Payment Card, Mobile and Prepaid Card Fraud

Why This Topic Matters

Payment card, mobile payment and prepaid card fraud sit at the intersection of consumer fraud, identity theft, cybercrime and money laundering. On the CFE Exam, this material falls under the Fraud Schemes section (within the broader Payment Fraud area, alongside check and electronic payment fraud). Examiners expect you to recognize how cards and mobile platforms are attacked, who ultimately bears the loss, what red flags signal a scheme in progress, and which controls prevent or detect each type of abuse. Because these schemes are high volume, cross-border and increasingly technical, a Certified Fraud Examiner must understand them to advise merchants, issuers, financial institutions and victims. Expect scenario-based questions that test your ability to name a scheme, distinguish it from a similar one, and select the most effective control.

Part 1: Payment Card Fraud

What a payment card is
A payment card is any card (physical or virtual) used to access funds or credit. The main categories are:
• Credit cards: a revolving line of credit extended by an issuer.
• Charge cards: balance must be paid in full each cycle.
• Debit cards: draw directly on the cardholder's deposit account; may be PIN-based (online debit) or signature-based (offline debit, processed over the credit networks).
• Prepaid cards: funds are loaded in advance (covered in Part 3).

Security features you should know
• Magnetic stripe: stores account data (including CVV1/CVC1) and is easily copied.
• EMV chip: generates a unique cryptogram for each transaction, making counterfeiting far harder. Chip-and-PIN is stronger than chip-and-signature.
• CVV2/CVC2: the three- or four-digit code printed on the card, intended to prove the buyer physically has the card in card-not-present sales.
• PIN: a knowledge factor for ATM and PIN-debit transactions.
• Contactless/NFC: tap-to-pay, usually tokenized and transaction-limited.
• Holograms, embossing, signature panels, BIN/IIN (the first six to eight digits identify the issuer).

Card-present vs. card-not-present (CNP)
This distinction is heavily tested. Card-present fraud involves a physical card (genuine, stolen or counterfeit) used at a terminal. Card-not-present fraud involves use of account data without the physical card: online, by phone or by mail order. As EMV adoption reduced counterfeit card-present fraud, criminals shifted to CNP fraud, which is now the dominant form of payment card loss in most markets. Merchants, not issuers, usually bear the loss on CNP transactions.

How criminals obtain card data
• Physical theft of cards, wallets or mail (including never-received-issue (NRI) fraud, where new or replacement cards are intercepted before reaching the cardholder).
• Skimming: a hidden device captures magnetic stripe data at ATMs, fuel pumps, or point-of-sale (POS) terminals, often paired with a pinhole camera or fake keypad overlay to capture PINs. Dishonest employees may also skim with handheld devices.
• Shimming: a thin device inserted in a chip reader to intercept chip data (used mainly to create magnetic-stripe clones for non-EMV terminals).
• Data breaches of merchants, processors or issuers, with stolen data sold on dark web carding forums.
• Phishing, vishing, smishing and social engineering.
• Malware on POS systems (RAM scraping) or e-commerce sites (digital skimming/formjacking, such as Magecart attacks).
• Shoulder surfing and dumpster diving.

Common payment card schemes
• Unauthorized use of lost or stolen cards: the simplest form; speed matters because the window closes when the card is reported.
• Counterfeit cards: skimmed data encoded onto blank or re-embossed cards (white plastic). EMV largely defeats this at chip-enabled terminals.
• Account takeover (ATO): the fraudster obtains personal information, contacts the issuer, changes the address or contact details, and requests a replacement card or adds an authorized user.
• Application fraud / identity theft: opening new accounts using a stolen identity, or a synthetic identity built from a real identifier (such as a Social Security number) combined with fabricated details. Synthetic identities are often nurtured for months before a bust-out, where the fraudster maxes out credit and disappears.
• Card testing / BIN attacks: running small transactions or generating card numbers from a known BIN to see which are valid before larger purchases.
• Friendly fraud / first-party fraud (chargeback fraud): a genuine cardholder makes a purchase and then falsely disputes it as unauthorized or not received.
• Merchant fraud: a merchant processes fictitious sales, a bust-out merchant runs charges and vanishes before chargebacks arrive, or a legitimate merchant launders transactions (factoring) by processing sales for a business that cannot get its own merchant account.
• Collusive employee schemes: cashiers process refunds to their own cards, skim customer data, or run fraudulent transactions at the register.
• Advance-fee and telemarketing schemes that solicit card numbers.

