Unit 02 · Chapter 4 · 10 min read

Scams, money mules, and social engineering

Recognize deception across both the sender and receiver journeys.

The customer completed the authentication challenge correctly. They also sent their savings to an impersonator. The system verified the button press and missed the story behind it. Scam controls need to consider intent, destination, and the receiving network.

Separate unauthorized access from deception

In unauthorized access, another actor uses the account without permission. In a scam, the customer may perform the action after being deceived. These categories can overlap, but they suggest different interventions. A stronger login does not by itself test whether an invoice is genuine.

Use neutral language when collecting the report. Ask what happened, who initiated each action, what instructions were received, and how the destination was selected. Do not infer legal reimbursement rights from the internal fraud category. The relevant law, rail, account type, and facts determine the applicable process.

The familiar security story has an intruder stealing access. In an authorized scam, the person at the keyboard may be the real customer, using the real device, with the correct password. The attack changes the customer’s belief about why the money must move. Strong login controls can therefore coexist with severe scam losses.

Product design can make the intended payment easier to inspect. Show the actual recipient, distinguish a new destination from a familiar contact label, and explain an unusual instruction in language tied to the action. Generic warning walls lose value when customers learn to dismiss them. A warning needs a specific reason, a practical next step, and a path for customers who need help before the funds leave.

Separate unauthorized access from deception Separate unauthorized access from deception — the flow Follow the sequence. Trace where value was sent. Actor Identify who performed the action Influence Record the claimed reason Destination Trace where value was sent — Follow the sequence. Trace where value was sent. Chapter sources · Open image

Separate unauthorized access from deception Separate unauthorized access from deception — the distinction These concepts answer different questions. Read each definition in the context of the section. Unauthorized use Account action lacked permission Deceived authorization Customer acted on a false story — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Separate unauthorized access from deception Impersonation report Fictional teaching record. Needs investigation. Impersonation report Illustrative data; not a real customer record or a prescribed policy. Actor customer They pressed send Claim urgent bank transfer Reported false story Destination new external account Needs investigation Authentication and intent answer different questions — Fictional teaching record. Needs investigation. Chapter sources · Open image

Separate unauthorized access from deception Separate unauthorized access from deception — control and failure modes Authentication and intent answer different questions. The branches show why alternative designs fail. Control design Collect actor and deception facts separately. Authentication and intent answer different questions. Failure mode 1 Deny every claim after strong login. Login does not resolve all legal or factual issues. avoid Failure mode 2 Call every scam account takeover. That can misdirect controls. avoid Failure mode 3 Promise reimbursement from a label. Rights require the applicable rules and facts. avoid — Authentication and intent answer different questions. The branches show why alternative designs fail. Chapter sources · Open image

Interrupt the story at the right moment

A warning works best when it addresses the action in progress. A generic fraud paragraph becomes background noise. A destination-change warning can explain that a real bank will not need a transfer to a supposed safe account. Keep messages clear and test comprehension.

Avoid revealing exact detection thresholds or implying that the customer caused the problem. Offer a safe pause and a verified support route. Measure completed safe resolutions, not only how many warnings were displayed. A customer who clicks through a warning may be confused, rushed, or under pressure; clicks alone do not prove informed understanding.

Interrupt the story at the right moment Interrupt the story at the right moment — the flow Follow the sequence. Offer verified help and a pause. Detect context Recognize a relevant payment pattern Warn clearly Explain the specific concern Provide exit Offer verified help and a pause — Follow the sequence. Offer verified help and a pause. Chapter sources · Open image

Interrupt the story at the right moment Interrupt the story at the right moment — the distinction These concepts answer different questions. Read each definition in the context of the section. Impressions Warnings shown Comprehension Users understand and can act safely — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Interrupt the story at the right moment Warning evaluation Fictional teaching record. Separate evaluation measure. Warning evaluation Illustrative data; not a real customer record or a prescribed policy. Shown 1000 Exposure to the message Help used 80 Possible safe intervention Confirmed understanding sampled Separate evaluation measure A visible message may still be ineffective — Fictional teaching record. Separate evaluation measure. Chapter sources · Open image

Interrupt the story at the right moment Interrupt the story at the right moment — control and failure modes A visible message may still be ineffective. The branches show why alternative designs fail. Control design Test warning comprehension and safe exits. A visible message may still be ineffective. Failure mode 1 Count display volume as prevented fraud. Exposure is not an outcome. avoid Failure mode 2 Expose exact rule thresholds. That needlessly reveals control boundaries. avoid Failure mode 3 Use accusatory language. It can reduce cooperation and useful reporting. avoid — A visible message may still be ineffective. The branches show why alternative designs fail. Chapter sources · Open image

Investigate receiver behavior

A receiving account can be used to move proceeds onward. Look at the relation between incoming funds, account history, outgoing destinations, and the stated purpose. A sudden rise in activity can have an honest explanation, such as a successful fundraiser.

Use the pattern to select a review, not to declare a person guilty. Preserve the transaction chain and seek relevant context through approved channels. Restrictions should have a legal and policy basis, a scope, and an owner. Do not assume all incoming funds have the same origin merely because one payment is disputed.

Receiver analysis requires care because a fast movement of money can serve many purposes. A marketplace seller, a payroll business, and a suspected mule account can all receive and forward funds. Compare the activity with the declared business, connected accounts, timing, and other reliable evidence. Do not turn one shared device or one unusual transfer into a conclusion about criminal intent. The investigation should preserve alternative explanations and identify the facts that would distinguish them.

