Fraud protection
How the common attacks actually work, and the one habit that defeats most of them.
Last updated
Most fraud is social, not technical
Encryption is rarely broken. People are persuaded. The overwhelming majority of losses begin with someone convincing the account holder to authorise something themselves — which is why a bank's technical controls, however good, are not the whole defence.
The patterns worth recognising
- The urgent call from your bank's fraud team, asking you to move money to a 'safe account'. No such account exists anywhere.
- A message about a failed delivery with a link to update payment details.
- An invoice from a known supplier with changed bank details, usually after their email was compromised.
- A refund that requires you to read out a code, which is the code authorising the payment.
- An investment opportunity with a deadline. The deadline exists to prevent you checking.
The habit that defeats them
End the contact and re-initiate it yourself, using a number or address you already had. Not the number they gave you, not the one in the message, and not the one that called. This single habit defeats nearly every impersonation attack, because the attacker's entire advantage is controlling the channel.
What a real firm does
Scores each authorisation in flight and can hold one for confirmation; monitors for patterns across accounts; and staffs a fraud line continuously with a stated response time. This is a demonstration project and does none of it.