An investigator closing a fraud alert has to settle two facts first: where the fraud got in, and who carries the loss. Picture a transfer of 9,500 dollars to a payee the customer added an hour earlier. If a stranger sent it with a stolen password, the fraud entered at account access, and consumer rules usually cap what the holder loses. If the customer sent it on a caller's instructions, it entered at the payment, and the customer's own consent leaves the loss with them unless a refund rule applies.
Every type below is a form of fraud, a lie told for money or advantage, and each control in the tables is one part of a fraud detection and prevention program.
What are the types of fraud, mapped by where they enter?
The types of fraud fall into five stages, set by the point where the deception first reaches the firm or its customer.
Table 1. Five stages where fraud enters (as of November 2026)
| Stage | Entry point | Types on the map | Who usually pays | One dated number |
|---|---|---|---|---|
| Onboarding | applications, new accounts, new hires | 5 | the lender, or the person whose identity was used | card accounts opened in someone else's name: £16.1m lost, 21,141 cases in 2025 (UK Finance, June 2026) |
| Account access | logins, card details, phone numbers | 4 | the account holder, often refunded by the bank | card account takeover: £37.8m lost, 82,030 cases in 2025 (UK Finance, June 2026) |
| Payment | transfers, cards, ACH, checks, refunds | 17 | the payer, the bank or the merchant | authorized fraud £576.4m, up 19%; unauthorized £703.4m, down 5% (UK Finance, June 2026) |
| Inside the firm | staff with access or authority | 5 | the employer and its investors | 2,402 occupational fraud cases from 143 countries and territories (ACFE, 2026) |
| Third parties | suppliers, processors, insurers, the state, property registers, markets | 9 | the buyer, the insurer, taxpayers or the owner | 12,368 real estate fraud complaints, $275,110,419 lost in 2025 (FBI IC3, April 2026) |
At onboarding and at account access, the firm is the one lied to, about who the customer is. At the payment, the lie is usually told to the customer. Fraud from inside the firm or through a third party comes from someone who already holds a trusted role there, as staff or as a partner the firm pays.
One scheme can cross stages, which is why complead, formerly Sanction Scanner, runs onboarding, screening, monitoring and fraud on one engine. In its fraud detection tool, each customer holds a single risk score from the application to the latest payment.
What changed in fraud types in 2026?
- 25 March. The FTC told Congress that reported consumer fraud losses have risen nearly 430 percent since 2020, and that bank payments carried the largest losses of any way victims paid (FTC testimony).
- April. IC3's 2025 report put losses at $20.877 billion, up 26 percent. It added charity fraud as a crime type and an AI related descriptor, with 22,364 complaints, and its three year tables mark both as not captured in 2023 and 2024 (IC3 2025 report).
- 15 June. UK Finance put 2025 investment scam losses at £221.5 million, the highest it has recorded, while CEO fraud fell to £5.6 million, its lowest since 2021 (Annual Fraud Report 2026).
- 2026. The ACFE's 14th occupational fraud study covered 2,402 cases investigated since January 2024 (Report to the Nations).
Which types of fraud start at onboarding?
IC3's 2025 report names dozens of victim companies that North Korean IT workers deceived into hiring them as remote staff. The FBI saw some of those workers use their network access to take company data. The deception happened at hiring, the onboarding of staff, before any money moved.
Onboarding fraud uses a stolen, invented or borrowed identity to open an account, win a loan or get a job. The firm usually pays. A lender writes off the credit, while the person whose name was used has to prove the debt is not theirs. UK Finance counted 21,141 card accounts opened in someone else's name in 2025, with £16.1 million lost, down 17 percent. Accounts opened here are also lent or sold to move stolen money. UK Finance's intelligence unit recorded 12,438 money mules disrupted in 2025.
The steps to take against identity fraud at this stage come before any credit is granted: combine the identity check, which shows the applicant is a real person and present, with an income check against the account the pay goes into. After approval, compare the first weeks of activity with the purpose the customer gave.
Table 2a. Onboarding: who pays, the first signal and the control
| Type | Who usually pays | First signal | Control |
|---|---|---|---|
| Identity fraud | the lender; the named person must dispute the debt | contact details new to the identity's history | document and liveness check at application |
| Synthetic identity fraud | the lender, often booked as a credit loss | a credit file with no history before its first application | verify the identity number with its issuer |
| Loan fraud | the lender | declared pay never reaches the applicant's account | verify income at its source |
| Mortgage fraud | the lender and any investor in the loan | a valuation or occupancy claim the file cannot support | independent valuation; trace where the deposit came from |
| Money mule | victims upstream; the mule's bank faces their claims | a new account that receives and forwards money within hours | compare early inflows with the stated purpose |
How do fraudsters get into an account?
Account access fraud uses a real customer's existing account. One key is enough. It can be a password, a login code, card details or control of the phone number. This map puts most of what older lists call cyber fraud or online fraud on this stage.
IC3's alert of November 2025 describes the usual way in: texts, calls, emails or fake websites that pose as the bank's support staff. The customer is talked into reading out the MFA code. With it, the criminal resets the password and takes the account over (IC3 alert on account takeover). IC3's 2025 report counted about 4,700 account takeover complaints with $359.7 million lost, and phishing and spoofing was its largest category, at 191,561 complaints. In the UK, card account takeover cost £37.8 million across 82,030 cases.
Breaches and ransomware, which locks data and demands payment openly, sit outside this map. IC3 records personal data breach (67,456 complaints), extortion (89,129) and ransomware (3,611) as crime types of their own, but a breach supplies the logins and identities that the first two stages run on. In the session, a new device, a password reset and a new payee inside the same hour are reason enough to hold the payment for a check.
Table 2b. Account access: who pays, the first signal and the control
| Type | Who usually pays | First signal | Control |
|---|---|---|---|
| Phishing | the account holder, or the bank when it refunds | a login from a new device soon after a fake "bank" message | tell customers the bank never asks for codes; step up new devices |
| Account takeover fraud | the holder, often refunded by the bank | a password reset, then a new payee | hold payee changes made right after a reset |
| Skimming fraud | the card issuer | fraud on many cards last used at one terminal or pump | trace the common point of purchase; reissue the cards |
| Cyber fraud | the holder, the merchant or the business | account or contact details changed online | confirm changes on a channel already on file |
Which types of fraud happen at the payment?
The payment stage holds 17 of the 40 types, split by who pressed send.
Table 2c. Payment: who pays, the first signal and the control
| Type | Who usually pays | First signal | Control |
|---|---|---|---|
| Authorized: the customer sends the money | |||
| APP fraud | the payer; in the UK the payment firm refunds most cases in scope (88% of in scope losses in the rules' first year) | a first small payment to a new payee, then larger ones | check the payee's name; pause first payments |
| Impersonation fraud | the payer | a "bank" or "police" caller asks for an urgent transfer | warn the customer at the moment of payment |
| CEO fraud | the company | an executive's urgent request to pay a new account | call back on a known number; two approvers |
| Romance scam | the payer | growing payments to one new contact | speak with the customer before release |
| Ponzi scheme | later investors | new deposits leave as payouts to earlier investors | trace payouts back to fresh deposits |
| Charity fraud | donors | the receiving account is not the named charity's | match the account to the charity's registration |
| Wire fraud | the sender | wire instructions changed by email | verify by phone; request a recall at once |
| Elder financial exploitation | the older customer | unusual withdrawals with a new helper present | a trusted contact; delay and escalate |
| Unauthorized: someone else sends it | |||
| Transaction fraud | the bank or issuer, within legal caps | a payment the holder says is not theirs | device and behavior checks at authorization |
| Credit card fraud | the issuer or the merchant | spending that breaks the card's usual pattern | authorization scoring; strong authentication |
| Card not present fraud | usually the merchant | a new device with a mismatched address | strong authentication; velocity limits |
| ACH fraud | the account holder or its bank | a debit the holder never approved | debit blocks; verify account changes |
| Check fraud | the bank that took the deposit, or the payer's bank | an altered payee or amount | positive pay; holds on new accounts |
| Ecommerce fraud | the merchant | many cards tried from one device | device checks; velocity rules |
| Bank fraud | the bank | false documents behind an account or payment | verify documents with their issuer |
| After the sale | |||
| Chargeback fraud | the merchant | a dispute from a buyer with earlier undisputed orders on the same device | keep device and delivery evidence |
| Return fraud | the retailer | returns of items the store never sold | tie each return to its original sale |
What is the difference between authorized and unauthorized fraud?
UK Finance draws the line by consent. In unauthorized fraud, someone else makes the payment without the account holder's approval. In authorized fraud, the holder is tricked into paying a criminal posing as a legitimate payee. UK authorized losses rose 19 percent to £576.4 million in 2025, while unauthorized losses fell 5 percent to £703.4 million. Since October 2024, the Payment Systems Regulator's rules have required UK payment firms to refund victims in scope, and 88 percent of in scope losses were refunded in the first year.
In the US, investment scams carried the largest reported consumer losses of 2025: over $7.9 billion, about half of the total. Most of the money left by bank payment, then cryptocurrency. Card issuers, payment service providers and enterprises that pay suppliers by transfer see both kinds in one queue, so the first question on an alert is who pressed send.
After an authorized transfer, the bank's speed decides what comes back. IC3 tells anyone who finds a fraudulent transfer to call their bank at once and ask for a recall, and its Financial Fraud Kill Chain froze $679,013,183 in 2025, a 58 percent success rate.
Which frauds come after the sale?
Two payment types start once the goods have gone. In chargeback fraud a buyer disputes a purchase they made and keeps the goods; in return fraud a customer brings back stolen, switched or used goods for a refund. The merchant pays both, and the evidence kept at the sale decides the dispute.
Which types of fraud start inside a company?
Corporate fraud from the inside is committed by staff against their own employer, or by managers against investors and lenders. The ACFE's 2026 study of 2,402 cases from 143 countries and territories lists the behavioral red flags that came with the highest median losses:
- Excessive pressure from within the organization, $532,000. Targets that cannot be met honestly push people toward false figures.
