Fraud or abuse by users
Account takeover, fake sellers, bonus abuse, content abuse.
Severity: money. Attached to 21 of 46 published product types, backed by 27 evidence records.
Product types that carry it
| Product type | Grade | Note for this type | Evidence |
|---|---|---|---|
| mobile banking app | primary | A customer coached by a scammer adds a new payee and sends a Faster Payment from the app; the sending bank reimburses the loss. | |
| neobank | practitioner single incident, no second source | The in-app sign-up accepts a landmark as a home address, and the account opens for someone who can use it to move the proceeds of financial crime. | |
| peer-to-peer payment app | primary | A scammer changes the account's password and adds a new phone, the owner gets no alert, and the scammer withdraws the account's funds. | |
| crypto exchange | primary | Callers posing as exchange support use leaked account details to talk holders into moving coins to a 'safe' wallet address the scammer controls, and transaction monitoring alerts on those withdrawals sit unreviewed. | |
| lending platform | primary | A loan is originated and disbursed in a stolen identity because the application flow does not flag altered pay stubs or a mismatched ID. | |
| buy now pay later service | primary | A fraudster opens a pay-later plan at checkout with a stolen name and card, the merchant ships, and the real person receives the missed-instalment notices. | |
| stock trading app | primary | A taken-over brokerage account buys thinly traded options from the fraudster's account, or instant deposit buying power is traded before the ACH pull bounces. | |
| accounting and invoicing SaaS | secondary | A staff user adds a supplier, enters bills for services never rendered and marks them for the next payment run, and the owner approves the batch total. | |
| expense management tool | secondary | An employee splits one personal dinner into two receipts below the approval threshold and is reimbursed for it, or claims a corporate card charge again as out-of-pocket and is paid twice. | |
| online marketplace | primary | A seller passes onboarding with a borrowed tax ID, lists counterfeit goods, collects payouts, and buyers find no way on the listing to report them. | |
| event ticketing platform | primary | Broker bots split purchases across many accounts and cards to get past the per-buyer ticket limit, then resell the seats. | |
| ride-hailing app | secondary | Drivers spoof GPS to log trips that never moved, and attackers take over rider accounts with passwords leaked elsewhere to ride on stored cards. | |
| loyalty program app | practitioner single incident, no second source | Credential stuffing logs into member accounts, then the attacker spends the linked stored value card or detaches it and sells it. | |
| video conferencing tool | practitioner single incident, no second source | An uninvited participant joins with a guessed or shared meeting ID and takes over screen share before the host can mute or remove them. | |
| identity and access management service | primary | A cached-credential shortcut in delegated directory sign-in accepts a wrong password for a user who signed in before, on apps where MFA is not enforced. | |
| LLM-based assistant | primary | Instructions hidden in an uploaded file or retrieved web page make the assistant call a tool the user never asked for, such as sending an email. | |
| smart home or IoT app | primary | Passwords leaked from other sites log attackers into camera accounts, with no second factor. | |
| fleet and logistics tracking | primary | A hard-coded master password lets an attacker send commands to a tracker and disarm a parked truck's alarm. | |
| social network | primary | Stolen session tokens let attackers log in as other users and take over their accounts, and every affected session has to be signed out. | |
| dating app | primary | Accounts already flagged as romance scammers keep sending likes and messages, and the app turns those likes into 'someone likes you' upsell emails to non-paying members. | |
| government services portal | secondary | Criminals file benefit claims with stolen identities through the online claim form, and payments go out before identity proofing catches them. |
Tests that address it
- end-to-end functional tests: mandatory for this risk on 13 product types.
- penetration testing: mandatory for this risk on 20 product types.
- compliance checks: mandatory for this risk on 5 product types.
- security scanning: mandatory for this risk on 2 product types.
- exploratory testing: mandatory for this risk on 5 product types.
- payment and money-flow testing: mandatory for this risk on 1 product types.
- regression suite: mandatory for this risk on 2 product types.
- release smoke tests: mandatory for this risk on 1 product types.
- unit tests: mandatory for this risk on 1 product types.
- integration tests: mandatory for this risk on 1 product types.
Evidence
ev-0037standardprimary
NIST SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management, National Institute of Standards and Technology
SP 800-63B sets requirements for authenticators, multi-factor authentication, session management and throttling of guessing attempts.
published undated · verified 2026-10-07
ev-0062post-mortemprimary
Coinbase Global, Inc. Form 8-K (May 14, 2025), Coinbase Global, Inc. (filed with the U.S. Securities and Exchange Commission)
Company filing on a crypto exchange incident in which bribed support staff collected customer data from internal support systems, after which the exchange added fraud monitoring and warned customers of impersonation. Supports data-breach and fraud-abuse for crypto exchanges.
published 2025-05-14 · verified 2026-10-07
ev-0063court-or-fineprimary
DFS Announces [amount] Settlement with Coinbase, Inc. after Investigation Finds Significant Failings in Company's Compliance Program, New York State Department of Financial Services
State regulator settlement finding a crypto exchange's know-your-customer program inadequate and its transaction monitoring system unable to keep pace with alerts, leaving a large unreviewed backlog. Supports regulatory-penalty and fraud-abuse for crypto exchanges.
