CFA Digital Fraud & Account Takeover 3

Question 1

During a phishing simulation, employees who clicked the link were redirected to a fake login page that captured real credentials. This infrastructure is called a:

Accepted Answer

Adversary-in-the-Middle (AiTM) proxy

Answer

AiTM phishing proxies sit between the victim and the legitimate site, capturing credentials and session cookies in real time.

Question 2

Which digital fraud indicator is most associated with new-account fraud (NAF) rather than account takeover (ATO)?

Accepted Answer

Synthetic or mismatched identity data at registration

Answer

New-account fraud typically involves fabricated or synthetic identity data submitted during account opening, unlike ATO which targets existing legitimate accounts.

Question 3

A fraud analyst reviewing logs sees thousands of login attempts using valid usernames but randomized passwords. This is best characterized as:

Accepted Answer

Brute force attack

Answer

Brute force attacks systematically try many passwords against one or more accounts, whereas credential stuffing uses known username-password pairs.

Question 4

What is the primary purpose of device fingerprinting in digital fraud prevention?

Accepted Answer

Identifying and tracking devices across sessions without cookies

Answer

Device fingerprinting collects browser and hardware attributes to create a unique identifier that persists even when cookies are cleared.

Question 5

A fraudster gains access to an account by answering knowledge-based authentication (KBA) questions using information scraped from social media. This illustrates a weakness of:

Accepted Answer

Static KBA

Answer

Static KBA relies on answers to questions whose answers are often publicly available or easily researched, making it a weak authentication factor.

CFA Practice Test

CFA Practice Test

CFA Digital Fraud & Account Takeover 3