Lesson 1 · Foundations · Both · 22 min
Fraud Vectors: ATO, Synthetic ID & APP Scams
Know the major retail fraud patterns so product controls target real attacker economics—not theatre.
Objectives
- ▸Differentiate ATO, synthetic identity, and APP / authorised push payment scams
- ▸Map controls to each vector
- ▸Design customer communications that do not enable social engineering
- ▸Prioritise controls by loss and partner-bank scrutiny
Attackers hijack legitimate accounts via stolen credentials, SIM swap, malware, or social engineering of support. Once inside, they change payout rails, add beneficiaries, and drain balances.
- Controls: step-up auth on risky actions, device binding, cool-offs after password/SIM change, beneficiary warm-up.
- Support scripts are part of the control surface—verify callers carefully.
Key terms
ATOSynthetic identityAPP scamMule accountCool-offConfirmation of payee