Most reported cybercrime losses now come from fraud rather than intrusion, and nearly every attack on this list starts by abusing an identity: a stolen login, a fabricated customer, a hijacked phone number or a convincing fake executive. The FBI's IC3 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses for 2025, and the UK Finance Annual Fraud Report 2026 put UK payment fraud losses for 2025 at £1.28 billion. This list ranks ten online fraud attacks by our judgement of frequency and impact for digital businesses and their customers. For each: what it is, how to spot it and the control that matters most, then a mapping to OWASP. It is for fraud, security, identity and product teams.
The Top 10 at a glance
- Account takeover and credential stuffing
- Authorised push payment scams
- Business email compromise and invoice fraud
- Card-not-present fraud and card testing
- Synthetic identity fraud
- New account fraud and mule accounts
- Deepfake and AI impersonation
- SIM swap and phone number takeover
- Promotion, coupon and loyalty abuse
- Refund and chargeback abuse
| # | Attack | What the attacker gains | First control |
|---|---|---|---|
| 1 | Account takeover | Stored value, cards, personal data, a trusted account to defraud others | Phishing-resistant or risk-based MFA; bot defence on login |
| 2 | APP scams | Victim sends the money themselves | Payee checks, scam warnings and holds on risky first payments |
| 3 | BEC and invoice fraud | Supplier or executive payments redirected | Out-of-band verification of bank detail changes |
| 4 | Card-not-present and card testing | Goods bought with stolen card data; validated cards to sell | Velocity limits on authorisations; 3-D Secure on risky orders |
| 5 | Synthetic identity | Credit lines built up and then maxed out | Identity proofing that checks data consistency, not just existence |
| 6 | New account fraud | Accounts to launder money or exploit offers | Onboarding risk scoring and device intelligence |
| 7 | Deepfake impersonation | Payments approved or identity checks passed | Call-back procedures; injection-resistant liveness |
| 8 | SIM swap | SMS codes and account recovery | Remove SMS from high-value recovery; detect recent SIM changes |
| 9 | Promotion and loyalty abuse | Free credit, points and discounts at scale | Per-person limits; bot and multi-account detection |
| 10 | Refund and chargeback abuse | Goods kept and money returned | Refund risk rules; delivery evidence; chargeback dispute data |
1. Account takeover and credential stuffing
What it is: criminals log in to real customer accounts using passwords from earlier breaches (OWASP OAT-008 Credential Stuffing), guessed passwords, infostealer logs or phished one-time codes, then spend stored balances, change payout details or harvest personal data. UK Finance reported £37.8 million lost to account takeover of card accounts in 2025 across 82,030 cases. In the 23andMe breach, reused passwords on a small share of accounts exposed data on millions of people.
How to spot it: spikes in failed logins across many accounts from rotating IPs, a correct password followed by a failed MFA step, new devices changing email, phone or payout details shortly after login, and abnormal login success rates.
The control: OWASP calls MFA "by far the best defense" against password attacks; offer passkeys and apply step-up MFA on new devices and sensitive changes. Add connection fingerprinting (JA3, HTTP/2) and breached-password checks, and notify users when a correct password fails MFA. See the Account Takeover Prevention Guide and the Passwordless and Passkeys Guide.
2. Authorised push payment scams
What it is: the victim is manipulated into sending a payment to an account the criminal controls, through purchase, investment, romance or impersonation scams. UK Finance reported APP losses of £576.4 million across 248,070 cases in 2025, up 19%, with investment scams (£221.5 million) the costliest type, and stated that "66 per cent of APP fraud begins online and a further 17 per cent via telecoms." In the UK, the Payment Systems Regulator's reimbursement rules have applied since 7 October 2024, with a maximum of £85,000 per claim and costs split 50:50 between sending and receiving firms.
How to spot it: first payments to new payees that are large for the customer, a Confirmation of Payee mismatch overridden, payments to newly opened receiving accounts, and signs of coaching such as an active call or remote access tool during the session.
The control: dynamic scam warnings written for the specific scam type, holds and human intervention for high-risk first payments, and inbound mule detection on receiving accounts. See the Authorised Push Payment (APP) Fraud Guide.
3. Business email compromise and invoice fraud
What it is: a compromised or spoofed mailbox of a supplier, executive or solicitor asks for a payment to new bank details. IC3 recorded 24,768 BEC complaints with more than $3.04 billion in losses in 2025, and UK Finance reported £41.3 million of invoice and mandate fraud and £5.6 million of CEO fraud.
How to spot it: bank detail changes requested by email, look-alike domains, mailbox rules that forward or hide replies, urgency and secrecy, and sign-ins to finance mailboxes from new locations.
The control: verify every bank detail change by calling a number already on file, require dual approval for new payees, enforce DMARC and phishing-resistant MFA on finance and executive accounts. Report fast: the IC3 Recovery Asset Team froze $679 million through its Financial Fraud Kill Chain in 2025. See the Email Identity and BEC Guide.
4. Card-not-present fraud and card testing
What it is: stolen card data is used for online purchases, after bots first validate it with small authorisations (OAT-001 Carding) or guess missing expiry dates and security codes (OAT-010 Card Cracking). Remote purchase fraud was the largest UK unauthorised category in 2025: £423.5 million across 3,196,962 cases, according to UK Finance. Card data itself is often stolen from merchant systems, as in the AI agent retail card theft campaign.
How to spot it: bursts of low-value authorisations, many cards from one device or session, high decline rates by BIN, and mismatches between billing country, IP location and shipping address.
The control: velocity limits per device, account and card; bot defence on checkout and card-add endpoints; 3-D Secure or strong customer authentication for risky orders; and integrity monitoring of payment page scripts. See the Payment Fraud Guide and the PCI DSS 4.0 Guide.
5. Synthetic identity fraud
What it is: the Federal Reserve defines it as "the use of a combination of personally identifiable information (PII) to fabricate a person or entity" for gain. Criminals combine real and invented details, build a credit history over months, then max out the credit and disappear.
How to spot it: identifiers that are each valid but have no shared history, thin credit files with rapid limit increases, many applications sharing a phone, address or device, and authorised-user piggybacking on established accounts.
The control: identity proofing that tests consistency across sources, consortium and device data, and monitoring for linked identities after onboarding. See the Identity Proofing and KYC Guide.
6. New account fraud and mule accounts
What it is: accounts opened with stolen or synthetic identities, often at scale by bots (OAT-019 Account Creation), to receive scam proceeds, claim sign-up offers or run marketplace fraud.
How to spot it: many sign-ups from one device, emulator or hosting IP range; disposable email domains; accounts that receive funds and move them on within hours; and onboarding sessions with pasted or scripted input.
The control: risk scoring at onboarding with device intelligence, bot management on registration, graduated limits for new accounts, and payment pattern monitoring for mule behaviour. See the Identity Fraud Prevention Guide and the Bot Management Guide.
7. Deepfake and AI impersonation
What it is: synthetic video, voice or documents used to impersonate executives or to pass remote identity checks. In the Arup deepfake fraud, a video call with a fake CFO led to HK$200 million in transfers. IC3 received 22,364 complaints reporting AI-related information in 2025, with $893 million in losses.
How to spot it: FinCEN alert FIN-2024-Alert004 (13 November 2024) lists red flags including inconsistent identity documents, a photo that does not match the stated age, a customer who "uses a third-party webcam plugin during a live verification check", refusal of MFA, and device or location data inconsistent with the documents.
The control: call-back verification through known numbers for payment instructions, liveness detection that resists camera injection, and phishing-resistant MFA, as FinCEN recommends. See the Deepfake and AI Impersonation Guide.
8. SIM swap and phone number takeover
What it is: criminals persuade or bribe mobile operator staff to move a victim's number to a SIM they control. The FBI warns that "Once the SIM is swapped, the victim's calls, texts, and other data are diverted to the criminal's device", including SMS codes and recovery messages. IC3 recorded 971 SIM swap complaints and $17.4 million in losses in 2025.
How to spot it: a customer's phone suddenly unreachable, logins and password resets shortly after a number change, and SIM change or porting signals from mobile network data services where available.