published 2023-01-04 · verified 2026-10-07
ev-0084vendor-docsecondary
Occupational Fraud 2026: A Report to the Nations, Association of Certified Fraud Examiners
Expense reimbursements scheme: A fraudulent disbursement scheme in which an employee makes a claim for reimbursement of fictitious or inflated business expenses
Supports fraud-abuse for an expense management tool and accounting SaaS: the survey-based industry report with stated method tracks expense reimbursement schemes, which its Fraud Tree splits into mischaracterized, overstated, fictitious and multiple reimbursements, and billing schemes (fictitious or inflated invoices paid through payables) as recurring occupational fraud types.
published undated · verified 2026-10-07
ev-0102regulatorprimary
Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business, Federal Trade Commission
Supports fraud-abuse for a lending platform: creditors with covered accounts must detect identity theft signals such as altered documents at application, which is where loans are taken out in another person's name. BNPL providers extend consumer credit and are creditors in the same sense.
published undated · verified 2026-10-07
ev-0106court-or-fineprimary
Attorney General James Gets Dunkin' to Fill Holes in Security, Reimburse Hacked Customers, Office of the New York State Attorney General
An attacker that gained access to one of these accounts would have been able to use the DD card to make purchases, or remove the card from the account and sell it online.
Settlement after credential stuffing took over rewards app accounts holding stored value cards, which attackers spent or resold. Supports fraud-abuse and money-loss for loyalty program apps that hold stored value or redeemable balances.
published 2020-09-15 · verified 2026-10-07
ev-0107regulatorprimary
Online Marketplace Temu to Pay [amount] Penalty for Alleged INFORM Act Violations, U.S. Federal Trade Commission
First INFORM Act enforcement: an online marketplace was penalised for missing or hard-to-find seller disclosures and suspicious-activity reporting on third-party listings, including listings inside its app.
published 2025-09-05 · verified 2026-10-07
ev-0108regulatorprimary
Informing Businesses about the INFORM Consumers Act, U.S. Federal Trade Commission
Online marketplaces must verify the information they get from high-volume third party sellers.
FTC guidance sets the duty for a marketplace to collect, verify and disclose high-volume third-party seller details to deter stolen, counterfeit or unsafe goods, which is the fake-seller risk of this product type.
published undated · verified 2026-10-07
ev-0116regulatorprimary
PS23/4 APP scams reimbursement policy statement, Payment Systems Regulator
The PSR sets a reimbursement requirement within Faster Payments for victims of authorised push payment scams, applying to in-scope payment service providers from 7 October 2024. Supports fraud-abuse for UK banking and payment apps that send Faster Payments, because scam payments made through the app become the provider's cost.
published 2023-12-19 · verified 2026-10-07
ev-0117court-or-fineprimary
FCA fines Monzo [amount] for failings in financial crime controls, Financial Conduct Authority
FCA penalty against an app-only bank whose financial crime controls did not keep pace with customer growth and which onboarded customers on obviously implausible details, such as London landmarks as an address. Supports fraud-abuse and regulatory-penalty for neobank in-app onboarding.
published 2025-07-08 · verified 2026-10-07
ev-0121court-or-fineprimary
Block, Inc. (CFPB enforcement action), Consumer Financial Protection Bureau
CFPB order finding the operator of a peer-to-peer payment app failed to prevent, detect and address fraud on the platform and used the card network chargeback process in place of its own investigation of unauthorised transfer disputes. Supports fraud-abuse and money-loss for P2P payment apps.
published 2025-01-16 · verified 2026-10-07
ev-0122court-or-fineprimary
PayPal Settles FTC Charges that Venmo Failed to Disclose Information to Consumers About the Ability to Transfer Funds and Privacy Settings; Violated Gramm-Leach-Bliley Act, U.S. Federal Trade Commission
FTC settlement over a P2P app that told users received money was available to transfer while it could still be frozen or removed after review, shared transactions publicly by default, and did not notify users of password or new device changes. Supports money-loss, data-breach and fraud-abuse for P2P payment apps.
published 2018-02-27 · verified 2026-10-07
ev-0160practitionersecondary
Engineering Uber Systems to Combat Fraud, Uber Engineering
Engineering blog write-up on fraud seen on a ride-hailing platform, including account takeover with credentials from other breaches and GPS location spoofing to fake trips. Supports fraud-abuse for ride-hailing apps.
published 2016-06-30 · verified 2026-10-07
ev-0177post-mortemprimary
Taylor Swift | The Eras Tour Onsale Explained, Ticketmaster
The ticket seller's own account of a presale where bot traffic and fans without presale codes drove record system load and disrupted part of the queue. Supports outage-under-load and fraud-abuse for an event ticketing platform.
