Legal Hub
The working vocabulary of fraud investigation, with the statutes that give each term its teeth.
also: ATO, account hijacking
When a criminal gains unauthorized access to a victim's bank, brokerage, or email account and uses it to move funds or data.
Account takeover usually starts with stolen credentials from a data breach, phishing, or SIM swapping. Because the login is genuine, banks and platforms can be slow to flag it; attackers often change contact details first so the victim is locked out before the money moves.
also: community fraud
Investment or lending fraud that targets a close-knit community by leveraging shared trust and identity.
The fraudster is often a member or trusted associate of a religious, ethnic, professional, or age-based group. Because victims assume shared identity means shared interests, they rarely verify the investment — and are reluctant to report it when it collapses.
also: UBO, ultimate beneficial owner
The natural person who ultimately owns or controls a legal entity, even if the records list a nominee or another company.
Beneficial-ownership rules exist to pierce the layers of shells and nominees used to hide control. Corporate Transparency Act reporting now requires many U.S. entities to disclose their beneficial owners.
also: BEC, CEO fraud, email account compromise
A scheme in which attackers impersonate an executive, vendor, or colleague over email to trick an employee into wiring funds or disclosing data.
BEC rarely relies on malware. Attackers spoof or hijack an email account, study the organization's payment habits, and time a convincing request — often an urgent wire to a 'vendor' — when the right person is available to approve it.
also: friendly fraud, first-party fraud
A customer disputes a legitimate charge to obtain a refund while keeping the goods or services.
Also called friendly fraud, it shifts the cost to the merchant, who usually absorbs the loss plus dispute fees. It is often rationalized as victimless, but organized versions are prosecuted as wire fraud.
also: floating
Writing checks against insufficient funds across two or more accounts to create a false positive balance.
Kiting exploits the float — the delay before a check clears. By depositing a check from Account A into Account B and vice versa, the fraudster manufactures a temporary balance they can withdraw against before either check bounces.
also: bust-out, sleeper fraud
Quietly building credit on an identity, then maxing out every available account and disappearing.
A bust-out can take months. The fraudster opens accounts, pays them on time to raise limits, then charges or withdraws every line at once across all lenders. It is the payoff stage of synthetic identity and stolen-identity schemes.
also: security freeze, fraud alert
A free lock placed on a credit file that prevents lenders from pulling it, blocking new accounts opened in your name.
A freeze is the strongest consumer defense against new-account identity theft: without access to the report, most lenders cannot issue credit. It must be lifted temporarily when you genuinely need financing. A freeze differs from a fraud alert, which only asks lenders to verify identity.
also: no-show employee, phantom employee
A fictitious person, or a real person who does no work, placed on a payroll so salary payments can be diverted or laundered.
Ghost employees appear on the books but never on the floor. The salary is drawn by whoever controls the payroll, and the same trick is used to inflate headcount on loan or credit applications that are keyed to payroll size.
also: reintegration
The final stage of money laundering: re-entering laundered funds into the economy as apparently legitimate money.
Once layered, the funds are used to buy property, businesses, or luxury goods, or are 'invested' back into legitimate ventures. At this point the money looks earned, and tracing it to the original crime becomes hardest.
also: customer due diligence, CDD
The anti-money-laundering obligation for financial institutions to verify a customer's identity, beneficial owners, and source of funds.
KYC requires institutions to confirm who they are doing business with and to monitor activity for red flags. Weak KYC is what allows shell companies, mules, and synthetic identities to move funds through legitimate accounts.
also: layered transfers
The middle stage of money laundering: moving funds through many transactions, accounts, or assets to obscure their origin.
After 'placement' (getting cash into the system) and before 'integration' (returning it as apparently legitimate wealth), layering breaks the paper trail through wires, shell companies, crypto conversions, and purchases. The goal is distance from the original crime.
also: money transfer agent, smurfer
A person who transfers illegally obtained money for others, often recruited under the guise of a job, and who may be criminally liable even if unaware.
Recruiters present mule work as a job: receive funds, forward them, keep a commission. Some mules are genuine victims of romance or employment scams; others knowingly launder. The law generally does not require knowledge of the underlying crime for the transfer to be unlawful.
also: drop account
A bank or crypto account controlled by a fraudster but opened in someone else's name, used to receive and forward funds.
