that a legitimate company that provides investment services must be licensed by the supervisory authority of the country in which it is registered. Before dealing with any investment company, a person must first check the jurisdiction in which it is registered and verify if the investment company has the permits to provide such services inside the person’s country of residence.

Emotional manipulation and fake promises fraud

What are fake promise scams?

This fraudulent scheme shares many similarities with phishing scams. A person will receive a text/email/phone call about winning a lottery or a prize, even though they didn't participate in any giveaways. Using this pretense, scammers will either send a link or request personal information. If the individual clicks a link, they risk downloading malware. And if they give away personal information, the malicious actors will use it to log into a person's accounts and steal data and funds. Fraudsters will email someone, claiming that this person has inherited a lot of money or other prized possessions from a distant relative. Scammers will then require a “small fee” for their services, for instance, to cover notary expenses, etc. Once an individual pays the said “fee,” malicious actors disappear, and a person, predictably, does not inherit anything.

How to protect yourself from emotional manipulation

If you get notified that you have won anything, be skeptical and do not click on any links or attached files. It is also crucial that you don't provide any information or financial data. Such fraudulent emails create a highly unlikely scenario, so most people are likely to ignore them altogether. If you receive an email notifying you about an inheritance, be skeptical. Do not click any links, download any attachments, or share any information with scammers.

Identity theft

What is identity theft?

It occurs when criminals steal someone’s personal data (such as name, address, ID or passport details, banking information, login credentials). This data is then used to impersonate the person. Scammers can use the stolen information to open social media/bank accounts, apply for loans, make purchases, or gain access to existing services in the victim’s name. This type of fraud is hard to detect. The person usually notices it after finding suspicious transactions or getting a call from their financial institution.

How to protect yourself from identity theft

To avoid identity theft, never share sensitive personal or banking data via email, messages, or unsolicited calls. Be careful with links asking you to “verify” your account - don't click them prematurely, check their validity. Use strong, unique passwords and change them regularly. Enable two-factor authentication not only for banking apps, but also for social media. Regularly monitor your bank statements and online accounts for suspicious activity. Make sure websites are legitimate and secure, and immediately report and block any unauthorized operations or account changes.

Chargeback fraud

What is chargeback fraud?

Also known as "friendly fraud," it occurs when a cardholder disputes a legitimate transaction. However, they received the goods/services, making the chargeback unsubstantiated. Due to this, a business that gets this chargeback loses revenue, pays additional fees, and may face penalties or higher risk ratings. Chargeback fraud is widespread in online and other card-not-present transactions, where it can be harder to prove the cardholder's intent.

How to protect your business from chargeback fraud

The issue of chargeback fraud concerns specifically merchants (businesses that sell products/services). Companies must have billing descriptors, detailed receipts, delivery confirmation, and strong customer communication to prevent misunderstandings. Fraud prevention tools, 3D Secure, and strong customer authentication are a must when it comes to confirming genuine transactions. Keeping thorough records (order history, emails, IP logs, proof of delivery) is crucial for responding to unjustified disputes and successfully representing chargeback cases.

Synthetic ID fraud

What is synthetic ID fraud?

In this case, fraudsters create a new, "synthetic" identity by combining real personal information (such as a genuine ID number, date of birth, or address) with fabricated data (fake names, emails, or phone numbers). Such fake profiles usually don't match the identity of a person they were stolen from. Therefore, this type of fraud is harder to detect. The "synthetic" identity is then used to open bank accounts, lend money, get credit, and engage in other activities that lead to funds and data theft.

How to protect yourself from synthetic ID scams

To reduce the risk of synthetic ID fraud, businesses should implement robust identity verification tools. Such tools must cross-check multiple data points, such as documents, device data, and behavioral patterns, instead of relying on single identifiers. To protect your personal data, don't share your information online. Promptly respond to alerts about new accounts or credit checks they did not authorize.

BIN attack fraud

What is a BIN attack?

This type of fraud happens when criminals use the first digits of a card number (the BIN) to guess the full card details. They use scripts or bots to try many combinations and test them by making small online payments. If a payment goes through, they know the card is real and can use it for bigger fraud or sell the details to others.

