12 types of financial fraud

Fraud teams clear one alert queue, and new typologies appear in the next: APP scams, synthetic identities, and deepfake impersonation now transfer money in seconds – leaving legacy, rules-based systems written years ago struggling to keep pace.

This guide defines the main types of financial fraud businesses face, lists red flags for each, and explains how financial institutions (FIs) can deploy intelligent, real-time technology to detect and prevent them.

What are the main types of financial fraud businesses face?

The main types of financial fraud are identity and account fraud, payment fraud, scams and social engineering, first-party and merchant fraud, and cybercrime. As of September 2025, fraud accounts for 45% of crime, with 1 in 14 adults being victims, and total losses of nearly £14.4 billion. To combat this rising threat, FIs are transitioning from static rules to AI-powered risk detection. The National Crime Agency lists investment, romance, payment, and online bank account fraud among the most common types of fraud in the UK.

TLDR

• Identity and account fraud covers identity theft, synthetic identities, and account takeover.
• Payment fraud covers card and authorized push payment (APP) fraud.
• Scams rely on social engineering, from romance and investment schemes to fake charities.
• First-party fraud, such as chargeback and return fraud, starts with the customer.
• Detection depends on real-time monitoring and minimizing alert noise to enable compliance teams to focus on genuine risk.

Financial fraud types at a glance

The 12 core types below are grouped into tiers, with two related typologies added to reflect shifts in fraud since the guide’s first publication.

Identity and account fraud

1. Identity theft

Identity theft is the illegal acquisition and use of sensitive personal information – such as Social Security numbers, dates of birth, or bank account details – to commit fraud. In a notable 2024 deepfake case, a finance worker released $25 million after a call with fraudsters who used deepfake technology to impersonate the firm’s CFO.

Common techniques:

• Phishing through messages that impersonate banks, regulators, or colleagues.
• Physical theft of wallets and interception of mail.
• Exploitation of large-scale data breaches.

Rigorous customer authentication and real-time monitoring help FIs prevent unauthorized account access.

2. Synthetic identity fraud

Synthetic identity fraud combines real and made-up information – such as pairing a stolen Social Security number with a fabricated name and date of birth – to build a fake identity that opens accounts and builds credit before defaulting. Because no single real-world victim spots the activity, FIs rely on advanced, AI-powered onboarding checks to verify whether identity data is consistent across sources. Read more in our guide about synthetic identity fraud.

3. Account takeover fraud

Account takeover fraud occurs when a criminal gains access to an individual’s online account to steal money or sensitive information. Attackers typically use credential stuffing, where automated bots test lists of leaked login credentials, or brute-force attacks that guess passwords.

Red flags:

• Multiple password reset requests and login attempts.
• Changes to contact details, such as addresses and backup email addresses.
• Requests for new cards or checkbooks to a new address.
• Unusual or rapid setup of a new authorized user.

Payment fraud

4. Payment fraud

Payment fraud covers practices that target financial transactions, including credit card and check fraud. According to UK Finance, criminals stole over £1.2 billion through authorized and unauthorized fraud in the UK, with nearly 80% of APP fraud cases originating online. Real-time transaction monitoring and automated verification checks help FIs flag irregular payment patterns before funds leave the institution.

5. Authorized push payment (APP) fraud

APP fraud happens when a scammer tricks a victim into making a bank transfer, often by posing as the bank and asking for funds to be sent to a “safe account” – a request genuine banks never make. Because the customer authorizes the payment, FIs depend on advanced behavioral monitoring and dynamic payment warnings before funds leave. 

6. Credit card fraud

Credit card fraud is the unauthorized use of a debit or credit card to withdraw cash or make purchases. The Federal Trade Commission (FTC) found that US credit card fraud reports skyrocketed to 503,450 reports recently, representing a 54% spike over previous years. Card-not-present (CNP) fraud uses stolen card details online, while card-present fraud relies on stolen, skimmed, or intercepted cards.

Scams and social engineering

7. Advance fee and romance fraud

Advance-fee fraud entices victims with unrealistic investment opportunities or fictitious prizes, requiring an upfront payment. Many romance scams end in “pig butchering” – a multi-stage scam where fraudsters build trust over time before pushing the victim into fake cryptocurrency investments.

Indicators to share with customers:

• Offers that seem too good to be true.
• An unusual sense of urgency.
• Any mention of upfront payment or cryptocurrency transfers.

