Which of the following is an example of a way in which an electronic funds transfer (EFT) fraud scheme can be committed?

• A. An employee of a person-to-person (P2P) provider misappropriates a customer's account and password information
• B. A hacker obtains consumer account and password information to direct funds from consumers' accounts
• C. A person who has stolen information about another person's bank account instructs a biller to obtain payment from that account
• D. All of the above

Answer: (D)

EFT fraud can occur through multiple attack paths that exploit electronic payment channels. In one scenario, an insider at a P2P service misuses a customer’s account and password information, showing how credential theft or abuse from within a trusted system can enable unauthorized transfers. In another, a hacker steals consumer account credentials to direct funds from those accounts, which is the classic external cybercrime of unauthorized transfers. In the third, someone who has stolen another person’s bank account details uses a biller to obtain payment from that account, illustrating fraudulent instruction to a payment processor to pull funds. Each scenario demonstrates a real method by which electronic funds transfers can be fraudulently initiated, so a choice that includes all of them best reflects the range of EFT fraud methods.