IOCTA
EUROPOL SPOTLIGHT
ONLINE FRAUD
SCHEMES:
A WEB OF DECEIT
2
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Content s
03 Key terms
04 Key ndings
05 Introduction
06 A fast-growing threat
06 Online fraud against individuals and the private and public sectors
Investment fraud
Business e-mail compromise (BEC)
Phishing campaigns
12 Online fraud against payment systems
Logical attacks on ATMs
Skimming
Shimming
Account takeover (ATO)
16 Criminal actors involved in online fraud
16 The future of OFSs
17 Europol’s response in the ght against online fraud schemes
3
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Key terms
ACCOUNT CHECKER: a soware tool that veries
the validity of login credenals – such as
usernames and passwords – for a parcular
service or plaorm. In online fraud schemes
(OFSs), an account checker is a bot that takes
lists of leaked or stolen credenals (e.g.
usernames and passwords) and tests them
against websites to access accounts.
BOT: automated soware that is programmed to
perform repeve tasks.
CARDING: fraudulent use of stolen credit card
data. Somemes called credit card stung or
card vericaon, it involves a series of mulple
aacks usually performed by bots (soware
used to perform automated operaons) to
idenfy which card numbers or details can be
used to make purchases. Thanks to the bots,
criminals are able to make parallel automated
operaons to aempt purchase authorisaon.
CRACKING TOOL: soware deployed to break
through security measures on systems
and applicaons.
DEEPFAKE: technology that uses arcial
intelligence (AI) soware to make synthec
duplicates of real people’s voices, images
and videos. In OFSs, deepfake is an
impersonaon technique.
MALWARE: soware that is designed to inltrate
computer systems or mobile devices without
the owner’s consent to gain control over the
device, steal valuable informaon or corrupt
data. The word is a portmanteau of ‘malicious’
and ‘soware’.
MAN-IN-THE-MIDDLE (MITM) ATTACK: the aacker
places himself between two communicang
pares and relays messages for them, while the
pares believe they are communicang with
each other directly and securely.
ONE-TIME PASSWORD (OTP): a password that is
valid for only one login session or transacon
on a computer system or other digital device.
The OTP is usually sent by banking instuons
to customers to authorise a money transfer.
Also known as a one-me PIN, one-me
authorisaon code or dynamic password.
PHISHING: a form of social engineering,
characterised by unsolicited communicaons
which appear to come from a reputable source
(oen impersonang a bank instuon, delivery
company or judicial authority). Generally, these
communicaons solicit payments or contain
malicious links that land on fraudulent websites
(either a domain created by the criminals or
a compromised legimate website). They
may also contain aachments that will install
malware if opened.
SMISHING: a form of phishing using text
messages or common messaging apps.
SOCIAL ENGINEERING: the main technique used
in OFSs. Social engineering means the use
of decepon to manipulate individuals into
divulging condenal or personal informaon
that may be used for fraudulent purposes.
It can take many forms, but always relies
on psychological manipulaon and
emoonal aacks.
THIRD-PARTY SHOPPING SOFTWARE: any
soware developed outside of the vendor’s
website or the vendor’s main website provider.
VISHING: a form of phishing using voice calls
and voicemails.
4
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Key ndings
Online fraud schemes represent a
major crime threat in the EU and
beyond as online fraudsters generate
mulple billions in illicit prots every
year to the detriment of individuals,
companies and public instuons.
Criminal networks involved in online
fraud schemes are persistent and
driven by opportunism. Their chain of
crime is business-like, facilitated by
the growing presence of accessible
enablers and the wide availability of
crime-as-a-service.
Fraudsters display sophiscated
modi operandi, which are usually
a combinaon of dierent types
of fraud. Vicms of fraud are oen
re-vicmised within the same
criminal scheme.
Social engineering techniques that
fraudsters use have been growing
in complexity. Criminals adapt these
techniques according to the prole of
the vicm and the typology of fraud.
Investment fraud and business e-mail
compromise (BEC) fraud remain the
most prolic online fraud schemes.
Criminal networks involved in
these schemes pose a high threat,
given their level of organisaon
and resilience.
Charity scams leveraging emergency
situaons have increased. This
was visible during the COVID-19
pandemic, the Russian invasion
of Ukraine and the earthquake in
Türkiye and Syria. Fraudsters show
great versality in modelling their
narraves around current crises.
While physical skimming is an
ever-diminishing threat in the EU,
relay aacks targeng payment card
chips (shimming) are increasingly
being detected.
Logical aacks on ATMs sll occur in
the EU, with criminal networks tesng
ways to exploit new vulnerabilies at
the ATMs they target.
Digital skimming is a persistent
threat that results in the the, re-
sale and misuse of credit card data.
A major evoluon in digital skimming
is the shi from the use of front-
end malware to back-end malware,
making it more dicult to detect.
5
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Introduction
Online fraud schemes (OFSs) comprise a wide range of criminal acvies
that are exclusively or primarily perpetrated online or with the use of
computers; we call this cyber-enabled. The increasing online presence of
individuals, businesses and instuons has prompted many fraud schemes
to shi from the physical world to the digital environment. Although online
fraud specically occurs online, such schemes can comprise both online and
oine operaons.
A fraud scheme is perpetrated with the intenon of defrauding vicms of
their assets using false and deceiul pretexts, or with the use of cyber-
aack techniques. This results in the voluntary or involuntary transfer of
personal or business informaon, money or goods to criminals.
Today, OFSs represent a major crime threat in the EU and beyond, with
criminals generang mul-billion illicit prots by targeng individuals,
private companies and public instuons. Some types of OFS specically
target banking systems. OFSs are carried out by opportunisc individuals
and by highly organised criminal networks.
Fraudsters exploit digital tools that have been produced and marketed by
lawful businesses and service providers and also create their own illegal
tools or buy others manufactured by cybercriminals. To idenfy their
vicms and communicate with them, fraudsters make extensive use of
legimate websites, email service providers, dang apps, social media and
instant messaging services, as well as tradional telephone and voice over
IP (VoIP) services.
Virtual private networks (VPNs) are commonly used to conceal oenders’ IP
locaons. Remote Administraon Tools (RATs) provide scammers access to
vicms’ computers from a distance and let them install malicious soware,
change sengs, run applicaons and access all the vicms’ data, including
two-factor authencaon (2FA) details.
Fraud is the most frequently idened predicate oence that involves the
misuse of cryptocurrencies. Online fraudsters commonly misuse digital
currencies, crypto-wallets and crypto-exchange plaorms. This misuse
includes the deposing, transferring and laundering of fraud proceeds as
well as perpetrang cryptocurrency investment fraud.
6
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Criminals misuse bank accounts, digital wallets, instant money transfer and
peer-to-peer services to obtain money transfers from their vicms and
transfer these sums across country borders and jurisdicons. Addionally,
fraudsters create fake websites, fake ads on legimate websites and landing
pages, and fake online trading plaorms, not forgeng bots, chatbots,
computer malware, mobile malware and phishing kits.
A fast-growing threat
OFSs are a ourishing criminal market. Online fraudsters target millions of
vicms across the EU every day, and the impact of these crimes is enormous
and increasing. Not only are there the direct nancial losses for the vicms
(with some instances of fraud amounng to millions of euros in damages),
but also the costs of invesgaon by law enforcement and recovery and
reimbursement by nancial service providers.
Compared to past scenarios where fraud schemes were perpetrated
chiey in person, modern fraudsters exploit the increasing online presence
of cizens, businesses and public instuons to skilfully target the
vulnerabilies of each segment of society. The harm from online fraud is
exacerbated by the detrimental eect on the vicms’ mental and physical
health and the common re-vicmisaon.
Fraudsters are capable of adapng their modi operandi to emerging
trends and socio-economic developments, quickly integrang innovave
technologies and tools into their business models. These criminals are oen
non-EU naonals operang from abroad. Similarly, stolen funds are swily
transferred out of the EU, bringing further challenges to invesgaons,
asset tracing and recovery.
Online fraud against individuals and
the private and public sectors
Investment and business e-mail compromise (BEC) fraud remain the most
prolic forms of OFS. Phishing campaigns also persist, adding new narraves
to lure vicms into transferring money to the oenders. Fraudsters
connue to show high levels of adaptability, leveraging crises such as the
7
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Russian war of aggression against Ukraine or the earthquake in Türkiye and
Syria, to scam their vicms.
