CFA Digital Fraud & Account Takeover 2

Question 1

A fraudster purchases stolen credentials from the dark web and uses them to log into customer accounts. This technique is known as:

Accepted Answer

Credential stuffing

Answer

Credential stuffing involves using lists of previously breached username/password pairs to gain unauthorized access to accounts at other services.

Question 2

During an account takeover investigation, an analyst discovers the fraudster changed the victim's email and phone before making transactions. This tactic is called:

Accepted Answer

Contact point hijacking

Answer

Contact point hijacking involves replacing legitimate contact details to intercept security alerts and lock out the true owner.

Question 3

Which metric best measures an organization's exposure to automated bot-driven account takeover attacks?

Accepted Answer

Failed login rate per IP range

Answer

An unusually high failed login rate concentrated across certain IP ranges is a primary signal of automated credential stuffing or brute-force attacks.

Question 4

A bank notices logins from a known good device but at an unusual hour and location. Which fraud detection approach flags this anomaly?

Accepted Answer

User and Entity Behavior Analytics (UEBA)

Answer

UEBA establishes a behavioral baseline per user and flags deviations in time, location, or activity pattern as potential compromises.

Question 5

SIM swapping is a form of account takeover because it allows fraudsters to:

Accepted Answer

Intercept one-time passwords sent via SMS

Answer

By porting the victim's phone number to a fraudster-controlled SIM, all SMS-based OTPs are redirected, defeating SMS multi-factor authentication.

CFA Practice Test

CFA Practice Test

CFA Digital Fraud & Account Takeover 2