MITRE ATT&CK T1657 Financial Theft: Detecting and Limiting Damage

For most criminal intrusions money is the end goal, and the final step is often a payment that your own staff or systems approve. MITRE ATT&CK T1657 Financial Theft, in the Impact tactic (TA0040), covers adversaries stealing monetary resources through extortion, social engineering, technical theft or other methods. ATT&CK names ransomware extortion, business email compromise (BEC) and fraud, "pig butchering", bank hacking and cryptocurrency theft as campaign types that end here, on Linux, macOS, Windows, Office Suite and SaaS platforms. This guide is for security, finance, treasury and fraud teams who need to see the last stage of an attack and limit how much money leaves. It takes the ATT&CK technique view (procedures, detection, mitigations); for the payment process controls in depth, see the Invoice Redirection and Supplier Bank Detail Fraud Guide and, for the most prolific state actor in this space, the APT38 Threat Actor Profile Guide.

Key takeaways

• Four routes to the money. ATT&CK v20 procedures fall into extortion (ransomware and data leak threats), payment fraud (BEC and impersonation), direct theft from compromised accounts and cryptocurrency wallets, and theft by malware that harvests wallet and card data.
• The controls are mostly process. ATT&CK maps two mitigations: M1018 User Account Management (limit authority to execute sensitive transactions and approve payments outside email) and M1017 User Training.
• Theft is patient. ATT&CK records FIN13 observing a victim's software and infrastructure for months to learn how legitimate transactions work before attempting fraudulent ones.
• Speed decides recovery. The FBI advises contacting your bank immediately to request a recall of funds and filing at ic3.gov as soon as possible after a fraudulent transfer.
• Machine identities move money too. Payment APIs, ERP integrations, signing keys and wallet keys are non-human identities; the Bybit theft ran through a developer's hijacked AWS session tokens.

What the technique covers

ATT&CK's description makes three points that shape defence. First, adversaries may compromise accounts to make unauthorised transfers, or use impersonation of a trusted party so that victims send money themselves. Second, ransomware extortion follows data encryption (T1486 Data Encrypted for Impact) and exfiltration, with threats to publish data on leak sites unless payment is made. Third, the prospect of financial gain can be used to distract from the real goal, such as data destruction (T1485), as ATT&CK notes for NotPetya. T1657 has no sub-techniques in v20. The AI-system counterpart in MITRE ATLAS is AML.T0048.000 Financial Harm; see the AML.T0048 External Harms page.

Cases: how adversaries reach the money

• FIN13 (G1016): ATT&CK, citing Sygnia's "Elephant Beetle" research, records the group observing the victim's software and infrastructure over several months to understand legitimate financial transactions before attempting fraudulent ones. The lesson is that transaction monitoring must look for small, well-formed anomalies, not only obvious ones.
• ShinyHunters (G1057): ATT&CK records the group calling, texting or emailing employees of victim organisations to demand payment in Bitcoin within 72 hours, citing Google's June 2025 reporting on Salesforce data theft.
• Scattered Spider (G1015): deployed ransomware and threatened to leak stolen data for financial gain, according to ATT&CK and the CISA and FBI advisory AA23-320A, which notes the group has also threatened release without deploying ransomware. See the Scattered Spider Threat Actor Profile.
• Contagious Interview (G1052): stole cryptocurrency wallet credentials and card information with BeaverTail and InvisibleFerret, which search for wallet browser extensions and wallet files. See the Contagious Interview Threat Actor Profile Guide.
• Bybit (February 2025): about USD 1.5 billion was taken from a multisig cold wallet after a third-party wallet developer's laptop was compromised, the developer's AWS session tokens were reused, and malicious JavaScript was placed in the wallet interface's S3 bucket. Signers approved what looked like a routine transfer. The FBI attributed the theft to North Korea, naming the activity TraderTraitor. See the Bybit hack analysis.
• Arup (January 2024): a finance employee made 15 transfers totalling HK$200 million after a video call in which, police said, every other participant was a deepfake. No system was hacked. See the Arup deepfake fraud analysis.

Scale: the FBI's public service announcement of 11 September 2024 reported USD 55.5 billion in exposed BEC losses across 305,033 incidents reported between October 2013 and December 2023. For current annual figures, see the FBI IC3 Internet Crime Report guide.

What to detect: ATT&CK DET0495 in practice

ATT&CK's Detection Strategy for Financial Theft (DET0495) has five analytics. They watch the systems where money is requested, approved and moved:

Tuning elements ATT&CK lists include a list of high-risk finance, treasury and executive accounts, a transaction amount threshold and a fraud keyword list. NHI Mgmt Group recommends adding these sequence detections, which catch the steps before the payment:

1. Mailbox manipulation on finance staff: new inbox rules that forward, move or delete messages containing words such as invoice, payment or bank. See the MITRE ATT&CK T1564.008 Hide Artifacts page and the T1114 Email Collection Defensive Guide.
2. Bank detail change followed by payment: a supplier or payroll bank account change and a payment to the new account within a short window.
3. New payee plus urgency: first payment to a new beneficiary that is also above a threshold, out of hours or marked confidential.
4. Payment system access from a new context: a treasury or ERP sign-in from a new device or location, or a payment API key used from a new source address.
5. Wallet and signing anomalies: changes to wallet interface code, signing policies or approved address lists; signing requests outside change windows.

