CFA Digital Fraud & Account Takeover 2 — Questions and Answers
Question 1: A fraudster purchases stolen credentials from the dark web and uses them to log into customer accounts. This technique is known as:
- Spear phishing
- Credential stuffing (Correct answer)
- SQL injection
- Session hijacking
Correct answer: Credential stuffing
Credential stuffing involves using lists of previously breached username/password pairs to gain unauthorized access to accounts at other services.
Question 2: During an account takeover investigation, an analyst discovers the fraudster changed the victim's email and phone before making transactions. This tactic is called:
- Account enumeration
- Contact point hijacking (Correct answer)
- Synthetic ID takeover
- Mule recruitment
Correct answer: Contact point hijacking
Contact point hijacking involves replacing legitimate contact details to intercept security alerts and lock out the true owner.
Question 3: Which metric best measures an organization's exposure to automated bot-driven account takeover attacks?
- Failed login rate per IP range (Correct answer)
- Average transaction value
- Chargeback ratio
- Customer lifetime value
Correct answer: Failed login rate per IP range
An unusually high failed login rate concentrated across certain IP ranges is a primary signal of automated credential stuffing or brute-force attacks.
Question 4: A bank notices logins from a known good device but at an unusual hour and location. Which fraud detection approach flags this anomaly?
- Static rule engine
- Behavioral biometrics
- Device fingerprinting alone
- User and Entity Behavior Analytics (UEBA) (Correct answer)
Correct answer: User and Entity Behavior Analytics (UEBA)
UEBA establishes a behavioral baseline per user and flags deviations in time, location, or activity pattern as potential compromises.
Question 5: SIM swapping is a form of account takeover because it allows fraudsters to:
- Intercept one-time passwords sent via SMS (Correct answer)
- Clone a physical debit card
- Install malware on the victim's device
- Bypass CAPTCHA challenges
Correct answer: Intercept one-time passwords sent via SMS
By porting the victim's phone number to a fraudster-controlled SIM, all SMS-based OTPs are redirected, defeating SMS multi-factor authentication.
Question 6: Which type of malware is specifically designed to intercept online banking sessions and modify transaction details in real time?
- Ransomware
- Man-in-the-Browser (MitB) (Correct answer)
- Adware
- Rootkit
Correct answer: Man-in-the-Browser (MitB)
Man-in-the-Browser malware injects code into the browser to manipulate web transactions without the user's knowledge, even when SSL is in use.
Question 7: An e-commerce site detects multiple new accounts created from the same device fingerprint within minutes. This is most indicative of:
- Friendly fraud
- Account farming for future abuse (Correct answer)
- Refund policy abuse
- Chargeback fraud
Correct answer: Account farming for future abuse
Mass account creation from a single device is a hallmark of account farming, where fraudsters stockpile accounts for later fraudulent use.
CFA Digital Fraud & Account Takeover 2
A fraudster purchases stolen credentials from the dark web and uses them to log into customer accounts.
This technique is known as: