New Account Schemes and Theft from Customer Accounts

Why This Topic Matters

Financial institutions are the central plumbing of the economy, and the point at which a customer relationship begins (account opening) and the point at which money sits waiting (customer balances) are two of the most attractive targets for fraudsters, both external and internal. On the CFE exam, this material sits within the Financial Transactions and Fraud Schemes section under Financial Institution Fraud. The ACFE treats new account fraud and theft from customer accounts as foundational because they illustrate several recurring exam themes: identity verification, Know Your Customer (KYC) and the Customer Identification Program (CIP), red flags, dormant account risk, insider abuse, and the preventive controls that counter each. If you understand how these schemes work, you can usually reason your way to the correct answer even on questions you have not seen before.

Part 1: New Account Schemes

What They Are

A new account scheme is any fraud in which a perpetrator opens a deposit account at a financial institution with the intent to use that account as the vehicle for theft. The account itself is the tool. The fraudster typically has no intention of maintaining a legitimate banking relationship; the goal is to extract value quickly, before the institution realizes the account holder is fictitious, the deposited items are worthless, or the identity has been stolen.

The Fraud Examiners Manual generally describes new account fraud in a few overlapping forms:

1. False or stolen identification. The perpetrator opens an account using forged documents, a synthetic identity (a mix of real and fabricated data), or the stolen identity of a real person. Once open, the account can be used to deposit bad checks, launder funds, obtain overdraft privileges, receive fraudulent loan proceeds, or order checks and debit cards that will be used to defraud merchants.

2. Business account schemes using stolen or forged checks. The fraudster opens a business account in the name of a real or plausible-sounding company (often a name very similar to a well-known legitimate firm). Checks stolen from the mail or from the legitimate company's incoming payments are then deposited, and the funds are withdrawn before the items are returned or the real payee notices.

3. Personal account schemes using worthless deposits. The perpetrator opens an account with a small deposit, then deposits checks drawn on closed accounts, accounts with insufficient funds, or counterfeit items, and withdraws cash against the uncollected funds. This exploits funds-availability rules and gaps between provisional and final credit. It is closely related to check kiting, though kiting usually involves accounts at two or more institutions.

How New Account Schemes Work, Step by Step

- The fraudster selects an institution, often one outside the area where he or she actually lives or works, so that local references cannot be checked.
- Identification is presented that is fake, altered, or belongs to someone else. A fictitious or disconnected phone number and a mail-drop address are common.
- A modest opening deposit is made, sometimes in cash, sometimes with an out-of-area check.
- Shortly afterward, deposits of stolen or worthless checks begin, often followed immediately by requests for cash withdrawals, cashier's checks, or wire transfers.
- The fraudster may request a large supply of printed checks or a debit card right away.
- By the time the deposited items are returned unpaid, the account has been drained and the customer has disappeared.

Red Flags of New Account Fraud

The exam loves red flag lists. Learn these:

- Customer's residence or business is outside the institution's normal service area.
- Customer has no prior relationship with any bank, or cannot or will not give references.
- Customer is reluctant to provide identification, or the identification looks altered or inconsistent (e.g., a Social Security number issued before the applicant's date of birth).
- Customer's home or business telephone is disconnected or never answered.
- Dress, appearance, or stated occupation seems inconsistent with the type or size of account being opened.
- Customer requests immediate cash withdrawals or cash advances against newly deposited items.
- Account is opened with a large cash deposit or with a check drawn on an out-of-area institution.
- Customer requests a large number of checks or multiple debit cards immediately.
- Business account: no evidence the business exists, the business name closely resembles a well-known company, or the nature of the business does not match the deposit activity.
- Customer appears nervous, hurried, or unusually knowledgeable about funds availability and hold periods.

Prevention and Detection Controls

- Customer Identification Program (CIP). Under Section 326 of the USA PATRIOT Act, institutions must obtain and verify, at a minimum, the customer's name, date of birth (for individuals), address, and identification number (such as a Social Security number or, for non-U.S. persons, a passport or other government number). Institutions must also check names against government lists and keep records of verification.
- Verify identification documents and compare photographs; use documentary and non-documentary methods (credit bureau or database checks).
- Screen applicants through deposit account consumer reporting agencies (such as ChexSystems) to identify a history of closed accounts or check fraud.
- Confirm the address by mailing a welcome letter and following up on returned mail.
- Place holds on deposited items for new accounts consistent with funds availability regulations, and restrict cash-back on deposits during an initial probationary period.
- Require officer approval for business accounts and for high-risk applicants; verify that a business actually exists (state registration, site visit, phone directory).
- Train new accounts personnel on red flags, and reward diligence rather than just account volume.
- Monitor new accounts for the first several months for rapid deposit-and-withdraw patterns.

Part 2: Theft from Customer Accounts

What It Is

Theft from customer accounts is the unauthorized removal of funds from an existing, legitimate customer's account. The perpetrator may be an outsider who gains control of the account (account takeover) or an insider (an employee) who abuses access to the institution's systems and records. Unlike new account schemes, the account belongs to a real customer who will eventually, but perhaps not quickly, notice missing funds.

Insider (Employee) Schemes

Employees have system access, knowledge of controls, and the ability to alter records, which makes them uniquely dangerous. Common methods include:

- Dormant account theft. Dormant or inactive accounts (no customer-initiated activity for an extended period, often a year or more) are the classic target. The customer is not watching, statements may be returned as undeliverable, and nobody complains. The employee makes unauthorized withdrawals or transfers, forges a signature on a withdrawal slip, or changes the address so statements no longer reach the owner. Employees sometimes move money among several dormant accounts to cover earlier thefts in a lapping-style pattern.
- Forged withdrawal slips and checks. Tellers or platform employees prepare withdrawal tickets with forged customer signatures and pocket the cash or route it to accounts they control.
- Unauthorized electronic transfers. Using system access to transfer funds via ACH, wire, or internal book transfers to accounts controlled by the employee or an accomplice.
- Exploiting vulnerable customers. Elderly customers, customers with disabilities, or those who rarely visit the branch are targeted because they are less likely to detect or report losses.
- Altering account records. Changing addresses, adding joint owners or signers, resetting online banking credentials, or suppressing statements.

Outsider Account Takeover

External fraudsters gain control of a legitimate account through:

- Identity theft and pretexting. Obtaining personal data through phishing, data breaches, dumpster diving, or social engineering of bank staff, then impersonating the customer.
- Address change schemes. Submitting a fraudulent change of address, then requesting new checks, debit cards, PINs, or online credentials sent to the new address. The real customer stops receiving statements, delaying discovery.
- Counterfeit or stolen checks and cards. Forging the customer's signature on stolen checks or using skimmed card data.
- Online and mobile banking compromise. Credential stuffing, malware, SIM-swap attacks to intercept one-time passcodes, and fraudulent enrollment of the customer's account in digital banking.
- Wire and ACH fraud. Instructing the institution to wire funds out, often with urgency and resistance to call-back procedures.

Red Flags of Theft from Customer Accounts

- Customer complaints of unauthorized transactions or missing statements.
- Activity in accounts that were previously dormant, especially withdrawals or transfers rather than deposits.
- Address changes followed shortly by requests for new checks, cards, PINs, or large withdrawals.
- Statements returned as undeliverable with no follow-up.
- An employee who accesses accounts with no business reason, who handles an unusual number of dormant accounts, or who processes transactions on accounts of customers he or she personally knows.
- Employees who refuse to take vacation, resist job rotation, or insist on handling particular customers exclusively.
- Employees living beyond their means or under evident financial pressure.
- Forged or irregular signatures on withdrawal slips; withdrawal tickets completed in handwriting that matches an employee's.
- Wire requests with urgency, unusual destinations, or refusal to accept call-back verification.
- Spikes in failed login attempts or password resets on a customer's digital banking profile.

Prevention and Detection Controls

- Dual control over dormant accounts. Flag accounts as dormant after a defined period, segregate them in the system, and require two authorized employees to approve any transaction or address change on a dormant account.
- Segregation of duties. The person who can post transactions should not also be able to change customer master data (addresses, signers) without independent review.
- Mandatory vacations and job rotation. Many insider schemes require constant attention; a forced two-week absence frequently exposes them.
- Address change verification. Send confirmation of any address change to both the old and new addresses, and delay issuance of new checks or cards following an address change.
- Positive customer identification for withdrawals, signature comparison, and transaction limits for over-the-counter withdrawals by non-account holders.
- Call-back procedures for wire transfers and other high-value instructions, using contact information already on file rather than information provided with the request.
- Multifactor authentication and anomaly monitoring for online and mobile banking; alerts to customers on new device enrollment, password changes, and large transfers.
- Employee access logs and surveillance. Review who looked at which accounts and when; investigate access without a transaction or business reason.
- Customer statement review and education. Encourage customers to review statements promptly and report discrepancies; respond quickly to returned mail.
- Background checks on employees in sensitive positions and an anonymous reporting hotline.

