OR-04 Banking detail fraud
⚠️ Risk statement
A fraudster impersonating an intermediary or policyholder changes banking details on an agreement or a refund, diverting commission or refund payments. Gross rating High; residual Medium, trend Watch.
🧭 Attack paths seen in the industry
Compromised intermediary mailbox A fraudulent actor sends a banking detail change using authentic branding and credible intermediary correspondence.
Insider-enabled amendment submission An internal or partner contact submits fraudulent changes alongside legitimate operational amendments.
Refund redirection timing attack Fraudulent refund amendments are submitted immediately following policy cancellation before customer confirmation controls complete.
🛡️ Key controls
Control | Type | Evidence |
|---|---|---|
Call-back verification to the number already on file (CTRL-D-11 pattern) | Preventive | Call log reference on the amendment record |
Four-eyes release on refunds above threshold | Preventive | Second approver in payment run log |
Confirmation letter to the OLD contact channel on every banking change | Detective | Dispatch record |
🚫 Banking verification control
All call-back verification activity must use the telephone number already recorded in the core system. Contact details provided in the change request must never be used for authentication.
📈 Watch rationale
Attempt volume is rising industry-wide; the control set is adequate but attempt-detection reporting is manual. Improvement candidate: automated alert on banking change + refund within 30 days.