Who bears the loss?
• In the United States, the Truth in Lending Act (Regulation Z) caps a consumer's liability for unauthorized credit card use at $50. The Electronic Fund Transfer Act (Regulation E) governs debit cards: liability is $50 if reported within two business days, up to $500 if reported within 60 days of the statement, and potentially unlimited after that. Network zero-liability policies often go further. Exam questions may test that consumer protections differ between credit and debit cards.
• The EMV liability shift moved counterfeit card-present losses to whichever party (merchant or issuer) has not adopted chip technology.
• Chargebacks are the mechanism by which issuers reverse disputed transactions; merchants with excessive chargeback ratios face fines and loss of processing privileges.

Red flags of payment card fraud at the point of sale
• Customer buys large quantities or many high-value items with little regard to size, color or price.
• Rushes the cashier, shops right at opening or closing, or returns repeatedly in a short time.
• Multiple cards declined, or the customer pulls cards from a pocket rather than a wallet.
• Signature panel altered, card damaged near the hologram, embossing uneven, or name does not match presented ID.
• Attempts to split a sale across several cards to stay below authorization limits.
• For online sales: billing and shipping addresses differ, orders placed from anonymizing IPs or high-risk countries, expedited shipping on expensive goods, multiple orders to one address using different cards, disposable email addresses, unusual hour of purchase.

Prevention and detection controls
• EMV chip terminals and PIN use.
• Address Verification Service (AVS), CVV2 checks, and 3-D Secure protocols for CNP sales.
• Tokenization (replacing the card number with a surrogate value) and end-to-end encryption.
• PCI DSS compliance for any entity storing, processing or transmitting cardholder data.
• Velocity checks, geolocation, device fingerprinting, behavioral analytics and machine-learning fraud scores at the issuer and merchant level.
• Real-time transaction alerts to cardholders; card controls that let customers lock cards or block categories.
• Employee screening, segregation of refund duties, inspection of terminals and ATMs for skimmers, and tamper-evident seals.
• Consumer education: shredding, monitoring statements, avoiding public Wi-Fi for payments.

Part 2: Mobile Payment Fraud

What mobile payments are
Mobile payments use a phone or wearable device to initiate a transaction. Key models include:
• Mobile wallets (Apple Pay, Google Pay, Samsung Pay) that tokenize a card and transmit via NFC.
• Mobile banking apps for transfers and bill payment.
• Peer-to-peer (P2P) apps such as Zelle, Venmo, Cash App and PayPal.
• Mobile money services in developing markets (for example M-Pesa), where the phone account itself holds value.
• Carrier billing, where charges appear on the phone bill.
• Mobile POS (mPOS) devices that turn a phone or tablet into a card terminal.
• QR-code payments, where either the merchant or customer presents a code.

How mobile payment fraud works
• Provisioning (enrollment) fraud: a fraudster loads a stolen card into a mobile wallet. If the issuer's identity verification at enrollment is weak, the wallet becomes a convenient way to use stolen data in card-present settings. The tokenization itself is secure; the weakness is the onboarding step.
• Account takeover via phishing, credential stuffing or malware, followed by draining of linked accounts.
• SIM swapping / port-out fraud: the criminal convinces the carrier to transfer the victim's number to a new SIM, then intercepts one-time passcodes to reset passwords and approve transfers.
• Smishing and fake apps: malicious apps or text links harvest credentials or install banking trojans that overlay fake login screens.
• Authorized push payment (APP) fraud: the victim is manipulated into sending money themselves via P2P transfer (romance, impersonation, fake invoice, or purchase scams). Because the payment is authorized and typically instant and irrevocable, recovery is difficult and consumer protection is more limited than for unauthorized transactions.
• Lost or stolen devices without strong screen locks.
• Man-in-the-middle attacks on unsecured Wi-Fi, and QR-code substitution where a criminal pastes a fraudulent code over a merchant's code to divert payments.
• Mobile merchant fraud: fraudsters use mPOS readers to run stolen cards, or buyers pay via P2P for goods that never arrive.
• Mobile money agent fraud: agents skim deposits, create fake transactions or pressure customers for PINs.

Controls for mobile payments
• Tokenization and device-specific credentials; biometrics (fingerprint, face) and strong device passcodes.
• Multi-factor authentication that does not rely solely on SMS; carrier port-out PINs to defeat SIM swaps.
• Robust identity verification at wallet enrollment, with issuer step-up authentication for high-risk provisioning.
• Transaction limits, cooling-off periods for new payees, confirmation-of-payee name matching, and behavioral analytics.
• Remote lock and wipe capability; downloading apps only from official stores; keeping operating systems patched.
• Consumer awareness of scams that pressure them to pay through P2P apps or share verification codes.

Part 3: Prepaid Card Fraud

What prepaid cards are
Prepaid cards carry value loaded in advance rather than drawing on a credit line or bank account. Important distinctions:
• Open-loop cards carry a network brand (Visa, Mastercard, American Express, Discover) and can be used anywhere the brand is accepted. General purpose reloadable (GPR) cards are the main open-loop type and may function much like a bank account.
• Closed-loop cards (store gift cards) can be used only with a specific merchant or merchant group.
• Other forms include payroll cards, government benefit cards (EBT), travel cards, incentive and rebate cards, and virtual prepaid cards.

Why prepaid cards attract fraudsters
They can be bought with cash, often with minimal identification, are portable, can be reloaded, can be used at ATMs (open-loop), and their value can be transferred or spent quickly across borders. This makes them ideal for cashing out fraud proceeds, laundering money, and collecting payments from scam victims.

Common prepaid card schemes
• Rack tampering / card draining: a fraudster records card numbers and scratches off and replaces the PIN covering on cards hanging in a store, reseals the packaging, and then monitors the account; the moment a legitimate buyer activates and loads the card, the fraudster spends the balance online.
• Activation fraud by employees: a cashier activates cards without collecting payment, or swaps a customer's activated card for an inactive one.
• Loading with stolen payment cards: criminals convert stolen credit card data to prepaid value, effectively laundering it.
• Gift-card payment scams: victims of IRS impersonation, tech support, grandparent, romance or utility-shutoff scams are told to buy gift cards and read the numbers over the phone. Any demand for payment by gift card is a hallmark of a scam.
• Return and refund fraud: stolen merchandise returned for store credit on gift cards, which are then resold.
• Balance-check brute forcing: bots query a retailer's balance-inquiry page to find active card numbers.
• Cloning and counterfeiting of magnetic-stripe gift cards.
• Reselling stolen or fraudulently obtained cards on secondary gift-card exchanges.
• Money laundering and structuring: loading many cards below reporting thresholds, moving cards across borders (prepaid cards are not always treated as monetary instruments at customs), or using cards to layer proceeds.
• Benefit card trafficking: selling government benefit card value for cash at a discount.

Regulatory and control environment
• In the United States, FinCEN's Prepaid Access Rule (2011) brought providers and sellers of prepaid access under the Bank Secrecy Act: providers must register as money services businesses, implement AML programs, collect customer identification for certain products, keep records, and file suspicious activity reports. Sellers face thresholds (for example, selling more than $10,000 in prepaid access to one person in a day triggers obligations). Low-value, non-reloadable closed-loop cards are largely exempt.
• Regulation E protections were extended to many GPR accounts in 2019.
• Merchant controls: tamper-evident packaging, keeping high-value cards behind the counter, activation only at the register with receipt, load limits, employee training, surveillance of gift-card racks, monitoring of activation patterns, and rate-limiting balance inquiries.
• Issuer controls: velocity and load limits, KYC at activation for reloadable products, geographic and merchant category monitoring.