Investigate receiver behavior Investigate receiver behavior — the flow Follow the sequence. Trace linked movement and evidence. Inflow Observe source and timing Context Compare with account purpose Outflow Trace linked movement and evidence — Follow the sequence. Trace linked movement and evidence. Chapter sources · Open image

Investigate receiver behavior Investigate receiver behavior — the distinction These concepts answer different questions. Read each definition in the context of the section. Rapid turnover Potential investigation signal Illicit proceeds Conclusion requiring supporting evidence — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Investigate receiver behavior Receiver review Fictional teaching record. Plausible claim to test. Receiver review Illustrative data; not a real customer record or a prescribed policy. Prior activity low volume Baseline New credits several unrelated senders Pattern change Explanation unverified fundraiser Plausible claim to test Unusual movement is a lead rather than proof — Fictional teaching record. Plausible claim to test. Chapter sources · Open image

Investigate receiver behavior Investigate receiver behavior — control and failure modes Unusual movement is a lead rather than proof. The branches show why alternative designs fail. Control design Review the pattern with customer context. Unusual movement is a lead rather than proof. Failure mode 1 Label every fast transfer laundering. Speed alone is insufficient. avoid Failure mode 2 Ignore the stated purpose. Context can distinguish legitimate activity. avoid Failure mode 3 Assume all funds are tainted. Different inflows may have different evidence. avoid — Unusual movement is a lead rather than proof. The branches show why alternative designs fail. Chapter sources · Open image

Connect fraud and AML without collapsing them

Fraud teams often focus on immediate loss and customer protection. AML teams examine suspicious activity and applicable reporting duties. Shared evidence can help both, but their decisions and access rules differ. A fraud refund does not automatically close an AML concern.

Create a controlled referral that carries transaction references, observed facts, and confidence levels. Keep protected reporting information out of general support tools. Track acknowledgment and ownership so the referral is not lost between queues. Each team should record its own conclusion under the relevant policy rather than inherit another team’s label as a legal determination.

Connect fraud and AML without collapsing them — the flow

Fraud caseCollect loss and deception facts
ReferralShare permitted evidence
AML reviewApply the separate investigative duty

Follow the sequence. Apply the separate investigative duty. Chapter sources · Open image

Connect fraud and AML without collapsing them Connect fraud and AML without collapsing them — the distinction These concepts answer different questions. Read each definition in the context of the section. Customer remediation Addresses the customer impact AML disposition Addresses suspicious-activity obligations — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Connect fraud and AML without collapsing them Cross-team referral Fictional teaching record. Separate controlled record. Cross-team referral Illustrative data; not a real customer record or a prescribed policy. Facts linked transactions Shared evidence Refund completed Customer remedy only AML status restricted Separate controlled record The objectives and confidentiality rules differ — Fictional teaching record. Separate controlled record. Chapter sources · Open image

Connect fraud and AML without collapsing them — control and failure modes

Control design

Keep distinct decisions with a controlled referral. The objectives and confidentiality rules differ.

Failure mode 1avoid: Close AML automatically after refund. Remediation does not resolve every suspicion.
Failure mode 2avoid: Copy protected reporting status into support. Access must respect confidentiality.
Failure mode 3avoid: Send an unowned email. The handoff needs acknowledgment and responsibility.

The objectives and confidentiality rules differ. The branches show why alternative designs fail. Chapter sources · Open image

Build a compassionate incident intake

Scam victims may feel fear or shame. A clear intake helps gather better evidence and reduces repeated explanations. Record the timeline, destination, communications, and remaining account access. Separate immediate containment from later investigation.

Support should know how to protect credentials, escalate a recovery request, and preserve evidence without promising outcomes it cannot control. Use a single case reference across teams. Measure time to a useful first action and the quality of updates. A fast automated acknowledgment is not the same as contacting the right payment partner.

Build a compassionate incident intake Build a compassionate incident intake — the flow Follow the sequence. Use one case and clear updates. Listen Capture the event without blame Contain Address ongoing access and transfers Coordinate Use one case and clear updates — Follow the sequence. Use one case and clear updates. Chapter sources · Open image

Build a compassionate incident intake Build a compassionate incident intake — the distinction These concepts answer different questions. Read each definition in the context of the section. Acknowledgment Confirms receipt of a report Useful action Changes exposure or starts the right process — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Build a compassionate incident intake Incident intake Fictional teaching record. Needs an accountable owner. Incident intake Illustrative data; not a real customer record or a prescribed policy. Case scam-42 Shared reference Access still active Containment concern Partner escalation pending Needs an accountable owner Each has a different immediate purpose — Fictional teaching record. Needs an accountable owner. Chapter sources · Open image

Build a compassionate incident intake — control and failure modes

Control design

Separate containment recovery and investigation. Each has a different immediate purpose.

Failure mode 1avoid: Promise all funds will return. Recovery may be uncertain.
Failure mode 2avoid: Make the customer retell the story to each team. That adds friction and inconsistent records.
Failure mode 3avoid: Close after an automated acknowledgment. The substantive work remains.

Each has a different immediate purpose. The branches show why alternative designs fail. Chapter sources · Open image

Chapter connections

This chapter builds on Transaction risk and decision economics. Continue with First-party misuse, merchant abuse, and feedback to follow the next part of the system. Use the glossary for terminology and risk mathematics for formulas and worked calculations.

Sources

Reviewed 2026-09-17