Mitigations: what ATT&CK maps and what to add

See the M1018 User Account Management and M1017 User Training pages, and the Business Email Compromise Awareness for Finance Teams Guide.

Decision guidance: small and large organisations

• Small organisations: two-person approval for new payees and bank detail changes, call-back to numbers on file, MFA on banking portals and email, and a written number for the bank's fraud line. These cost little and address the most common loss route.
• Large organisations: add transaction monitoring with thresholds per role, segregation of payment release in the ERP, a privileged access model for treasury systems, behavioural baselines for payment APIs and integration accounts, and an extortion decision process agreed with legal and the board in advance.
• Cryptocurrency holders: multisig or policy-based signing with independent verification of what signers see, separation of the right to change signing interfaces from developer sessions, and allowlisted withdrawal addresses. See the Crypto Wallet Security Guide.

Where identity fits

Every T1657 route depends on an identity being trusted: an executive's face or voice, a supplier's email address, a finance user's session, or a key that a system uses to move money. The non-human side is often overlooked. ERP service accounts, payment gateway API keys, bank connectivity certificates and wallet signing keys can each move funds without a human approving each transfer. Inventory them, give each one an owner, restrict them to the payment flows they serve, and alert on any use from a new source. The Bybit case shows the risk of session tokens on a developer workstation that could change a production signing interface. See the MITRE ATT&CK T1078 Valid Accounts Guide.

Response: limiting damage once theft starts

1. Call the bank first: request a recall of the transfer immediately, as the FBI advises, then file at ic3.gov (or your national reporting body) regardless of amount.
2. Freeze the route: suspend the compromised mailbox, session or API key; block the beneficiary account in the payment system; pause pending payments to recently changed bank details.
3. Preserve evidence: email headers, inbox rules, sign-in logs, payment system audit trails, call records and chat messages.
4. Find the other requests: search for the same sender, beneficiary or invoice pattern across finance mailboxes and the ERP.
5. For extortion: follow your ransomware and leak site process; see the Ransomware Data Leak Site Listing Playbook and the Business Email Compromise Response Playbook.

How to test

• Run a tabletop with finance, treasury, legal and security on a bank detail change request backed by a convincing call or video.
• Send an authorised simulated payment redirection email to accounts payable and measure whether the call-back step is followed.
• Create a test inbox rule on a finance test mailbox and confirm the alert fires.
• Review every identity, human and machine, that can release a payment, and confirm each has a second approver or a value limit.

Metrics:

• Percentage of bank detail changes verified by call-back before the next payment.
• Number of identities able to release payments alone.
• Time from fraud report to bank recall request in exercises and real cases.
• Percentage of finance and treasury sign-ins using phishing-resistant MFA.
• Number of payment API keys and signing keys without a named owner.

Common failure patterns

• Verification in the same channel: confirming a bank change by replying to the email, or calling the number in the request.
• Trusting faces and voices: treating a video or voice call as authorisation, as at Arup.
• Single-person release: one user can create a payee and release a payment.
• Unwatched finance mailboxes: inbox rules and forwarding on finance staff accounts are not alerted.
• Machine credentials with payment rights: long-lived API keys and service accounts that can move funds with no owner or baseline.
• No pre-agreed extortion process: decisions about payment are made under pressure without legal, insurance and law enforcement input.

Framework mapping

See the ATT&CK Impact Tactic Guide for the rest of the Impact tactic.

Practitioner checklist

• Require two-person approval for new payees, bank detail changes and payments above a threshold.
• Verify every bank detail change by call-back to contact details already on file.
• Enforce phishing-resistant MFA on email, banking portals, ERP and treasury systems.
• Alert on inbox rules and forwarding created on finance and executive mailboxes.
• Inventory payment API keys, ERP service accounts and signing keys; assign owners and baselines.
• Keep the bank's fraud contact and the recall process in the incident playbook.
• Agree an extortion decision process with legal, insurance and the board in advance.
• Train finance and help desk staff on deepfake and impersonation scenarios at least yearly.

Standards and references

• MITRE ATT&CK: T1657 Financial Theft
• MITRE ATT&CK: M1018 User Account Management
• MITRE ATT&CK: FIN13 (G1016)
• FBI IC3: Public Service Announcement on Business Email Compromise (PSA240911)
• CISA and FBI: AA23-320A Scattered Spider
• MITRE ATLAS: AML.T0048.000 Financial Harm
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: APT38 Threat Actor Profile Guide, Invoice Redirection and Supplier Bank Detail Fraud Guide, Authorised Push Payment (APP) Fraud Guide, Deepfake and Payment Fraud Executive Briefing, MITRE ATT&CK T1486 Data Encrypted for Impact, MITRE ATT&CK T1667 Email Bombing.