Part 3: Comparing the Two Schemes

Keep the distinction sharp, because exam questions often hinge on it:

- New account schemes: the account is newly opened by the fraudster, often with false identity; the primary control weakness is inadequate identification and premature funds availability; key controls are CIP, identity verification, holds, and new-account monitoring.
- Theft from customer accounts: the account is legitimate and belongs to a real customer; the perpetrator is an insider or an outsider who takes over the account; the primary control weaknesses are weak access controls, lack of dual control over dormant accounts, and unverified address or instruction changes; key controls are segregation of duties, dual control, mandatory vacation, address-change confirmation, and call-back verification.

Exam Tips: Answering Questions on New Account Schemes and Theft from Customer Accounts

1. Identify who owns the account. If the question describes someone opening an account with questionable identification and then depositing bad checks, you are dealing with a new account scheme. If a real customer's funds disappear, you are dealing with theft from a customer account or account takeover. Classifying the scenario correctly eliminates half the wrong answers.

2. Memorize the CIP minimums. Name, date of birth, address, and identification number are the four pieces of information an institution must collect under Section 326 of the USA PATRIOT Act. Distractors will add items like occupation, employer, or income; those may be good practice but are not the regulatory minimum.

3. Know the red flag lists cold. Questions frequently ask which item is or is NOT a red flag of new account fraud. Out-of-area residence, no prior banking relationship, refusal to provide references, disconnected phone, and immediate cash withdrawal requests are red flags. A customer who provides multiple forms of valid identification and local references is not.

4. Dormant accounts are the signature insider target. When a question involves an employee stealing from customers, the expected answer usually involves dormant or inactive accounts, and the expected control is dual control or management approval of transactions on those accounts.

5. Address change plus new instrument equals account takeover. A change of address followed by a request for new checks, cards, or PINs is a textbook red flag. The matching control is sending confirmation to the old address and delaying issuance.

6. Match the control to the scheme. The exam often asks for the best or most effective control. Choose the control that attacks the specific weakness: holds and identity verification for new accounts; dual control, segregation of duties, and mandatory vacations for insider theft; call-back and multifactor authentication for outsider takeover. A generically good control (such as an ethics policy) is rarely the best answer when a targeted control is offered.

7. Watch for absolute language. Statements such as 'new account fraud can always be prevented by requiring a driver's license' are false. Identification can be forged; the correct approach is layered verification.

8. Do not confuse related schemes. Check kiting involves floating funds between accounts at different institutions; it is related to but distinct from a simple worthless-deposit new account scheme. Loan fraud, embezzlement by tellers from the cash drawer, and account takeover are separate categories in the ACFE outline even though they share red flags.

9. Behavioral red flags of employees carry over. Refusing vacation, living beyond means, and possessiveness over certain accounts appear throughout the CFE body of knowledge. If an answer choice describes one of these in a bank setting, it is likely a correct red flag.

10. Read the question stem for the perspective. Is the question asking what a fraudster would do, what an employee should notice, or what management should implement? Answer from that perspective. A red flag is an indicator, a control is a preventive or detective measure, and a scheme is the method; do not select a control when the question asks for a red flag.

Quick Review Summary

- New account schemes exploit weak identification at account opening and premature access to deposited funds; think false ID, stolen business checks, worthless personal deposits.
- Theft from customer accounts exploits weak access controls over existing balances; think dormant accounts, forged withdrawals, address changes, and account takeover.
- CIP requires name, date of birth, address, and identification number.
- Dormant accounts demand dual control; address changes demand confirmation to the old address; wires demand call-back; insiders demand mandatory vacations and segregation of duties.
- On the exam, classify the scheme, recall the red flags, and pick the control that directly addresses the described weakness.