- Past legal problems, $400,000. A background check at hiring can find this one.
- Unusually close with a vendor or customer, $300,000. A kickback or a fake invoice needs someone inside to approve it.
- Refusal to take vacations, $250,000. A scheme that needs daily care tends to break when someone else covers the desk.
- Wheeler dealer attitude, $250,000. A habit of bargaining around the usual rules is a reason for a second approver on deals outside the usual terms.
Tips arrived most often through the web in the same study, at 46 percent, ahead of email and phone. A reporting route staff trust, enforced leave and a second person on every payment and every change to supplier or pay details are the controls that bring such schemes to light.
Table 2d. Inside the firm: who pays, the first signal and the control
| Type | Who usually pays | First signal | Control |
|---|---|---|---|
| Employee fraud | the employer | an employee who will not take leave | enforced leave and job rotation |
| Embezzlement | the employer, or the client whose money was held | records that only one person ever reconciles | separate holding money from recording it |
| Payroll fraud | the employer | pay to a worker no manager knows, or two staff sharing one account | limit who can change pay rates and bank details |
| Insider fraud | the firm or its customers | access used beyond the role | least access; review the access logs |
| Financial statement fraud | investors and lenders | results that meet every target under heavy pressure | audit committee review of estimates |
Which types of fraud come through third parties?
In June 2025, Paddle, a UK payment processor, agreed to pay $5 million and accept a permanent ban on processing payments for tech support telemarketers, settling FTC allegations (FTC release). The FTC alleged that Paddle opened merchant accounts as a "merchant of record" and used them to take card payments for numerous unrelated merchants, among them tech support schemes run from Cyprus that used fake virus alerts (FTC testimony of 25 March 2026, pp. 7 and 8). The proposed settlement order also requires Paddle to run "effective client screening and monitoring" and to report on its merchant clients' transactions.
Third party fraud reaches the firm through someone it pays, partners with or collects for: a supplier, a processor's merchant, an insurer's claimant, the state, a property register or a market. Who pays follows the partner. The buyer pays in procurement fraud, the insurer and its other policyholders in insurance fraud, taxpayers in tax fraud and benefit fraud, and the owner of record in land fraud.
In property, IC3 logged 12,368 real estate fraud complaints and $275,110,419 lost in 2025. Its June 2026 alert on parcel owner impersonation describes criminals who fake a landowner's identity and use it to sell vacant land through a local realtor and title company. In each row of Table 2e, the control is a check on the partner before the first payment, repeated while the relationship lasts.
Table 2e. Third parties: who pays, the first signal and the control
| Type | Who usually pays | First signal | Control |
|---|---|---|---|
| Procurement fraud | the buying organization | a buyer unusually close to one vendor | check who owns each bidder; rotate approvers |
| Tax fraud | taxpayers | deposits far above the income a customer declares | compare account activity with declared income |
| Benefit fraud | taxpayers | a claim that ignores a change in circumstances | match claims against other records |
| Healthcare fraud | public and private health payers | bills for care never given | confirm care with the patient; claims analytics |
| Insurance fraud | the insurer, then other policyholders | a claim soon after cover starts | review claims against policy history |
| Bankruptcy fraud | creditors | property moved out just before the filing | review transfers made before the petition |
| Land fraud | the owner of record | a seller who will not meet and wants a fast sale below market | verify the seller in person; owner alert services |
| Real estate fraud | the buyer | closing wire instructions changed by email | confirm instructions on a known number |
| Market manipulation | other investors | orders placed and canceled to move a price | trade surveillance and reporting |
What are the types of financial fraud, stage by stage?
Financial fraud is the part of this map where the lie is told to a lender, an investor, a card issuer, a tax authority or the reader of a company's accounts. It has no stage of its own: loan and mortgage fraud enter at onboarding, while investment fraud, card fraud and bank fraud happen at the payment. False accounting starts inside the firm, and tax fraud comes through the state as a third party. A business that lends, invests or pays suppliers meets the different types of financial fraud at four of the five stages, each with the control of its stage.
Some schemes only show as suspicious network patterns: several accounts that share a device, a beneficiary or a funding path, as a mule ring does. Corruption examples sit on two stages at once, since a kickback is paid inside the firm to win a supplier's contract. Financial crime is wider again. It adds money laundering, bribery and sanctions breaches, the ground an AML program covers.
Which stage your team watches least. Count the rows above that would raise an alert in your team today. A stage with none, often hiring or supplier onboarding because HR and procurement own them, needs a named owner for its first signals, or a written decision that the firm accepts the loss it carries.
How this page was checked. All figures were reread at their sources on 2 November 2026: the FTC's testimony to the Joint Economic Committee (25 March 2026) and its Paddle release (16 June 2025), the FBI IC3 2025 report (April 2026) and its alerts of 25 November 2025 and 16 June 2026, UK Finance's Annual Fraud Report 2026 (15 June 2026) and the ACFE's Occupational Fraud 2026 page. The who pays, first signal and control cells in Tables 2a to 2e summarize each type's knowledge base entry, reworded. Fact checked by Javid Khasayev. Reviewed on 6 November 2026.
