OR-04 Banking detail fraud

⚠️ risk statement a fraudster impersonating an intermediary or policyholder changes banking details on an agreement or a refund, diverting commission or refund payments gross rating high ; residual medium , trend watch 🧭 attack paths seen in the industry compromised intermediary mailbox a fraudulent actor sends a banking detail change using authentic branding and credible intermediary correspondence insider enabled amendment submission an internal or partner contact submits fraudulent changes alongside legitimate operational amendments refund redirection timing attack fraudulent refund amendments are submitted immediately following policy cancellation before customer confirmation controls complete 🛡️ key controls control type evidence call back verification to the number already on file (ctrl d 11 pattern) preventive call log reference on the amendment record four eyes release on refunds above threshold preventive second approver in payment run log confirmation letter to the old contact channel on every banking change detective dispatch record 🚫 banking verification control all call back verification activity must use the telephone number already recorded in the core system contact details provided in the change request must never be used for authentication 📈 watch rationale attempt volume is rising industry wide; the control set is adequate but attempt detection reporting is manual improvement candidate automated alert on banking change + refund within 30 days 🧾 evidence retention expectations store call recordings or call log references against the amendment transaction retain payment approval evidence within the finance workflow archive preserve outbound notification evidence for all banking detail amendments escalate failed verification attempts through operational fraud incident management procedures