How to protect against BIN attacks

Merchants can protect their business by setting limits on how many payments can be tried from the same card, IP, or BIN range, and by blocking suspicious patterns like many small failed payments. Use tools like CVV and address checks, 3D Secure, and real-time monitoring. Work with your payment provider to adjust risk rules and quickly stop unusual activity.

Money mules

What are money mules?

It is a type of fraud that uses money mules. These are people who move stolen money on behalf of criminals. They may know it's illegal, or they may be tricked with fake "job offers" promising quick income for simply receiving and forwarding transfers. The money often comes from fraud, scams, or hacked accounts. By passing it through different mule accounts, criminals try to hide where it really came from.

How to avoid being used as a money mule

Don't accept or be wary of offers that promise easy money for using your bank account, crypto wallet, or cards. Never receive or send funds for strangers or "companies" you can't verify. Only share your account details with trusted, legitimate businesses.

Refund fraud

What is refund fraud?

This type of fraud occurs when someone tries to get a refund they are not entitled to. They may lie about not receiving an item, return the wrong product, or ask for money back after using the service.

How to protect your business from refund fraud

Check refund requests carefully. Match them to the original order and payment. Send refunds only to the original payment method. Watch for unusual refund activity.

Triangulation fraud

What is triangulation fraud?

This scam involves a fake seller, a real customer, and a real merchant. The customer buys from the fake seller. The fraudster then uses stolen card details to buy the item from a real merchant and sends it to the customer.

How to protect against triangulation schemes

Watch for suspicious orders, unusual shipping details, or repeated purchases of the same goods. Use fraud checks like CVV, address checks, and 3D Secure. Review risky payments more closely.

Subscription fraud

What is subscription fraud? This type of fraud happens when stolen card details are used to sign up for a subscription. The first payment may look normal, but later the real cardholder notices the charges and disputes them.

How to prevent subscription fraud

Check new sign-ups carefully. Watch for many accounts created from the same device, IP, or card range. Use 3D Secure and fraud monitoring. Look out for unusual account activity.

Transaction laundering

What is transaction laundering?

It is a type of fraud when a merchant account is used for payments that were not disclosed to the payment provider. The business may look normal, but the payments are really for something else.

How to protect against transaction laundering

Check what the merchant is really selling. Watch for differences between the stated business activity and actual payments. Review websites, payment flows, and customer complaints regularly.

Fake merchant onboarding

What is fake merchant onboarding?

It happens when criminals pretend to be a real business to open a merchant account. They may use fake documents or stolen company details. The account is then used for fraud.

How to protect against fake merchants

Check business documents and ownership details carefully. Make sure the business is real and active. Watch for strange behavior after onboarding, such as sudden high-risk transactions.

Invoice fraud

What is invoice fraud?

Invoice fraud happens when someone sends a fake invoice or changes the payment details on a real one. The goal is to trick a business into paying the wrong account.

How to protect your business from invoice fraud

Check invoices carefully. Confirm bank detail changes directly with the supplier. Do not rely only on email. Use approval steps for payments.

Payout redirection fraud

What is payout redirection fraud?

It occurs when criminals change payout details so money is sent to them instead of the real recipient. They may do this by hacking an account or tricking staff.

How to protect against payout redirection

Always verify payout detail changes. Use two-factor authentication and approval steps. Set alerts for account changes. Be careful with urgent requests to change bank details.

API/webhook manipulation and fake payment confirmations

What is API/webhook manipulation?

It is a type of fraud when criminals send fake payment messages or confirmations. They try to make it look like a payment was successful when it was not.

How to protect against fake payment confirmations

Always verify payment status on the provider’s side. Do not trust only what appears on screen. Use secure API and webhook validation. Monitor for suspicious requests.

Bot-driven payment abuse

What is bot-driven payment abuse?

It is a type of fraud when bots attack payment systems automatically. They may test stolen cards, abuse free trials, or send many fake payment attempts very quickly.

How to protect against payment bots

Use rate limits, CAPTCHA, and bot detection tools. Watch for repeated failed payments or unusual spikes in activity. Block suspicious IPs, devices, and accounts.