published 2022-11-19 · verified 2026-10-07
ev-0178regulatorprimary
FTC Brings First-Ever Cases Under the BOTS Act, Federal Trade Commission
Federal enforcement against ticket brokers who used automated software to get around per-customer ticket limits on a primary ticket seller. Supports fraud-abuse for an event ticketing platform: purchase limits that bots bypass are an attack surface the platform must test.
published 2021-01-22 · verified 2026-10-07
ev-0184regulatorprimary
Regulatory Notice 20-32, FINRA
Supports fraud-abuse for a stock trading app: the regulator describes account takeover and new account fraud in which a bad actor uses a victim's brokerage account to buy options at inflated prices from an account the actor controls.
published 2020-09-17 · verified 2026-10-07
ev-0185regulatorprimary
Regulatory Notice 21-14, FINRA
The malicious actor will then submit a request to the firm to request an ACH transfer (or "pull") from the linked bank account while also using the "instant funds" to immediately place orders to buy securities.
Supports fraud-abuse and money-loss for a stock trading app: instant buying power granted before a linked-bank ACH pull settles lets a fraudster trade and withdraw before the deposit is returned, leaving the broker with the loss.
published 2021-03-25 · verified 2026-10-07
ev-0216regulatorprimary
FTC Sues Owner of Online Dating Service Match.com for Using Fake Love Interest Ads To Trick Consumers into Paying for a Match.com Subscription, Federal Trade Commission
Millions of contacts that generated Match's 'You caught his eye' notices came from accounts the company had already flagged as likely to be fraudulent.
Supports fraud-abuse for a dating app: messages and likes from accounts already flagged as fraudulent were used to sell subscriptions. Also supports money-loss: members who disputed charges with their bank were banned from the paid service.
published 2019-09-25 · verified 2026-10-07
ev-0217regulatorprimary
Romance scammers' favorite lies exposed, Federal Trade Commission
Reports show romance scammers often use dating apps to target people looking for love.
Supports fraud-abuse for a dating app: the regulator names dating apps as a common starting point for romance scams run through fake profiles.
published 2023-02-09 · verified 2026-10-07
ev-0239regulatorprimary
ICS Advisory ICSA-22-200-01: MiCODUS MV720 GPS tracker (Update A), Cybersecurity and Infrastructure Security Agency (CISA)
Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands, and the disarming of various features (e.g., alarms).
CISA reports a vehicle GPS tracker whose API accepted a hard-coded master password and unauthenticated commands and, on a web server endpoint, arbitrary device IDs without further verification, exposing location and routes and allowing fuel cut-off, the core functions of fleet telematics.
published 2022-07-19 · verified 2026-10-07
ev-0243regulatorsecondary
Unemployment Insurance: Estimated Amount of Fraud During Pandemic Likely Between [amount] and [amount] (GAO-23-106696), U.S. Government Accountability Office
Supports fraud-abuse for a government services portal: GAO reports large-scale fraud in online unemployment benefit claims, the abuse an application and identity proofing flow must resist.
published 2023-09-12 · verified 2026-10-07
ev-0250post-mortemprimary
Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory, Okta
If the vulnerability was exploited, this could allow a user to authenticate with the stored cache key of a previous successful authentication.
Official security advisory: a cache key built with a hash that truncates long input let sign-ins through delegated directory authentication succeed without checking the password when MFA was not applied. Supports fraud-abuse for identity providers that cache directory credentials.
published 2024-11-01 · verified 2026-10-07
ev-0253regulatorprimary
FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras, U.S. Federal Trade Commission
Credential stuffing involves the use of credentials, such as usernames and passwords, obtained from a consumer’s breached account to gain access to a consumer’s other accounts.
The FTC charged a home camera company whose accounts were taken over by credential stuffing and brute force, after which attackers watched video and used two-way audio to harass people, including children, in their homes.
published 2023-05-31 · verified 2026-10-07
ev-0272standardprimary
LLM01:2025 Prompt Injection, OWASP Gen AI Security Project
The OWASP entry describes direct and indirect prompt injection, where instructions in user input or retrieved content change what the assistant does, including tool calls.
published undated · verified 2026-10-07
ev-0274standardprimary
LLM06:2025 Excessive Agency, OWASP Gen AI Security Project
Excessive Agency is the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM, regardless of what is causing the LLM to malfunction.
Applies to assistants that call tools or act for the user: a manipulated or wrong model output becomes an action with real effect.
published undated · verified 2026-10-07
ev-0317post-mortemprimary
Security Update, Meta (Facebook Newsroom)
This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts.
The company's own incident report says a flaw in the "View As" profile preview let attackers steal session tokens and take over accounts, a failure specific to social profile features.
published 2018-09-28 · verified 2026-10-07
ev-0323post-mortemprimary
A Message to Our Users, Zoom
Official company statement: uninvited participants disrupted meetings, and the company pointed hosts to waiting rooms, passwords, muting controls and limits on screen sharing. Supports fraud-abuse for video conferencing tools with joinable meeting links.
published 2020-04-01 · verified 2026-10-07