8. Investment, pension, and insurance fraud

Investment fraud uses cold calls, fake documents, and convincing websites to promote worthless schemes. Pension scams aim to trick victims into transferring their entire pension savings or withdrawing funds early. Insurance fraud can involve “ghost brokers” who impersonate legitimate insurers to sell fraudulent policies. Customers can and should check a firm’s status with the relevant regulator – such as the Financial Conduct Authority (FCA) in the UK – before transferring funds.

Educating customers and staff to watch out for the following can assist with protection against illicit investment opportunities:

• Stay vigilant when receiving cold calls, particularly from a company or organization with which the individual has never interacted.
• Investigate online reviews of any company offering investment opportunities, and check with the relevant local financial authority, such as the FCA in the UK, to ensure it is properly regulated.
• Ask for legitimate documentation detailing any proposal, and seek expert advice if unsure.

9. Social engineering: Phishing, smishing, and vishing

Social engineering manipulates people into handing over data or money, using email (phishing), text (smishing), or phone calls (vishing). Smishing often targets younger demographics aged 18–24, and reports of recruitment scams have more than doubled in recent years.

10. Fraudulent charities

Fraudulent charities exploit goodwill by soliciting donations for non-existent causes or by impersonating reputable organizations. FIs can apply robust customer due diligence to charity accounts and run continuous sanctions and watchlist screening.

• Using transaction monitoring to detect unusual patterns associated with potentially fraudulent charities. Many software options allow FIs to set up alerts for large or irregular donations.
• Ensuring there is a robust customer due diligence (CDD) process in place to thoroughly vet charitable organizations opening accounts.
• Conducting real-time screenings of charities against global watchlists and sanctions.
• Advising customers to watch out for red flags such as urgency, vague mission statements, and unsolicited contact from charities they’ve not previously dealt with. Firms should also encourage customers who wish to donate to do so through verified channels, such as a charity’s registered site.

First-party, merchant, and cyber fraud

11. Chargeback fraud

Chargeback fraud occurs when a customer disputes a legitimate transaction, often referred to as “friendly fraud,” costing merchants tens of billions annually, according to Retail TouchPoints. Customers usually have 60 days to dispute a charge under the Fair Credit Billing Act, so detailed transaction records are essential for challenging false claims.

• Legitimate chargebacks, aimed at protecting customers, involve billing errors, unauthorized charges, or undelivered goods and are supported by regulations such as the Fair Credit Billing Act (FCBA) and the Electronic Funds Transfer Act (EFTA). Customers have a specified timeframe to dispute, usually 60 days under the FCBA, ensuring protection against unauthorized transactions.
• Fraudulent chargebacks, also known as friendly fraud, occur when customers falsely claim legitimate dispute reasons, such as unauthorized charges or non-receipt of goods. Resolving these requires firms to navigate a process of proving the legitimacy of the charge. Merchants suspecting misleading claims can challenge the chargeback, emphasizing the importance of understanding legitimate and illegitimate grounds to manage resources and protect against unwarranted claims efficiently.

12. Return fraud

Return fraud exploits retail refund policies through receipt fraud, bricking, and the return of stolen items. Bricking means buying an electronic device, stripping out its valuable parts, and returning it as faulty. Returns pattern analysis, which flags customers who return goods unusually often or at unusually high value, helps merchants spot repeat abuse before losses build up.

Related typologies

Return fraud

Return fraud includes receipt fraud, bricking, and returning stolen items to exploit retail refund policies.

• Receipt fraud: Stealing or falsifying receipts to return a product and profit from the refund. This can also involve purchasing an item from a retailer at a lower price and attempting to return it to another store with a higher retail value.
• Bricking: This is when a malicious actor purchases an electronic device, renders it unusable, and returns it for profit. This can also include switch fraud, which involves buying a working item and then attempting to return a previously damaged version to profit from the return policy.
• Stolen items: Occurs when an item is stolen and returned for a full refund.

Consumer and mortgage fraud

Consumer fraud covers mortgage fraud, predatory lending, and false advertising.

• Identity fraud: This occurs when a perpetrator steals an individual’s identity or card details, either online or through physical theft. Once the identity is assumed, malicious actors will attempt to access a bank account and transfer funds without authorization.
• Mortgage/real estate fraud: Real estate and mortgage fraud encompasses deceptive practices in the real estate sector. Among the most notable types of fraud is mortgage fraud, which involves intentional deception in mortgage lending, where consumers provide false information to obtain a mortgage or influence loan terms. 
• False advertising occurs when a business provides inaccurate information about the quality or benefits of a product or service, violating legal obligations that mandate honesty in advertising and are overseen by watchdogs such as the UK’s Advertising Standards Authority (ASA). Such practices include false assertions about a product’s capacity to enhance health, mental faculties, or cognitive abilities.