There are other typologies of fraud that connue to have a strong impact
on vicms. Tech-support scams cause huge losses by tricking the vicms
into providing access to their computer systems to obtain login credenals
and credit card data. Romance fraud is widely reported in the EU,
somemes in combinaon with other fraud schemes targeng the same
vicms.
Recence in reporng online fraud to law enforcement is very common,
oen due to a sense of shame individuals feel or a company’s fear of
reputaonal damage. This result is an under-reporng of the phenomenon.
Fraud vicms are oen re-vicmised by dierent types of fraud within the
same criminal process; vicms’ informaon is monesed to its full extent
and frequently sold on to criminals, leading targets of fraud to be re-
vicmised.
Criminal networks are increasingly resorng to social engineering
1
. This
technique uses decepon to manipulate individuals into voluntarily or
involuntarily divulging condenal or personal informaon to fraudsters. As
authencaon mechanisms have been strengthened with the introducon
of 2FA measures such as one-me passwords and digital ngerprints,
criminal networks not only seek out credit card details, but also access
accounts through account takeover (ATO)
2
.
Phishing is a key access vector for most types of fraud, aiming to intrude
into systems, steal data or extort money. This technique may also involve
installing malware to steal credenals and/or banking informaon
3
. Phishing
can also take dierent guises, depending on the means of communicaon
in use. Common alternave techniques are smishing (SMS phishing) and
vishing (voice phishing).
1 Europol, 2020, Internet Organised Crime Threat Assessment (IOCTA), available at hps://www.europol.
europa.eu/publicaons-events/main-reports/internet-organised-crime-threat-assessment-iocta-2020
2 Direcve (EU) 2015/2366 (payment service direcve 2 – PSD 2) provides the legal foundaon for the
further development of a beer integrated internal market for electronic payments within the European
Union (EU). It establishes comprehensive rules for payment services, with the goal of ensuring harmonised
rules for the provision of payment services in the EU and a high level of consumer protecon. The direcve
requires Secure Customer Authencaon (SCA) for most electronic payments, involving two-factor
authencaon (2FA) or mul factor authencaon (MFA) to access services and/or authorise transacons.
Full Direcve available at: hps://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32015L2366
3 Europol, 2023, Cyber-aacks: The apex of crime-as-a-service, Europol Spotlight, IOCTA 2023, available at
hps://www.europol.europa.eu/publicaon-events/main-reports/cyber-aacks-apex-of-crime-service-
iocta-2023
8
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Impersonaon is a technique used in the majority of online fraud schemes
to deceive vicms. Spoong is one example of a very eecve technique
to gain vicms’ trust, whereby fraudsters make a phone call or send a
text message that bears a dierent caller ID than that of the telephone
from which the call was actually placed. Some criminal networks provide
spoong-as-a-service to other fraudsters
4
.
Investment fraud
Investment fraud persists as a key threat in the EU, targeng thousands of
vicms and generang millions in illicit prots every year. Criminal networks
involved in this type of fraud show great levels of adaptability by constantly
rening and improving their modi operandi and leveraging new investment
products that are highly in demand.
Fraudsters commonly seek out vicms on social media plaorms, but also
use e-mail, instant messaging applicaons or dedicated websites with
ads encing vicms to open online trading porolios and lure them in
with inial benets. Once the vicm starts asking for claricaon on the
investment returns or becomes suspicious, the criminals pretend that there
are legimate reasons why they cannot withdraw their money, such as fees
or state taxes. The vicm is then asked to pay more money to release their
funds. In order to provide the vicm with a sense of legimacy, criminal
networks involved in investment fraud make extensive use of call centres.
These call centres operate in dierent languages and the operators are in
some cases unaware of the criminal acvies behind the work they do.
Some investment fraud criminal networks use taccs such as pyramid
schemes, namely encouraging vicms to recruit other vicms. This process
provides fraudsters with a wider vicm base and eortlessly increases their
criminal prots.
