Glossary

Access Rights Abuse refers to the improper or unauthorized use of legitimately granted system access by authorized users.

Access rights abuse is commonly associated with insider threats, weak internal controls, and insufficient segregation of duties. It is particularly critical when privileged accounts are used to bypass controls or manipulate data.

It is a common driver of internal IT-related fraud and can lead to significant financial and operational damage.

An administrator misuses privileged access to alter financial data for personal benefit.

Unauthorized access to user accounts.

Account takeover is commonly associated with cyber fraud, social engineering, and access rights abuse. It affects digital platforms, email systems, and business-critical applications and often serves as an entry point for further fraudulent activities.

Enables unauthorized transactions, data manipulation, and control bypassing, posing a significant risk especially for privileged accounts.

Email account hijacked after phishing.

Business Email Compromise (BEC) is a fraud scheme in which business email accounts are compromised or impersonated to redirect payments or obtain sensitive information.

Business Email Compromise (BEC) is a form of cyber fraud closely linked to social engineering and phishing. Perpetrators exploit weaknesses in internal controls, particularly in payment approval processes and vendor master data management.

Business Email Compromise (BEC) is one of the most financially damaging forms of fraud, as it systematically exploits trust, processes, and control gaps.

A spoofed CEO email instructs an urgent wire transfer to a fraudulent account.

Cyber fraud involves fraud schemes executed through digital technologies.

Cyber fraud is closely linked to social engineering, access rights abuse, and other forms of occupational fraud as well as external cyber-enabled crime. It is particularly prevalent in digitalised business processes, e-commerce environments, and interconnected IT systems.

Represents a highly dynamic and difficult-to-control risk area due to scalability, automation, and global reach.

Phishing attacks to steal credentials.

Deepfake Fraud refers to a form of fraud in which artificially generated or manipulated audio, video, or image content is used to convincingly impersonate a real person. The objective is to exploit trust in order to influence financial transactions, obtain sensitive information, or manipulate organisational decisions.

Unlike traditional impersonation techniques, Deepfake Fraud relies on generative artificial intelligence models capable of replicating a person’s voice, facial expressions, and behavioural patterns with a high degree of realism.

Deepfake Fraud represents an evolution of social engineering and operates at the intersection of cybercrime, identity fraud, and organisational fraud.

It is particularly relevant in scenarios involving:
• Business Email Compromise (BEC)
• CEO Fraud / executive impersonation
• payment authorisation processes
• remote communication channels (phone, video conferencing)

The increasing availability of generative AI technologies, including voice cloning and video synthesis, has significantly lowered the barrier to entry. What previously required specialised expertise can now be achieved using commercially available or even freely accessible tools.

Deepfake Fraud poses a fundamental challenge to established control mechanisms, as traditional forms of authentication—especially voice and visual recognition—become unreliable.

Its significance is driven by several factors:
• High credibility: impersonations appear realistic and persuasive
• Bypassing of controls: e.g. verbal confirmations or informal approval processes
• Scalability: attacks can be replicated with relatively low effort
• Detection complexity: manipulation may only be identifiable through forensic analysis

For organisations, this implies a shift from trust-based verification towards structured, multi-layered control environments.

A finance manager receives a phone call that appears to come from the CEO. The voice, tone, and speaking style match the known characteristics of the executive. During the call, an urgent payment is requested in connection with a confidential transaction.

In reality, the voice has been synthetically generated using AI-based voice cloning. The payment is executed without additional verification.

The misuse of personal data to impersonate someone.

Identity fraud is often linked to cyber fraud, social engineering, and insufficient know your customer (KYC) processes. It is particularly relevant in digital business models, financial services, and e-commerce environments where identities are verified remotely.

Leads to financial losses, reputational risks, and regulatory consequences and requires robust identity verification and monitoring mechanisms.

Account opened using stolen ID.

Phishing refers to attempts to obtain sensitive information such as credentials or payment data through deceptive communication.

Phishing is a core technique in cyber fraud and is closely linked to social engineering, account takeover, and access rights abuse. It often serves as the initial attack vector in multi-stage attack scenarios, particularly in digital and interconnected environments.

A common entry point for broader attacks and a key risk factor for both information security and fraud.

Fake IT support email requests credentials.

SIM Swap Fraud refers to a form of fraud in which an attacker takes control of a victim’s mobile phone number by fraudulently transferring it to a new SIM card issued by a mobile network provider.

By gaining control over the phone number, the attacker can intercept SMS-based authentication messages, including one-time passwords (OTPs), and use them to access and compromise existing accounts.

SIM Swap Fraud is closely associated with:

• Account Takeover
• Identity Fraud
• Social Engineering
• bypassing Multi-Factor Authentication (MFA)

The attack exploits weaknesses in identity verification processes at telecom providers, often combined with previously obtained personal data.

It commonly targets:

• online banking systems
• cryptocurrency platforms
• email accounts
• social media accounts

SIM Swap Fraud represents a critical vulnerability in systems relying on SMS-based authentication.

Key risks include:

• Bypassing authentication controls: SMS-based OTPs are compromised
• Rapid escalation: multiple accounts can be accessed quickly
• High financial impact: particularly in financial and crypto environments
• Third-party dependency: security depends on telecom provider processes

The method highlights the limitations of SMS-based multi-factor authentication as a standalone security measure.

An attacker impersonates a victim when contacting a mobile network provider, using stolen or publicly available personal data. The attacker requests a SIM replacement for the victim’s phone number.

Once the number is transferred, the attacker receives all incoming messages, including authentication codes, and uses them to access banking or email accounts.

Social Engineering refers to the deliberate psychological manipulation of individuals to induce them to disclose confidential information or perform actions that compromise security.

Social engineering is a key method in cyber fraud and is closely linked to business email compromise (BEC) and access rights abuse. Attacks are typically executed via email, phone, or digital communication channels and aim to bypass internal controls.

It exploits human behavior such as trust, authority, and urgency, making it one of the most effective ways to circumvent technical security measures.

A fraudulent email impersonating a CEO requests an urgent payment transfer.

Synthetic Identity Fraud refers to a form of identity fraud in which a fictitious identity is created by combining real and fabricated information. Typically, genuine personal data—such as social security numbers or dates of birth—is merged with invented names, addresses, or other identity attributes.

The objective is to establish a seemingly legitimate identity that does not correspond to a real individual and can be used for financial or fraudulent activities.

Synthetic Identity Fraud is particularly relevant in environments involving:
• financial services and lending
• Know Your Customer (KYC) and Customer Due Diligence (CDD)
• digital onboarding and identity verification
• online banking and fintech platforms

Unlike traditional identity theft, this method does not involve taking over an existing identity. Instead, a new identity is gradually constructed and strengthened over time through legitimate-looking activity.

The increasing digitisation of onboarding processes and the availability of large datasets have significantly increased exposure to this type of fraud.

Synthetic Identity Fraud is considered one of the most difficult fraud types to detect, as there is no clear victim who can report misuse.

Key challenges include:
• Detection complexity: no direct link to a real individual
• Long-term development: identities are built over time
• High financial impact: especially in credit and lending environments
• Circumvention of controls: traditional KYC measures are insufficient

Organisations must therefore complement identity verification with behavioural analytics and cross-data validation.

A synthetic identity is created by combining a real but inactive social security number with a fictitious name. Over time, small financial activities are conducted to establish a credit profile.

Once the identity is considered credible, larger credit lines are obtained and subsequently defaulted.