---
title: OR-04 Banking detail fraud
slug: risks-and-controls/or-04-banking-detail-fraud
icon: {"lucideIcon":"BadgeAlert"}
docTags: 
createdAt: 2026-08-18T11:20:08.950Z
---

## ⚠️ Risk statement

A fraudster impersonating an intermediary or policyholder changes banking details on an agreement or a refund, diverting commission or refund payments. Gross rating **High**; residual **Medium**, trend **Watch**.

## 🧭 Attack paths seen in the industry

::::WorkflowBlock
:::WorkflowBlockItem
**Compromised intermediary mailbox**
A fraudulent actor sends a banking detail change using authentic branding and credible intermediary correspondence.
:::

:::WorkflowBlockItem
**Insider-enabled amendment submission**
An internal or partner contact submits fraudulent changes alongside legitimate operational amendments.
:::

:::WorkflowBlockItem
**Refund redirection timing attack**
Fraudulent refund amendments are submitted immediately following policy cancellation before customer confirmation controls complete.
:::
::::

## 🛡️ Key controls

| Control                                                                  | Type       | Evidence                                   |
| ------------------------------------------------------------------------ | ---------- | ------------------------------------------ |
| Call-back verification to the number already on file (CTRL-D-11 pattern) | Preventive | Call log reference on the amendment record |
| Four-eyes release on refunds above threshold                             | Preventive | Second approver in payment run log         |
| Confirmation letter to the OLD contact channel on every banking change   | Detective  | Dispatch record                            |

:::hint{type="danger"}
**🚫 Banking verification control**

All call-back verification activity must use the telephone number already recorded in the core system. Contact details provided in the change request must never be used for authentication.
:::

## 📈 Watch rationale

Attempt volume is rising industry-wide; the control set is adequate but attempt-detection reporting is manual. Improvement candidate: automated alert on banking change + refund within 30 days.

:::ExpandableHeading
## 🧾 Evidence retention expectations

- Store call recordings or call log references against the amendment transaction.
- Retain payment approval evidence within the finance workflow archive.
- Preserve outbound notification evidence for all banking detail amendments.
- Escalate failed verification attempts through operational fraud incident management procedures.
:::