A concerning threat around investment fraud is its use in combinaon
with other fraud schemes against the same vicms. Investment fraud is
somemes linked to romance scams: criminals slowly build a relaonship
of trust with the vicm and then convince them to invest their savings
on fraudulent cryptocurrency trading plaorms, leading to large nancial
losses. Following the the of the investments and the fraud being
4 Europol, 2022, Acon against criminal website that oered ‘spoong’ services to fraudsters: 142 arrests,
available at hps://www.europol.europa.eu/media-press/newsroom/news/acon-against-criminal-
website-oered-%E2%80%98spoong%E2%80%99-services-to-fraudsters-142-arrests
9
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
uncovered, criminals oen contact their vicms posing as lawyers or law
enforcement agents oering help to retrieve their funds in exchange for
a fee. The actual perpetrators of such schemes are somemes vicms of
forced labour themselves.
Fraudsters adverse a wide range of investment products (such as stocks,
binary opons and pension funds) and adapt to socio-economic trends by
connuously shiing their focus to aracve products. The most reported
investment fraud products in the EU are cryptocurrencies. This type of
fraud has shown to be extremely protable, rising in parallel with the price
surge on common cryptocurrencies
5
and the proliferaon of new ones.
However, the cryptocurrencies market saw a sharp drop in 2022 with
a strong decrease in cryptocurrency prices
6
leading to a decline in
the revenue from the crypto scams detected in 2022
7
. Though this
could be related to a general market decline, under-reporng might also
play a role, parcularly in relaon to crypto-investment fraud combined
with romance scams
8
.
Business e-mail compromise (BEC)
BEC is a form of digitally-enabled fraud perpetrated against private
companies with the use of social engineering techniques. The most
common types of BEC are chief execuve ocer (CEO) fraud (where
criminals make urgent payment requests by impersonang a company
execuve) and fake invoice fraud (which involves fraudsters impersonang
business partners and requesng payment on cous invoices, or
exploing genuine invoices where the legimate suppliers’ bank details
have been altered).
To perpetrate their scheme, fraudsters illicitly gain access to a company’s
e-mail communicaon, gaining insights into internal structures and
operang procedures. In some cases, fraudsters use phishing techniques
to obtain personal data, which they then use to intercept and manipulate
corporate communicaon.
5 Chainalysis, 2022, Crypto Crime Report 2022, available at hps://go.chainalysis.com/2022-Crypto-Crime-
Report.html
6 J. Yang, J. Gunzberg, M. Good, B. Keoun, CoinDesk, 20 December 2022, CoinDesk Market
Outlook: 4Q Crypto Gloom Spills Into 2023, available at hps://www.coindesk.com/consensus-
magazine/2022/12/20/2023-crypto-price-market-outlook/
7 Chainalysis, 2023, Crypto Crime Report 2023, available at hps://go.chainalysis.com/2023-crypto-crime-
report.html
8 Ibid.
CEO FRAUD
STEP 1
A fraudster contacts an
employee in the finance
department at a company,
posing as a high-ranking
executive (CEO or CFO).
STEP 1
A fraudster contacts an
employee in the finance
department at a company,
posing as a high-ranking
executive (CEO or CFO).
STEP 2
The fraudster requests an
urgent transfer of funds and
absolute confidentiality,
invoking a sensitive situation
(e.g. a tax inspection, merger
or acquisition)
STEP 2
The fraudster requests an
urgent transfer of funds and
absolute confidentiality,
invoking a sensitive situation
(e.g. a tax inspection, merger
or acquisition)
STEP 3
The fraudster pressures the
employee into not following the
regular authorisation procedures.
Instructions on how to proceed
are given by a third person or via
e-mail (optional).
STEP 3
The fraudster pressures the
employee into not following the
regular authorisation procedures.
Instructions on how to proceed
are given by a third person or via
e-mail (optional).
STEP 4
The employee transfers funds
to an account the fraudster
controls. The money is then
transferred to accounts across
multiple jurisdictions.
STEP 4
The employee transfers funds
to an account the fraudster
controls. The money is then
transferred to accounts across
multiple jurisdictions.
10
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
BEC, and parcularly CEO fraud, have grown in sophiscaon, focusing on
upper-level management. Vicms somemes conclude several transfers
before realising the scam, while the ill-goen gains are quickly split through
accounts based in mulple countries and laundered.
Criminal network involved in CEO fraud
In 2021, a Franco-Israeli criminal network was involved in large-scale CEO
fraud targeng companies located in France. The perpetrators used the
idenes of the company’s CEOs and trusted business partners (such as
lawyers working for accounng companies or consultants) to request large,
urgent and condenal transfers. One of the companies targeted lost almost
EUR 38 million in just a few days. The suspects laundered the criminal
proceeds through a pre-exisng money laundering scheme involving mulple
bank accounts in the EU, China and Israel
9
.
