CFA Digital Fraud & Account Takeover 3 — Questions and Answers
Question 1: During a phishing simulation, employees who clicked the link were redirected to a fake login page that captured real credentials. This infrastructure is called a:
- Watering hole site
- Adversary-in-the-Middle (AiTM) proxy (Correct answer)
- Honeypot
- Botnet C2 server
Correct answer: Adversary-in-the-Middle (AiTM) proxy
AiTM phishing proxies sit between the victim and the legitimate site, capturing credentials and session cookies in real time.
Question 2: Which digital fraud indicator is most associated with new-account fraud (NAF) rather than account takeover (ATO)?
- Unusual login time for an established account
- Synthetic or mismatched identity data at registration (Correct answer)
- Password reset request for an existing account
- Sudden high-value transaction on a dormant account
Correct answer: Synthetic or mismatched identity data at registration
New-account fraud typically involves fabricated or synthetic identity data submitted during account opening, unlike ATO which targets existing legitimate accounts.
Question 3: A fraud analyst reviewing logs sees thousands of login attempts using valid usernames but randomized passwords. This is best characterized as:
- Password spraying
- Credential stuffing
- Brute force attack (Correct answer)
- Reverse brute force
Correct answer: Brute force attack
Brute force attacks systematically try many passwords against one or more accounts, whereas credential stuffing uses known username-password pairs.
Question 4: What is the primary purpose of device fingerprinting in digital fraud prevention?
- Encrypting user session data
- Identifying and tracking devices across sessions without cookies (Correct answer)
- Blocking VPN traffic
- Storing biometric authentication data
Correct answer: Identifying and tracking devices across sessions without cookies
Device fingerprinting collects browser and hardware attributes to create a unique identifier that persists even when cookies are cleared.
Question 5: A fraudster gains access to an account by answering knowledge-based authentication (KBA) questions using information scraped from social media. This illustrates a weakness of:
- FIDO2 authentication
- Static KBA (Correct answer)
- Hardware security keys
- Behavioral biometrics
Correct answer: Static KBA
Static KBA relies on answers to questions whose answers are often publicly available or easily researched, making it a weak authentication factor.
Question 6: Which regulatory framework requires financial institutions to implement a layered security approach specifically to combat online account fraud?
- SOX Section 404
- FFIEC Authentication Guidance (Correct answer)
- GDPR Article 32
- PCI DSS Requirement 8
Correct answer: FFIEC Authentication Guidance
The FFIEC Authentication Guidance mandates that financial institutions use layered security controls to mitigate risks from online banking account fraud.
Question 7: An analyst notices that after an ATO event, the fraudster waited 30 days before transacting. What fraud strategy does this reflect?
- Account dormancy exploitation
- Low-and-slow fraud
- Velocity testing
- Account aging (Correct answer)
Correct answer: Account aging
Account aging involves waiting after takeover to allow the account's fraud score to normalize before committing the actual fraud.
CFA Digital Fraud & Account Takeover 3
During a phishing simulation, employees who clicked the link were redirected to a fake login page that captured real credentials.
This infrastructure is called a: