The LinkedIn post below by Ms. Macrafic begs the question of what a bank client or credit union member are doing when they come into your branch. What are their intentions with respect to a transaction request which may well not be a typical deposit or withdrawal?
The comments in response to her post below are worth reading and understanding where experienced professionals are coming from.
Vice President, Board Member of the Twin Cities Chapter of Association of Certified Fraud Examiners (ACFE) | Strategic Solutions Advisor, | Certified Fraud Examiner | Passionate Fraud Fighter | Speaker
🚩 5 Signs You May Be Looking at a Scam Victim, Not a Fraudster
One of the biggest mistakes we can make in fraud investigations is assuming:
Unusual behavior = fraudulent intent.
Sometimes the person making the transaction isn’t the fraudster.
They’re the person being manipulated by one.
Here are 5 things that should make you pause and look a little deeper:
1️⃣ A sudden change in behavior
The customer suddenly starts doing things that don’t fit their normal pattern.
•Large transfers.
•New payees.
•Unusual purchases.
•New accounts.
Don’t just ask:
❌ “What did they do?”
Ask: ✅ “What changed—and when did it change?”
2️⃣ They’re following someone else’s instructions
They’re on the phone while making transactions.
They’re being told exactly what to say.
They’re opening an account, moving money, or providing information because someone has convinced them it’s necessary.
That can look suspicious.
It can also be a sign of social engineering.
3️⃣ Their explanation sounds rehearsed
This is where things get interesting.
A victim may repeat the exact language they’ve been given by the scammer:
•“They told me this was a secure account.”
“I’m helping with an investigation.”
“They told me not to tell anyone.”
That doesn’t necessarily mean they’re lying.
It may mean someone has already written the script for them.
4️⃣ There’s fear, urgency, or emotional pressure
Listen for:
⏰ “I have to do this right now.”
😨 “They said I’ll be arrested.”
🔐 “They told me my account was compromised.”
🤐 “They told me not to tell the bank.”
Fear and urgency can dramatically change decision-making.
The transaction may be the visible symptom of the manipulation happening behind it.
5️⃣ The activity doesn’t make sense without the influence
This is the question I really want investigators to consider:
“Would this person normally do this if someone wasn’t directing them?”
If the answer is no, investigate the influence.
•Who contacted them?
•What were they told?
•What did the scammer convince them would happen?
•What instructions were they given?
•What happened immediately before the transaction?
🧠 THE BIGGER PICTURE
Don’t investigate only the transaction.
Investigate the story surrounding the transaction.
A fraudster may be trying to hide what they’re doing.
A scam victim may be trying desperately to do exactly what they’ve been told to do.
Those behaviors can look remarkably similar on a transaction-monitoring screen.
The difference is often found in:
•Behavior.
•Context.
•Influence.
And that’s why great fraud investigations require more than identifying red flags.
They require curiosity, context, and sometimes a little psychology.
💬 What is one question you ask that helps you distinguish a victim from someone intentionally committing fraud?
#FraudFighters #FraudInvestigation #FraudPrevention #ScamPrevention #FinancialCrime #FraudRisk #SocialEngineering #CFE #FraudAwareness #VictimCentered
Phillip Lea, CAMS, CFE Premium Profile 3rd+Phillip Lea, CAMS, CFE • 3rd+
Stephanie Macrafic,CFE The first question is often “who benefits/ where is the money going?” because understanding the activity can direct our next steps without making contact or performing outside research. What other activity besides my target transaction is occurring? So often the “share” the customer gets to keep is minuscule compared to the total of unusual activity. There’s more, of course. Your institution’s risk tolerance and attitude toward production vs. care may present challenges. But ideally we get to do the right thing.
Phillip Lea, CAMS, CFE – Thanks for sharing your thoughts Phillip. I agree I think these are good question to consider and can be a good starting point. I also think it can be easy for victims to be overlooked and assumptions that they are benefiting and they are moving the money when scam and social engineering are involved.
Chris A. McCulloch , CFE, MCBL, CHA Verified Profile 3rd+Chris A. McCulloch , CFE, MCBL, CHA • 3rd+
A good question to ask is “who asked you to come to the bank today (or send funds or whatever it is)”. Because they’ve been groomed they usually answer “no one”. Then I say”well that’s good because if someone had asked you, they’re part of a scam. And if no one asked you to do this, then no one will mind when we delay it to protect you.”