Cybercrime

Cybercrime encompasses malware, cryptojacking, and ransomware, and the Financial Action Task Force (FATF) recommendations call for risk-based anti-money laundering (AML) programs to address these evolving digital threats.

• Phishing: As mentioned earlier, this involves fraudulent attempts to obtain sensitive information or steal an individual’s identity. Phishers usually pose as trusted entities and use emails, messages, or websites to gain a target’s trust.
• Malware: Short for malicious software, it refers to malicious programs, such as viruses, that harm or exploit vulnerabilities in an individual’s computer system or device.
• Cryptojacking: Hackers illicitly use a victim’s system to mine cryptocurrency without their knowledge or consent; this is often a byproduct of successfully installing malware.
• Ransomware: Ransomware is software that locks a user’s files and devices, rendering them inaccessible. Cybercriminals will demand a ransom, usually in cryptocurrency, to unlock them.

How do FIs detect and prevent financial fraud?

In the ongoing battle against fraud in its many forms, FIs should pair the best practices in this guide with ongoing staff training and customer-awareness initiatives. Fraud detection software is also vital: these tools help businesses keep pace with fast-evolving payment fraud by combining AI models with rules a team can configure and adjust.

With the right software, FIs can set thresholds aligned with their own risk appetite and act in real time, deciding to proceed, flag, or hold a payment before the money moves, rather than reviewing it after a loss. The strongest tools also make each decision explainable, showing the reasoning behind an alert so analysts can work faster and stand behind their decisions with regulators.

Fraud and AML teams often work in separate tools, which can mean connected people and entities slip through the gaps. Running fraud detection on the same platform and data as screening and monitoring closes those gaps, so fraud and compliance act on the same signals instead of two disconnected systems.

Real-time monitoring

Real-time monitoring scores each transaction before funds settle, which matters most for payment, APP, and card fraud. On instant payment rails – where funds transfer in seconds – a check that runs after settlement runs too late.

Alert prioritization

Alert prioritization ranks alerts by risk, so analysts review the likeliest cases first. Explainable AI-driven alerts show why a transaction was flagged, speeding up decisions and supporting audit trails.

Entity and ownership data

Entity and ownership data link companies to their directors and beneficial owners. This helps FIs spot fraudulent charities, shell business accounts, and synthetic identities that look clean in isolation but present high risk when connected.

Fraud and AML alignment

Fraud and AML alignment gives both teams one shared view of customer risk. Cybercrime proceeds and scam networks often surface in both fraud alerts and AML monitoring, so shared data reveals connections that either team would miss on its own – breaking down traditional operational silos.

Customer education

Customer education covers scams the customer authorizes, such as APP, romance, and investment fraud, where transaction controls alone don’t always stop the payment. Clear payment warnings and reminders that banks never request transfers to a “safe account” give customers a chance to pause and reconsider.

Which controls should FIs prioritize?

• Payment firms on instant rails should prioritize real-time monitoring because APP and other payment fraud losses occur before a batch review can run.
• Banks with large alert backlogs benefit most from alert prioritization, as clearing false positives frees analysts to focus on genuine cases.
• FIs that onboard charities or business accounts need entity and ownership data and sanctions screening at onboarding and on an ongoing basis.
• Virtual asset service providers (VASPs) and crypto platforms, where cybercrime proceeds and scam payouts often meet, benefit most from aligning fraud and AML monitoring.
• Retail banks with large consumer bases should pair any of these controls with customer education on scams.

Fraud typologies change faster than static rules, so the FIs that keep pace pair real-time monitoring with high-quality alerts that let analysts focus on genuine risk.

Frequently asked questions

What are the main types of financial fraud businesses face?

The main types are identity and account fraud, payment fraud, scams and social engineering, first-party and merchant fraud, and cybercrime. 

What is the most common type of financial fraud?

In the UK, the National Crime Agency lists investment, romance, payment, and online bank account fraud among the most common types, reflecting the reality that most fraud begins online.

What is APP fraud?

APP fraud is a scam in which a criminal tricks a victim into authorizing a bank transfer to an account the criminal controls, often by posing as the bank and requesting a transfer to a “safe account.”

How can banks detect fraud?

Banks can detect fraud by monitoring transactions in real time, screening customers and entities, prioritizing alerts by risk, and aligning data between fraud and AML teams.

What is fraud prevention software for banks?

Fraud prevention software monitors transactions and customers for suspicious behavior, and banks are increasingly shifting from noisy, rules-only workflows to AI-native risk-detection platforms.