An indicator of the growing sophiscaon of CEO fraud is the use of
deepfakes. In one case, criminals used deepfake audio to impersonate
the CEO of a company and elicit the transfer of the equivalent of
EUR 35 million
10
.
9 Europol, 2023, Franco-Israeli gang behind EUR 38 million CEO fraud busted, available at hps://www.
europol.europa.eu/media-press/newsroom/news/franco-israeli-gang-behind-eur-38-million-ceo-fraud-
busted
10 Europol, 2022, Facing reality? Law enforcement and the challenge of deepfakes, Europol Innovaon Lab
observatory report, available at hps://www.europol.europa.eu/publicaons-events/publicaons/facing-
reality-law-enforcement-and-challenge-of-deepfakes
11
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Phishing campaigns
Massive phishing campaigns based on various themes connue to target
millions of vicms in the EU, causing signicant nancial losses and
reputaonal damage to the enes they impersonate. Phishing campaigns
are perpetrated mostly via email, but also via SMS, and oen entail
money transfer requests and impersonaon of well-known businesses or
government enes.
Vicms receive false informaon about overpayments, tax requests,
announcements of detected crimes, or promises of signicant cash prizes,
goods or services. Fraudsters nd or purchase contact lists and e-mail
addresses online. The increased availability of phishing kits sold online
allows more criminal networks to be successful in their phishing aacks,
regardless of the level of organisaon and technical experse.
Police-themed scams
In an online scam in 2022, fake correspondence was sent via email and social
media, purportedly from Europol departments and senior sta. The message
told vicms that they had visited websites hosng child sexual abuse material
and urged them to reply to an email address. Respondents were asked
to make a payment of between EUR 3 000 and 7 000 via bank transfer or
instant money services to avoid prosecuon
11
.
Fraudsters are always driven by opportunism, luring their targets with
aracve claims. Recurring narraves used for phishing campaigns relate
to ongoing crises to exploit people’s emoonal involvement. Charity scams
are a parcularly unscrupulous type of phishing campaign, proteering
from an individual’s generosity towards those in need. Criminals pose as
genuine organisaons to obtain donaons, vicmising both the donor
and the legimate aid agency. Scams exploing crises have been detected
increasingly in the last few years, rst in relaon to the COVID-19 pandemic,
and more recently in the context of the Russian invasion of Ukraine and the
earthquake in Türkiye and Syria.
11 Europol, 2021, Beware of scams involving fake correspondence from Europol, available at
hps://www.europol.europa.eu/media-press/newsroom/news/beware-of-scams-involving-fake-
correspondence-europol
12
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Leveraging the Russian war of aggression against Ukraine
Charity scams through phishing campaigns have been detected in relaon to
the Russian war of aggression against Ukraine. Fraudsters targeted vicms
across the EU under the guise of supporng Ukraine or Ukrainians. The
scammers created fake webpages to solicit money using URLs that included
misleading keywords. They also used fraudulent addresses to send fake
emails pretending to raise funds for humanitarian eorts. In some cases,
fraudsters impersonated celebries that were heading or supporng real
campaigns, or spoofed humanitarian organisaons’ domains, inving vicms
to donate in cryptocurrency.
Online fraud against
payment systems
A range of online fraud schemes are perpetrated specically against
payment systems. These specialised types of fraud use common intrusion
techniques
12
to access and manipulate payment and nancial systems
while remaining undetected. They target the systems without the users
being directly involved. The purpose is to either to steal funds or obtain
personal informaon that is then further exploited by the criminals. This
type of fraud not only has a signicant nancial impact on payment service
providers but also causes reputaonal damage to legimate vendors and
undermines consumer trust.
Compromising payment systems does not directly aect users who do not
experience any anomalies in their transacons. However, individuals may be
a secondary target of these types of fraud. Fraud against payment systems
is oen followed by the the of personal informaon that can then be
used for further criminal acts. This could include identy the, fraudulent
nancial transacons, or for rening social engineering methods to re-
vicmise the same individuals whose informaon was stolen during the rst
fraud scheme.