Part 4: Investigating Card, Mobile and Prepaid Fraud

A CFE investigating these schemes should:
• Obtain authorization logs, transaction histories, IP addresses, device IDs, geolocation data and merchant descriptors from issuers, processors or wallet providers (usually via subpoena or with victim consent).
• Trace the point of compromise by identifying the common merchant or ATM used by multiple compromised cards before fraud appeared.
• Review surveillance footage tied to timestamps of fraudulent transactions, shipping records for CNP goods, and drop addresses.
• For prepaid cards, request activation and load records, including the store, register, cashier and time of activation, and redemption details.
• Coordinate with the card networks, merchant acquirers, law enforcement and, where relevant, telecom carriers (SIM swap records).
• Preserve chargeback documentation and understand dispute time limits.

Exam Tips: Answering Questions on Payment Card, Mobile and Prepaid Card Fraud

1. Master the vocabulary and the pairs that get confused. Card-present vs. card-not-present; skimming (magnetic stripe) vs. shimming (chip); open-loop vs. closed-loop; credit card protections (Reg Z, $50 cap) vs. debit card protections (Reg E, tiered by reporting speed); friendly fraud (genuine cardholder disputes a real purchase) vs. unauthorized use; account takeover (existing account) vs. application fraud (new account); authorized push payment (victim sends the money) vs. unauthorized transaction (fraudster takes it).

2. Identify the scheme from the mechanics, not the label. If a question describes recording numbers from cards on a store rack and spending the value once activated, the answer is prepaid card tampering/draining. If a fraudster changes the address on file and requests a replacement card, it is account takeover. If a card issued to a new customer never arrives, it is never-received-issue fraud. If a business processes sales for another business through its merchant account, it is factoring or transaction laundering.

3. Know what each control actually defends against. EMV chips defeat counterfeit card-present fraud but do nothing for CNP fraud. AVS, CVV2 and 3-D Secure address CNP fraud. Tokenization protects stored data and mobile wallets. Port-out PINs and non-SMS MFA address SIM swapping. Strong enrollment verification addresses wallet provisioning fraud. Tamper-evident packaging and register activation address gift card draining. When the exam asks for the best or most effective control, match the control to the specific weakness described.

4. Remember the shift in fraud patterns. Questions often test that EMV adoption pushed criminals toward CNP fraud and that the liability shift penalizes the non-EMV party. Similarly, recognize that mobile wallets are generally more secure than plastic cards at the transaction level, so weaknesses lie in enrollment, device security and social engineering.

5. Watch for red-flag lists. The exam may ask which behavior is NOT a red flag or which is the strongest indicator. Think about what a thief with limited time and someone else's money would do: buy quickly, buy expensive items, ignore price and fit, want fast shipping, use mismatched addresses.

6. Link prepaid cards to money laundering and scams. If a question involves anonymity, cash loading, cross-border movement, structuring below thresholds, or victims being told to pay with gift cards, think prepaid access and AML obligations (registration as an MSB, SARs, recordkeeping).

7. Read True/False items for absolutes. Statements such as mobile payments are immune to fraud, closed-loop cards can be used anywhere, or debit cardholders enjoy the same liability cap as credit cardholders regardless of reporting time are false. Statements that correctly describe tiered Reg E liability, the liability shift, or the dominance of CNP fraud are true.

8. Think like the CFE adviser. When a question asks what a merchant, issuer or consumer should do, choose the answer that is preventive, proportionate and specific to the scheme described, rather than a generic response such as call the police. The exam rewards the option that directly addresses the described vulnerability.

9. Manage your time. These questions are usually straightforward once the scheme is identified. Read the scenario once, underline the mechanism (how the data was obtained, how value was moved, who was deceived), eliminate answers that describe a different mechanism, and move on.

Summary
Payment card fraud exploits stolen card data through card-present and card-not-present channels, with EMV, AVS, CVV2, tokenization and analytics as key defenses. Mobile payment fraud targets enrollment, device access and the user through SIM swaps, malware and authorized push payment scams. Prepaid card fraud exploits anonymity and weak retail controls through rack tampering, activation fraud, scam payments and laundering, which is why regulators treat prepaid access providers as money services businesses. For the CFE Exam, focus on precise terminology, matching schemes to controls, understanding who bears the loss, and recognizing red flags in scenario questions.