The Business Model of Fraud: Account Takeover Schemes

I hit a wall on a work project and my hourly task alarm rang so I took the opportunity to take a quick break and go to the garage to do a load of laundry. There was a big spider-web in the garage. It was a beautiful sight. The three dimensional aerial web started on the driver side mirror and ran parallel to the driver side door. The anchors of the spider-web were secure on the body of the vehicle and used the car as wind protection. Right in the middle of the web was the big spider. I could not identify what kind of spider it was, but my focus was not on the spider itself but on the web that it created. Each web branch, intact or disrupted, served a purpose and kept the web together. Fraud follows a similar structure, using identity theft and account takeover fraud as major tributaries in the web of financial crime.

Account takeover fraud begins with a form of identity theft. The suspect unlawfully obtains access to the victim’s banking account through stealing the victim’s login information. In addition to the stolen username and password, the suspect could also obtain the victim’s identifying documentation like a driver’s license or a social security card. The next step is verifying the access information and monitoring the account for the perfect moment to attack. Once that is complete, the final step is entering the account and taking over. With the stolen login information, the suspect is able to gain access to the victim’s account and quickly transfer funds to an external account before the victim is aware. With the use of the victim’s identifying documentation, the suspect could take the scheme a step further. Under the guise of a carefully scripted story, the suspect could open a fraudulent secondary business account and transfer funds from the victim’s account to the new business account. Taking advantage of different restrictions surrounding wire transfers, the suspect with the new business account could potentially empty an account in a few days. The use of charisma and technology can be a deadly tool.

The business model of fraud has one rule, the only constant is change. As online banking becomes more prevalent and security measures are increased, it is likely that we will see a mixture of the new and old, when it comes to successful account takeover schemes. The intentions behind an account takeover can differ but monetary gain is a pillar in the account takeover scheme. The types of damage to the victim, whether it is a person or an institution, can vary in manner and severity. It comes down to whether the victim’s account was the pot of gold or bridge. What do I mean by that?

The suspect executes an account takeover, whether it’s a bank account or a credit card, and proceeds to go on a shopping spree: the pot of gold. The other scenario is when the suspect executes an account takeover and uses the victim’s account to launder stolen funds: the bridge. At first glance, it may appear to be a theft but after a quick investigation, the victim recognizes that none of the funds were stolen. That initial reaction is the suspect’s desired result. It is no accident, and that is pretty clever.

The hope is that the victim and banking institution are focused on discovering whether victim’s funds are stolen, when in actuality, the account could be the bridge necessary to turn dirty money into clean money. Think about it. Once the victim’s account is compromised, the main focus is to ensure that the funds are safe. Oftentimes, as long as the parties haven’t suffered a loss, the matter is not escalated to law enforcement. So the suspect could move stolen funds through the account with minimal loss. If the matter is escalated to law enforcement and the suspect is caught, the difficulty in the case is for law enforcement to understand that the purpose may have been a bridge and not a theft.

From a prosecutor’s standpoint, the sand traps in these types of investigations are connecting the dots between the identity theft and the theft of the monies. Initial review of scheme may reveal these two different crimes but understanding their complementary role to the operation is integral for raising a defense or seeking for a conviction. From banking perspective, combating account takeover starts with training your 1st line of defense and proper “Know Your Customer” parameters that can quickly recognize odd transactions that do not fit your client’s profile. The best tool for a defense attorney or a prosecutor is bringing the case to life. It is either a delicate operation with a specific purpose or the transactions were not initiated by your client. The stories behind the money movement may give your arguments new life.

This type of scheme requires observing the web from different angles to uncover the hidden purpose and not get caught up in the misdirection. There is beauty in the spider web, just do not get entangled!

An attorney in New Jersey with an affinity for continuous upskilling within the realm of regulation, compliance, and white collar litigation.