Theory
Going straight for the money
Some cyber crimes want data, some want reputations, but financial cyber crimes want the most direct prize: money. They target bank accounts, credit and debit cards, and the personal information needed to access them.
This closing lesson of the crime unit covers the main financial crimes, banking fraud, card fraud, phishing, and identity theft, and how attackers pull them off. Because e-commerce runs on payments, these are the crimes an online store and its customers must most guard against. Understanding them is the bridge to the defences studied in the next unit.
At a glance
| Crime | What it does |
|---|---|
| Online banking fraud | Unauthorised access to bank accounts to transfer or steal money |
| Credit / debit card fraud | Using stolen card details for unauthorised purchases |
| Phishing | Tricking users into revealing banking or card credentials via fake emails/sites |
| Identity theft | Stealing personal information to impersonate someone for financial gain |
Theory
How they work
Online banking fraud involves gaining unauthorised access to someone's bank account, through stolen credentials, to transfer or withdraw money. Credit and debit card fraud uses stolen card details to make purchases the real owner never authorised (card skimming devices can capture card data).
Phishing is the common gateway: attackers send fake emails or set up fake websites that look genuine (your bank, a store) to trick you into entering your credentials, which they then use. Identity theft steals enough personal information to impersonate you and open accounts or make transactions in your name. Often these chain together: phishing or a data breach yields details, which are then used for fraud.
Formula
How to defend against financial crime
Because these crimes rely on stealing credentials, the defences focus on protecting and verifying them. Strong authentication, especially two-factor (a password plus a one-time code, OTP), means a stolen password alone is not enough. Secure connections (SSL/TLS) stop details being intercepted in transit. And user vigilance is vital: never enter banking details from a link in an unexpected email, check the site is genuine (the padlock, the real address), and be sceptical of urgent requests, the hallmark of phishing.
So the answer to financial crime combines technology (authentication, encryption) with awareness (spotting phishing). Both matter, since attackers target the weakest of the two.
Quiz
An attacker sends a fake email pretending to be your bank, linking to a lookalike site to trick you into entering your login details. What is this technique called?
- A denial-of-service attack
- Phishing, tricking users into revealing credentials via fake emails or websites
- Software piracy
- Cyber squatting
Show the answer
Phishing, tricking users into revealing credentials via fake emails or websites
Sending fake emails or setting up lookalike websites to trick users into revealing their credentials is phishing, a common gateway to financial crime. Option A, denial of service, floods a system to make it unavailable, it does not trick users into giving up credentials. Option C, software piracy, is illegally copying software, unrelated to stealing login details. Option D, cyber squatting, is registering a brand's domain in bad faith, different from impersonating a bank to harvest credentials. Phishing relies on deception (fake but convincing messages and sites) to get you to hand over your details, which are then used for fraud. Defend by never entering credentials from unexpected links and verifying the real site.
Think first
Why does two-factor authentication help so much against financial crime?
If an attacker steals your password through phishing, why does two-factor authentication still protect you? Then tap.
Show the answer
Because two-factor authentication requires a SECOND, separate proof of identity beyond the password, so even if an attacker steals your password, they still lack the second factor and cannot get in, it breaks the attack that a stolen password alone would complete. Most financial crime starts with an attacker obtaining your CREDENTIALS, often just a password, through phishing, malware, or a data breach. With single-factor login (password only), that stolen password is the whole key: the attacker types it and is in, able to drain your account. Two-factor authentication adds a second requirement of a DIFFERENT kind, typically 'something you have' in addition to 'something you know': after the password, you must also provide a one-time code (OTP) sent to your phone or generated by an app, or approve a prompt on your device. Now a stolen password is NOT enough, the attacker would also need your phone or device to get the second factor, which they almost certainly do not have. So the most common attack, stealing a password, no longer succeeds by itself, and the account stays protected. This is why banks and serious services push two-factor authentication so hard: it dramatically reduces account takeover, because it defends against exactly the weakness (a single stolen secret) that attackers most often exploit. It is not perfect, sophisticated attackers may try to intercept OTPs or trick you into revealing them, which is why user vigilance still matters, but it raises the bar enormously compared with a password alone. Requiring a second, separate factor means one stolen credential is no longer the whole key, which is what makes two-factor authentication such an effective defence. Two locks needing two different keys are far harder to pick than one.
Summary
Key takeaways
- Financial cyber crimes target money directly: bank accounts, cards, and the information needed to access them.
- Online banking fraud gains unauthorised access to accounts to transfer or steal money.
- Credit/debit card fraud uses stolen card details for unauthorised purchases (skimming captures card data).
- Phishing tricks users into revealing credentials via fake emails and lookalike websites; identity theft impersonates someone for financial gain.
- These often chain: phishing or a breach yields details, which are then used for fraud.
- Defences: strong two-factor authentication (a stolen password alone is not enough), secure connections (SSL), and vigilance against phishing.
- Memory hook: financial crime steals money or the credentials for it; defend with two-factor authentication, encryption, and phishing awareness.
- If you are worried about a specific transaction or account, contact your bank through its official channels rather than any link you were sent.