How it works
Accounts that have been inactive for a long period are attractive because no one is watching them. The holder may have emigrated, died or forgotten the account, so unusual activity is unlikely to be reported. Fraudsters reactivate them through account takeover, through insiders who change contact details or authorize withdrawals, or by buying access from the holder.
The pattern is a long flat line followed by sudden activity: a change of phone number or address, a new card or digital banking registration, then inbound credits or withdrawals. Each step can look routine on its own, and a rule that only scores transaction values will miss the account-maintenance events that come first. In mobile-money markets, a dormant number that the network operator recycles to a new subscriber can expose any bank or wallet profile still linked to it.
Dormant and unclaimed balances are also a target for internal fraud, where staff with access to dormancy flags reactivate accounts and divert the balance. Controls therefore need to record who reactivated an account and what was changed, not only the transactions that follow.
Red flags
- Registered phone number, email or address changed shortly before or after the account wakes up
- A new card, PIN or digital banking registration on an account with no recent activity
- A large inbound credit or a full-balance withdrawal soon after reactivation
- Reactivation processed at a branch, or by a staff user, with no connection to the customer
- Activity from a device, location or channel the customer has never used
Signals the engine evaluates
- Length of inactivity before the first new event, and the value of that event against the historic balance
- Account-maintenance events, such as contact changes, credential resets and new cards, in the window around reactivation
- Device, IP address and location of the reactivating session compared with the customer's historic footprint
- Links between the reactivating device, user or beneficiary and other recently reactivated accounts
Investigation and response
- 01Rebuild the sequence of events from the last genuine activity through reactivation, including who changed what and through which channel.
- 02Verify identity directly with the account holder using contact details held before the change.
- 03Hold outbound payments pending verification, and refer any staff involvement to internal fraud procedures.
- 04Escalate to a case and report to the financial intelligence unit where funds were moved, such as FinCEN in the US or the FIC in South Africa.