Reference library
Fraud and AML typology library
Twenty-eight schemes that banks, mobile-money operators and insurers face, each explained the way an investigator would: how it works, the red flags, the data signals worth measuring and what to do next. Free to read, cite and share.
28 typologies
BankingAML & transaction monitoring
- StructuringBreaking cash deposits or transfers into amounts below the reporting threshold so that no single transaction triggers a mandatory report.
- Mule ringsNetworks of accounts, recruited or controlled by one organizer, that receive criminal proceeds and pass them on to break the audit trail.
- Velocity spikesA sudden rise in the number or value of transactions on an account, well above its own history, often the first sign of takeover or mule use.
- Dormant-account reactivationA long-inactive account suddenly moves funds, often after a contact-detail change, pointing to takeover, insider abuse or mule recruitment.
- Round-trippingMoving funds out through intermediaries and back to the originator so they return looking like investment, loans or trade income.
- Synthetic identitiesIdentities assembled from a mix of real and invented details, used to open accounts, build credit, then borrow out or move illicit funds.
BankingCard fraud
- Card testingRunning many small or zero-value authorizations against stolen card details to find which cards are live before using them for larger fraud.
- Stolen-card burstsRapid spending on a compromised card in the short window between theft and blocking, often across many merchants and channels.
- BIN attacksGenerating card numbers from a known issuer prefix (BIN) and guessing expiry dates and security codes until authorizations succeed.
BankingMobile money & remittances
- SIM-swap takeoverMoving a victim's phone number onto a SIM the fraudster controls, then using intercepted one-time passwords to take over bank and wallet accounts.
- Agent cash-out launderingUsing mobile-money agents, sometimes complicit ones, to turn fraud or crime proceeds held in wallets into cash that can no longer be traced.
- Mobile-money Ponzi schemesInvestment or savings schemes run over mobile money that pay early members from later members' deposits until inflows slow and the scheme collapses.
- Corridor structuringSplitting a large cross-border transfer into many small remittances, across senders and providers, to stay under limits and reporting thresholds.
- Funnel accountsAccounts that take cash deposits from many people in different places and are drained quickly elsewhere, moving funds between regions.
InsuranceMotor claims
- Staged-accident ringsOrganized groups that cause or fake collisions, then claim through a recurring cast of drivers, witnesses, tow operators and repairers.
- Phantom vehiclesCover taken out on a vehicle that does not exist or is no longer held by the insured, followed by a theft or total-loss claim.
- Multi-claim VINsOne vehicle identification number on several claims across policies, claimants or insurers, often for the same damage claimed more than once.
- Inflated claimsA genuine motor loss padded with unrelated damage, excess labor hours, parts that were never fitted, or inflated towing and storage charges.
InsuranceLife
- Ghost policiesLife or funeral policies written on fictitious people, or on real people who never agreed to cover, to earn commission or claim benefits.
- Early-death clustersDeath claims bunching soon after policy inception, often around one intermediary, area, certifying doctor or funeral home.
- Over-insuranceCover far beyond the insured’s income, means or need, often stacked across several policies or insurers before a claim.
InsuranceMedical
- Provider collusionMedical providers acting together, or with members and recruiters, to bill for care that was unnecessary, never given or inflated.
- Phantom billingClaims for consultations, procedures, tests or supplies that were never provided, usually submitted against real member details.
- Doctor shoppingA member visiting several doctors and pharmacies to obtain overlapping prescriptions, often for controlled medicines, for misuse or resale.
- Impossible billing daysA provider billing more time in a day than one practitioner could work, or for services in two places at once.
InsuranceProperty claims
- Arson patternsFires set or arranged by the insured to claim on buildings, stock or vehicles, often preceded by financial strain and clustered by area or party.
- Repeat lossesThe same person, address or asset claiming repeated losses, often across several insurers, more often than the underlying risk explains.
- Inflated contents claimsContents claims padded with items never owned, values above what was paid, or receipts that were altered or fabricated.
Get started
Detect all 28, in real time
FinCrimes scores every transaction, claim, policy and party against these typologies, with an explainable evidence trail on every alert.