The control: do not rely on SMS alone for account recovery or high-value approvals; check SIM change recency before sending codes; prefer authenticator apps, passkeys or security keys. See the Vishing and Smishing Guide and the Authenticator Apps and OTP Guide.
9. Promotion, coupon and loyalty abuse
What it is: abuse of sign-up bonuses, referral credit and discounts through multiple accounts, enumeration of voucher codes (OAT-002 Token Cracking) and theft of loyalty points through account takeover, which are then cashed out (OAT-012 Cashing Out).
How to spot it: one device or payment card linked to many accounts, referral chains that loop back to the same people, high rates of invalid code attempts and points redeemed soon after a password or email change.
The control: per-person rather than per-account limits, non-guessable codes with rate limiting, step-up authentication before points redemption, and linking analysis across accounts. See the Fraud Prevention Guide for Digital Businesses.
10. Refund and chargeback abuse
What it is: customers, or criminals posing as them, claim items never arrived, return empty boxes or charge back purchases they received.
How to spot it: refund rates far above peers for an account, device or address, claims of non-delivery against confirmed deliveries, and repeat chargebacks across linked accounts.
The control: refund risk rules that consider history and linked accounts, delivery evidence such as signatures for high-value items, and feeding chargeback outcomes back into fraud models. See the Payment Fraud Guide.
Mapping to OWASP
The OWASP Automated Threats to Web Applications project (handbook v1.3, March 2026) names 21 automated threats, OAT-001 to OAT-021; it fits the attacks that rely on bots and fits social engineering not at all. The OWASP Top 10:2025 covers application weaknesses, so it maps only where a design gap enables the fraud.
| Attack | OWASP Automated Threats | OWASP Top 10:2025 |
|---|---|---|
| 1. Account takeover | OAT-008 Credential Stuffing, OAT-007 Credential Cracking | A07 Authentication Failures |
| 2. APP scams | Not mapped (social engineering) | Not mapped |
| 3. BEC and invoice fraud | Not mapped (social engineering) | Not mapped |
| 4. Card-not-present and card testing | OAT-001 Carding, OAT-010 Card Cracking, OAT-012 Cashing Out | A06 Insecure Design (weak fit: no limits on authorisations); A08 Software or Data Integrity Failures (payment page scripts) |
| 5. Synthetic identity | OAT-019 Account Creation (weak fit) | Not mapped |
| 6. New account fraud | OAT-019 Account Creation, OAT-009 CAPTCHA Defeat | A06 Insecure Design (weak fit) |
| 7. Deepfake impersonation | Not mapped | Not mapped |
| 8. SIM swap | Not mapped | A07 Authentication Failures (SMS-only recovery) |
| 9. Promotion and loyalty abuse | OAT-002 Token Cracking, OAT-019 Account Creation, OAT-012 Cashing Out | A06 Insecure Design |
| 10. Refund and chargeback abuse | Not mapped | A06 Insecure Design (business logic) |
Where to start
If you can do only three things this quarter: put bot defence and step-up MFA on login, registration and checkout (attacks 1, 4, 6 and 9), verify every payee or bank detail change out of band and hold risky first payments (attacks 2, 3 and 7), and take SMS out of high-value account recovery (attack 8). Track five numbers monthly: fraud losses in basis points of transaction value, account takeover rate per 10,000 active accounts, card authorisation decline rate on checkout, share of new accounts later closed for fraud, and time from a fraud report to funds frozen. See the Fraud Prevention Guide for Digital Businesses.
Primary sources: FBI IC3 2025 Internet Crime Report, UK Finance Annual Fraud Report 2026, PSR PS24/7 on the APP reimbursement limit, FinCEN Alert FIN-2024-Alert004 on deepfake media, Federal Reserve on synthetic identity fraud, FBI PSA I-020822-PSA on SIM swapping, the OWASP Automated Threats to Web Applications, the OWASP Credential Stuffing Prevention Cheat Sheet and the OWASP Top 10:2025.
Related NHI Mgmt Group resources: Account Takeover Prevention Guide · Authorised Push Payment (APP) Fraud Guide · Bot Management Guide · Customer IAM (CIAM) Guide