Mule accounts provide the turnover point between victim funds and the criminal network. They are often opened by victims of employment or romance scams who hand over their credentials, or bought from people who sell access to their accounts.
also: smishing, vishing, email spoofing
Messages that impersonate a trusted party to steal credentials, payment details, or one-time codes.
Phishing arrives by email, smishing by text, and vishing by voice call. All three rely on a believable pretext — a bank alert, a delivery fee, an IT password reset — that pushes the target to click, reply, or read out a code before they think to verify.
also: Sha Zhu Pan, romance investment scam
A long-term confidence scam pairing a romance or friendship with a fake crypto platform, grooming the victim before extracting larger deposits.
The name comes from the practice of fattening a pig before slaughter. Victims are cultivated for weeks, shown small successful 'withdrawals,' then encouraged to deposit more until the platform freezes and the operator disappears. It is often run from organized compounds using trafficked workers.
also: fund injection
The first stage of money laundering: introducing illicit cash into the financial system.
Placement is the riskiest stage for launderers because cash is bulky and reporting thresholds apply. Smurfing and cash-intensive businesses are common ways to get the money into banks without triggering reports.
also: pyramid scheme
An investment fraud that pays earlier investors using money from new investors rather than real profits.
A Ponzi scheme depends on continuous recruitment. Early investors are paid to build credibility, which attracts more capital; the scheme collapses when new deposits slow and withdrawals cannot be met.
also: refund scam, advance-fee recovery
A follow-up fraud that targets people who already lost money, promising to recover it for an upfront fee.
Scammers buy 'sucker lists' of known victims and pose as lawyers, investigators, or agencies that can retrieve lost funds. Any payment or personal information sent is lost too. Legitimate recovery rarely requires upfront payment.
also: withdrawal
A formal withdrawal of a published report when it is no longer supported; retracted reports remain visible and marked, not deleted.
On FoundFraud, retracted reports are never silently removed. They stay in the public record and the audit log with a visible retraction notice, so readers can see what changed and why.
also: opportunity to respond
Giving a person or organization criticized in a report a fair opportunity to respond before publication.
A cornerstone of fair reporting: before publishing an allegation, the subject is contacted and their response is published alongside the story. FoundFraud records right-of-reply privately and may publish responses with a report.
also: dating scam, catfishing
A confidence scheme that builds a fake romantic relationship to manipulate the victim into sending money.
Contact often begins on a dating app, game, or social platform. The scammer invests weeks or months in the relationship, then introduces an emergency, a business opportunity, or a 'sure' investment — frequently the on-ramp to pig butchering.
also: shell corporation, front company
A business entity with no real operations or assets, used to hold funds, receive payments, or obscure true ownership.
Shells are legal structures that become criminal when used to hide beneficial owners or move illicit money. They are used to sign leases, open bank accounts, receive fraudulent payments, and launder funds through legitimate-looking activity.
also: SIM hijacking, port-out scam
Hijacking a phone number by porting it to an attacker-controlled SIM to intercept calls and one-time codes.
The attacker impersonates the victim to the mobile carrier and requests a SIM change. Once the number moves, every text-based two-factor code goes to the attacker, opening the door to account takeovers at banks, email, and crypto exchanges.
also: nominee, front buyer
A person with clean credit who purchases property or a vehicle for someone else, concealing the real buyer or the source of funds.
The straw buyer's name and credit are used on the loan; the real buyer takes the asset. If the loans default, the straw buyer is left with the debt and criminal exposure while the organizer walks away.
also: smurfing
Deliberately breaking up transactions to stay below reporting thresholds — a federal crime even when the funds are legal.
U.S. banks must report cash transactions over $10,000. Structuring means splitting a larger sum into smaller deposits or withdrawals to avoid that trigger. Intent is the crime: 'structuring to evade reporting' is illegal regardless of where the money came from.
also: credit jacking, Frankenstein ID
A fabricated identity assembled from real and fake data that can pass identity checks and build credit.
Typically a real Social Security number is paired with a fictitious name and birth date. The identity may be dormant for months while credit is cultivated, then 'busted out' across many accounts at once. Because no single real person matches the record, it can be hard to detect.
also: code inflation
Billing for a more expensive medical service or diagnosis than was actually provided.
Upcoding is a form of healthcare fraud in which a provider submits codes for higher-value procedures than performed, or assigns a more severe diagnosis to justify higher reimbursement. Repeated across many patients, the overbilling compounds quickly.