Rules
Part of Digital finance security guide: identity, authentication, fraud, and recovery
Finance fraud attack patterns: phishing, SIM swaps, impersonation and mule accounts
Finance fraud attack patterns explained through phishing, SIM swaps, impersonation, money mules, recovery abuse, warning signs, diagnosis, and response.
What to take away
- Phishing steals secrets or approvals through a false interface or message.
- A SIM swap transfers control of a phone number, not the physical phone or every account automatically.
- Impersonation creates trust and urgency so the victim bypasses normal checks.
- Money mules receive or move fraud proceeds, sometimes without understanding their role.
- Recovery attacks target the process for replacing authenticators and contact details.
Finance fraud often combines several attack patterns. A fake bank text may lead to a phishing page, capture a password and code, support a phone-number takeover, and end with money routed through a mule account.
Diagnose each step. The response to a stolen password differs from the response to an authorized payment made after deception.
Pattern 1: phishing
Phishing presents a false message, login page, approval screen, QR code, or support conversation. It may ask for a password, one-time code, card details, seed phrase, remote-access installation, or payment approval.
Common signs include:
Phishing warning signs
- Unexpected urgency
- Domain does not match provider
- Request to move money
- Unexplained authentication prompt
- Request for recovery code
- Pressure to hide conversation
Do not test a suspicious link by signing in. Reach the institution through its known app, a typed address, or a statement number.
Pattern 2: SIM swap
A SIM swap occurs when an attacker causes mobile service for a victim's number to move to another SIM or device. The victim may suddenly lose calls and messages while the attacker receives texted authentication codes.
The FTC's SIM-swap guidance advises contacting the carrier immediately, setting a carrier account PIN, and using an authentication app or security key instead of text-message codes for sensitive accounts where possible. A carrier PIN helps, but it does not eliminate phishing, insider, or process risk.
If service disappears unexpectedly, contact the carrier through another phone or verified channel. Then review email and financial accounts for resets, new devices, and unauthorized activity.
Pattern 3: impersonation
An impersonator may claim to be bank security, a government investigator, a merchant, a relative, or technical support. The story is designed to replace the victim's normal decision process with the attacker's instructions.
The caller may know real details from a breach, public profile, or earlier phishing. Caller ID and a familiar logo are not proof. End the contact and call back through an independently verified channel.
No legitimate bank or government agency needs a consumer to transfer money to a safe account. No genuine investigator needs a password or full authentication code.
Pattern 4: money mules
A mule account receives and forwards money connected to fraud. Recruitment can be explicit, or it can be disguised as employment, romance, investment, prize processing, or help for an online acquaintance.
The CFPB explains that a money mule receives and moves fraud proceeds and advises a person who suspects involvement to stop communicating, stop transferring money, notify the financial institution, and consider changing accounts. Receiving a payment does not make the funds safe to spend or forward.
Warning signs include keeping a percentage, buying cryptocurrency or gift cards, opening an account for someone else, receiving funds from strangers, and forwarding money quickly to a new destination.
Pattern 5: recovery-channel attacks
Recovery can replace a password, phone number, passkey, or security key. Attackers may:
- compromise the recovery email;
- take over the mobile number;
- use breached biographical facts with support;
- forge identity evidence;
- exploit a recently changed address;
- steal backup codes;
- persuade an agent to remove a strong authenticator.
Treat a recovery notice as a security alert. If you did not start it, contact the provider through a known channel and ask it to stop profile changes and revoke sessions.
Diagnose the event
| Evidence | Likely issue | Immediate check |
|---|---|---|
| Password entered on look-alike page | Phishing | Sessions, devices, email, reused password |
| Phone loses service without explanation | SIM swap | Carrier account and text-dependent accounts |
| Caller directs a protective transfer | Impersonation | Provider through independent channel |
| Incoming money followed by forwarding request | Mule recruitment | Stop transfer and notify institution |
| Recovery email or number changes | Recovery attack | Old contact notices, sessions, authenticators |
Several rows may apply to one incident.
Diagnose the fraud event
Password entered on look-alike page?
Phishing: check sessions, devices, email
Phone lost service unexpectedly?
Response priorities
- Stop contact with the suspected attacker.
- Use a clean device and verified provider channel.
- Restrict affected accounts and pending transfers.
- Revoke sessions, tokens, unknown devices, and changed recovery details.
- Secure email and mobile service.
- Preserve messages, payment references, profile changes, and case numbers.
- Report and dispute through the process that matches the event.
Do not erase evidence or send another payment as a test. Recovery of funds may depend on timing and payment type, and it should never be promised.
Common questions
Does loss of phone service prove a SIM swap?
No. An outage or account issue can also cause it. Verify the status with the carrier promptly.
Is every scam payment unauthorized?
No. A person may initiate a payment after deception. Legal treatment can differ from a transfer initiated by an attacker.
Can a money mule be unaware?
Yes. Recruitment may be disguised, but suspicion is a reason to stop moving funds and contact the institution.
Why are recovery attacks dangerous?
Recovery can replace strong authenticators, change trusted contacts, and create fresh sessions for an attacker.