12 Europol, 2023, Cyber-aacks: The apex of crime-as-a-service, Europol Spotlight, IOCTA 2023,
available at hps://www.europol.europa.eu/publicaon-events/main-reports/cyber-aacks-apex-of-
crime-service-iocta-2023
13
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Logical attacks on ATMs
Automated teller machine (ATM) logical aacks involve electronically
compromising ATMs to withdraw cash without using a bank card. These
aacks connue to be an aracve avenue for criminals who exploit
vulnerabilies in ATMs. ATM logical aacks comprise a coordinated set of
acons aimed at gaining access to the ATM computer system, manipulang
or extracng data, and controlling the dispensing funcon. The most
common type of ATM logical aack is the Black Box (or jackpong) aack.
This is carried out either by connecng an unauthorised external device to
the ATM or by injecng malware into it. In both instances, the aim is to send
commands directly to the ATM cash dispenser so that it ejects cash.
Skimming
Digital skimming is a common technique that allows fraudsters to steal
credit card credenals from online vendors’ checkout pages or credenals
that are stored online (oen in mobile apps). Digital skimmers steal
payment data from input elds on exisng payment forms or redirect
unsuspecng users to fake checkout pages. Compromised card details
are sold on dedicated websites and dark web marketplaces (also known
as card dumps). These illicitly obtained credenals are oen used for
carding, usually performed by bots that test the validity of stolen card data,
and to make purchases. Through the bots, criminals are able to perform
simultaneous automated operaons to aempt purchase authorisaon.
Magecart
Magecart is a well-known digital skimming technique, named aer the most
known cybercrime group that specialises in cyber-aacks involving digital
credit card the by skimming online payment forms. Its name comes from
Magento, the rst type of third-party shopping soware targeted back in
2015. Since then, digital skimming aacks have grown in scope, scale, impact
and sophiscaon. Thousands of online stores around the world have been
infected
13
, resulng in their customers’ personal data being collected at
check out.
13 As of April 2023, Sansec has idened over 70 000 e-commerce websites that have suered a Magecart
aack. Available at hps://sansec.io/docs/what-is-magecart
14
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Physical skimming on bank and credit cards is diminishing in the EU,
however it remains a threat outside its borders. Physical skimming captures
data from the magnec stripe on cards. It is now forbidden to use the
magnec strip for transacons within the EU in compliance with the new
Strong Customer Authencaon (SCA) requirement of the revised Payment
Services EU Direcve (PSD2)
14
. This Direcve seeks to add extra layers of
security to electronic payments. The magnec stripe will not be required on
newly issued payment cards in many regions from 2024
15
. Nevertheless, EU
criminal networks with experse in this crime area may shi their aenon
to countries where there is sll widespread use of the magnec stripes.
Shimming
Similar to skimming, shimming is an intercepon and/or a manipulaon of
informaon owing between a card and the chip interface of a card reader.
In recent years, relay aacks targeng payment card chips have been
increasingly reported in the EU. In a relay aack, an aacker intercepts
communicaon between two pares and then relays it to another device.
The aacker does not need to iniate any communicaon between sender
and receiver, as is the case a Man-in-the-Middle aack.
Account takeover (ATO)
Recent invesgaons into the trade in compromised credenals show
the growing threat of the illicit trade in personal data. The extensive
compromised credenals market and readily available illicit tools are
making fraudsters less dependent on specic experse, as some tasks
within OFSs can be easily outsourced.
Account takeover is a form of hacking that occurs when criminals illegally
access a vicm’s online account for their own gain. Targeted accounts (such
as online banking, email accounts or social media proles) are valuable to
criminals as they can hold funds and access specic services or relevant
private informaon that can then be sold online. ATO is now considered
14 PSD2 is the acronym for the Direcve (EU) 2015/2366 of the European Parliament and of the Council of 25
November 2015 on payment services in the internal market, amending Direcves 2002/65/EC, 2009/110/
EC and 2013/36/EU and Regulaon (EU) No 1093/2010, and repealing Direcve 2007/64/EC (Text with EEA
relevance), available at hps://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32015L2366. The
Second Customer Authencaon (SCA) measure WAS introduced in September 2019 following the entry
into force of PSD2.
