Check and Electronic Funds Transfer (EFT) fraud are core topics in the CFE Financial Transactions and Fraud Schemes section, falling under payment fraud. Check fraud involves the unauthorized use, alteration, or creation of paper checks to obtain funds. Common schemes include forged maker signatures (signing another person's name on the drawer line), forged endorsements (signing the payee's name to negotiate a check), altered checks (changing the payee or amount through chemical washing or erasure), counterfeit checks (printing fake checks using stolen account and routing numbers), check kiting (exploiting float time by writing checks between accounts at different banks with insufficient funds to create artificial balances), paperhanging (deliberately writing checks on closed accounts), and demand draft fraud (creating remotely created checks without signatures using stolen account data). Internal variants include employees stealing blank company checks or issuing checks to fictitious vendors.

EFT fraud targets electronic payment systems such as ACH (Automated Clearing House), wire transfers, debit card transactions, and online banking. Typical schemes include account takeover (gaining login credentials via phishing, malware, or social engineering to initiate transfers), business email compromise (impersonating executives or vendors to request urgent wire transfers), unauthorized ACH debits using harvested account numbers, payroll diversion (changing direct deposit details), and money mule networks used to launder transferred funds. Because wires settle quickly and are often irrevocable, recovery is difficult.

For CFEs, key legal frameworks include the Uniform Commercial Code Articles 3 and 4 (allocating liability between banks and customers for checks), Regulation E (consumer EFT protections), and NACHA rules for ACH. Red flags include missing or out-of-sequence checks, frequent deposits just before withdrawals, altered payee names, unexplained changes to vendor banking details, and transfers to new beneficiaries. Prevention controls include positive pay, ACH debit blocks and filters, dual authorization for wires, segregation of duties, callback verification of payment changes, timely bank reconciliations, and employee awareness training.

In the Certified Fraud Examiner (CFE) body of knowledge, payment fraud covering payment cards, mobile payments, and prepaid cards is a major component of the Financial Transactions and Fraud Schemes section. Payment card fraud involves the unauthorized use of credit, debit, or charge cards. Common schemes include lost or stolen cards, account takeover (where a fraudster assumes control of a legitimate cardholder's account by changing contact details or requesting replacement cards), application fraud using stolen or synthetic identities, counterfeit cards created through skimming magnetic stripe data, and card-not-present fraud in online or telephone transactions where physical verification is impossible. Merchant collusion and 'bust-out' schemes, in which fraudsters build credit then max out accounts with no intention to pay, also fall into this category. Mobile payment fraud exploits digital wallets and mobile banking apps such as Apple Pay, Google Pay, or peer-to-peer services. Techniques include SIM swapping to intercept one-time passcodes, malware or phishing to harvest credentials, loading stolen card data onto mobile wallets, and social engineering victims into authorizing payments. Because transactions are fast and often irreversible, mobile channels appeal to criminals. Prepaid card fraud targets open-loop cards (network-branded, usable anywhere) and closed-loop cards (store-specific gift cards). Schemes include tampering with cards on retail racks to record numbers before activation, using stolen credit cards to buy prepaid cards for laundering, and scams in which victims are coerced into buying gift cards and reading codes to fraudsters. Prepaid cards are attractive because they offer anonymity and are hard to trace. CFEs detect these frauds by analyzing transaction patterns, velocity, geographic anomalies, chargeback ratios, and device fingerprints. Prevention relies on EMV chip technology, tokenization, multi-factor authentication, address and CVV verification, real-time monitoring, employee training, and consumer education, complemented by regulatory frameworks like PCI DSS and anti-money laundering rules governing prepaid instruments.

Account Takeover (ATO) schemes are a form of payment fraud in which a criminal gains unauthorized control of a legitimate customer's existing financial account—such as a bank account, credit card, brokerage, payroll, or e-commerce account—and uses it to steal funds, make purchases, or redirect payments. Unlike new-account fraud, where a fraudster opens an account under a stolen or synthetic identity, ATO exploits accounts that already have established history, balances, and trust, making the activity harder to detect.

For Certified Fraud Examiners, understanding the lifecycle of an ATO is essential. It typically begins with credential compromise. Fraudsters obtain usernames, passwords, PINs, or security answers through phishing emails, smishing (SMS phishing), vishing (voice calls impersonating the institution), malware and keyloggers, data breaches sold on dark-web markets, social engineering of call-center staff, or SIM-swapping to intercept one-time passcodes. Credential stuffing—using automated bots to test breached username/password pairs across many sites—is especially common because of widespread password reuse.

Once inside, the perpetrator often changes contact details (email, phone, mailing address) to lock out the true owner and suppress alerts, adds new payees or linked devices, requests replacement cards, or initiates wire, ACH, Zelle, or P2P transfers to mule accounts. Business accounts may suffer payroll diversion or fraudulent vendor payments.

Red flags include logins from unfamiliar devices, IP addresses, or geolocations; password resets followed quickly by profile changes; unusual transaction velocity or amounts; and customer complaints of missing funds. Detection relies on behavioral analytics, device fingerprinting, and transaction monitoring.

Prevention and response measures include multi-factor authentication, out-of-band verification for high-risk changes, cooling-off periods for new payees, strong call-center authentication protocols, customer education, and rapid freezing and recovery procedures. Fraud examiners investigating ATO should preserve logs, trace fund flows, coordinate with receiving institutions, and document evidence for law enforcement and regulatory reporting.

Preventing and detecting payment fraud is a core competency for Certified Fraud Examiners, who apply the fraud triangle (pressure, opportunity, rationalization) to reduce opportunity through strong internal controls. Payment fraud schemes include billing schemes (shell companies, pass-through vendors, personal purchases), check tampering (forged maker or endorsement, altered payee), ACH and wire fraud, business email compromise (BEC), expense reimbursement abuse, and card fraud.

Prevention begins with segregation of duties: the people who approve vendors, enter invoices, release payments, and reconcile bank accounts should be different individuals. A robust vendor master file process requires independent verification of new vendors and any changes to bank account details, ideally confirmed by a callback to a known phone number rather than one supplied in an email. Dual authorization for wires and ACH payments above set thresholds, positive pay and payee positive pay services with the bank, ACH debit blocks and filters, and timely bank reconciliations performed by someone outside the payment function all reduce exposure. Purchase orders and three-way matching (PO, receiving report, invoice) confirm that goods were ordered and received before payment. Clear expense policies, original receipts, and supervisory review limit reimbursement fraud. Training employees to recognize BEC and phishing is essential since social engineering drives many losses.

Detection relies on data analytics and vigilance. CFEs look for red flags such as vendors with addresses matching employee addresses, sequential or round-dollar invoices, duplicate payments, invoices just below approval thresholds, payments to vendors with no physical presence, sudden changes in bank details, and unusual payment timing. Benford's Law analysis, duplicate testing, and trend comparisons can surface anomalies. Surprise audits, anonymous hotlines (the most common means of detection per ACFE research), and regular review of access logs strengthen the control environment. When fraud is suspected, examiners preserve evidence, document the scheme, quantify losses, and recommend remedial controls, closing the gap that allowed the fraud to occur.