15 Emerchantpay, 24 May 2022, ‘Mastercard is phasing out magnec stripes’, available at
hps://www.emerchantpay.com/insights/mastercard-is-phasing-out-magnec-stripes/
15
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
quite an easy hacking technique to implement as cracking tools and account
checkers are sold on cybercrime forums for a very low price.
The the of digital ngerprint data from compromised devices has emerged
following the introducon of digital ngerprinng as an authencaon
mechanism
16
. This highlights the adaptability of criminals in countering
online an-fraud systems, which is set to connue in the future.
Tokenised credit cards have become a popular means of payment. They
are obtained aer card tokenisaon, the process of de-idenfying sensive
cardholder data by converng it to a string of randomly generated
numbers called token. Tokenisaon protects the cardholder in the event
of a data breach or other exposure. Tokenised credit cards are usually
found on mobile payment services and digital wallets and can be linked to
subscripons to online services as well as to card-not-present (CNP) online
purchases. Fraudsters apply several techniques to obtain the one me
password (OTP) – sent by banking instuons to customers to authorise
a money transfer – connected to tokenised credit cards. They can then
connect the stolen credit card data to exisng mobile payment systems to
purchase items or obtain cash from the counter (in the countries where this
is allowed).
SIM swapping is another ATO technique entailing fraudsters taking control
of the vicm’s mobile phone SIM card (or obtaining a duplicate of the SIM
card). Fraudsters deceive mobile phone operators into porng the vicm’s
mobile number to a SIM in their possession so they can receive incoming
calls and text messages and have access to sensive data. SIM swapping is
oen used to obtain the OTP to authorise money transfers. In 2022, cases of
SIM swapping had decreased, probably due to telecommunicaon providers
implemenng beer prevenon and customer idencaon mechanisms
17
.
16 Informaon provided to Europol
17 Informaon provided to Europol
16
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Criminal actors involved in
online fraud
The criminal actors engaged in OFSs span from lone criminals to highly
organised networks composed of tens, hundreds and even thousands of
facilitators. Criminals are facilitated by the growing presence of enablers,
such as guidelines and tutorials on fraud methods on dark web forums,
phishing kits, remote administraon tools, card dumps, and databases of
personal data. The wide availability of crime-as-a-service has made this
criminal acvity more accessible.
The degree of internal organisaon of such criminal networks varies
according to the complexity of the fraud scheme, the geographical extent
of the operaons, and the intricacy of the money laundering processes.
The structure of these criminal networks is typically pyramidal. Some of
them resemble internaonal corporate structures with a high level of
internal organisaon and sophiscated HR and they operate across
mulple jurisdicons.
Criminal networks involved in OFSs accrue their prots in both at and
cryptocurrencies. Funds are usually laundered very quickly aer the fraud
has taken place; by the me the vicm realises the scam, the money is
already split across accounts based in mulple countries and laundered.
Online fraudsters make frequent use of gambling plaorms to launder
prots. Criminals make use of money mules to launder illicit prots and
to swily move funds across a network of accounts, oen in dierent
countries. While money mules are somemes recruited in criminal forums,
social media remains a key recruitment environment. Somemes, the
vicms of frauds are unwingly used as money mules themselves.
The future of OFSs
Online fraud schemes are set to further expand in the future in terms
of both harm and reach. New foci, new narraves, new products and
new modi operandi will lure in more vicms than ever. Investment fraud
involving emerging products and growing economic sectors are likely to
evolve too.
17
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Online fraudsters and cybercriminals will connue to embrace new
technologies and maximise their potenal for harm with sensive data as
a core target. The growth of new technologies such as ChatGPT and other
generave arcial intelligence (AI) variants of large language models
(LLMs) will open them up to misuse, adding complexity to the exisng
threat. Against a backdrop of the rising trend in generave AI models,
unethical variants of ChatGPT – such as WormGPT and FraudGPT – are set
to evolve.
Defence from the harm of deepfakes will become an utmost necessity in
the ght against online fraudsters. The metaverse may also open up new
opportunies to dierent fraudulent schemes. Through the increasing use
of innovave technologies and tools, the crime-as-a-service ecosystem will
likely expand to service a wider criminal base, bringing criminal acvies
within the reach of more players and act as a mulplier for organised crime.
Both criminal networks and lone actors will gain new and more harmful
means of vicmising their targets.
The state-of-the-art encrypon that is used today to protect sensive
informaon will be challenged by the expected capability of quantum
computers. Encrypted data collected today may become available to
criminals in the not-too-distant future. This may facilitate a variety of
criminal acvies, including more threats related to social engineering and
advanced phishing techniques
18
.
Europol’s response in the ght
against online fraud schemes
Online fraud schemes are expected to further increase as a criminal threat
aecng the EU, its cizens and its economy. Cybercriminals are likely to
further embrace new technologies and maximise the reach of their services.
The crime-as-a-service business model will likely expand to service a wider
criminal base. Personal data, such as access credenals, are set to remain
an extremely valuable commodity for online fraudsters.
18 Europol, ‘The Second Quantum Revoluon: the impact of quantum compung and quantum technologies
on law enforcement’, Europol Innovaon Lab observatory report, available at hps://www.europol.
europa.eu/publicaon-events/main-reports/second-quantum-revoluon-impact-of-quantum-compung-
and-quantum-technologies-law-enforcement
18
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Europol’s mission is to support EU Member States and cooperaon
partners in prevenng and combang all forms of serious internaonal
and organised crime, cybercrime and terrorism. In 2013, Europol set up
the European Cybercrime Centre (EC3) to provide dedicated support for
cybercrime invesgaons in the EU to help protect European cizens,
businesses and governments from online crime. EC3 oers operaonal,
strategic, analycal and forensic support to Member States’ invesgaons.
EC3’s dedicated Analysis Project Terminal, focused on the threat of online
fraud schemes, supports internaonal invesgaons and operaons into
fraud targeng various vicms and payment systems in the EU and beyond.
19
EUROPOL SPOTLIGHT – ONLINE FRAUD SCHEMES: A WEB OF DECEIT
Your feedback matters.
By clicking on the following link or scanning the embedded QR code you
can ll in a short user survey on the received strategic report. Your input
will help us further improve our products.
hps://ec.europa.eu/eusurvey/runner/eus_strategic_reports
The Internet Organised Crime Threat Assessment (IOCTA) is a strategic
analysis report that provides a law enforcement-centric assessment of the
latest online threats and the impact of cybercrime within the EU. It serves
to inform decision-makers at strategic, policy and taccal levels in the ght
against cybercrime, with a view to updang the operaonal focus for EU
law enforcement authories.
The IOCTA is chiey informed by operaonal informaon shared with
Europol by EU Member States and third partners, combined with expert
insights and open source intelligence.
This ninth edion of the IOCTA appears in an updated format. A summary
presents the main overarching ndings concerning the major typologies of
cybercrime, namely cyber-aacks, online fraud schemes, and online child
sexual exploitaon. This report, “Online fraud schemes: a web of deceit”,
is the second in a series of spotlight reports covering each of these crime
areas in-depth as part of the IOCTA 2023.
Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member
States in their ght against terrorism, cybercrime and other serious and organised
forms of crime. We also work with many non-EU partner states and internaonal
organisaons. From its various threat assessments to its intelligence-gathering and
operaonal acvies, Europol has the tools and resources it needs to do its part in
making Europe safer.
EUROPOL SPOTLIGHT - ONLINE FRAUD SCHEMES: A WEB OF DECEIT
PDF | ISBN 978-92-95220-96-6 | ISSN 2600-2760 | DOI: 10.2813/543686 | QL-AN-23-003-EN-N
Neither the European Union Agency for Law Enforcement Cooperaon nor any person acng on behalf of
the agency is responsible for the use that might be made of the following informaon.
Luxembourg: Publicaons Oce of the European Union, 2023
© European Union Agency for Law Enforcement Cooperaon, 2023
Reproducon is authorised provided the source is acknowledged.
For any use or reproducon of photos or other material that is not under the copyright of the
European Union Agency for Law Enforcement Cooperaon, permission must be sought directly
from the copyright holders.
While best eorts have been made to trace and acknowledge all copyright holders, Europol would like to
apologise should there have been any errors or omissions. Please do contact us if you possess any further
informaon relang to the images published or their rights holder.
Cite this publicaon: Europol (2023), Online fraud schemes: a web of deceit,
Europol Spotlight Report series, Publicaons Oce of the European Union, Luxembourg.
This publicaon and more informaon on Europol are available on the Internet.
www.europol.europa.eu
