GRA · Financial Crime and Fraud Risk
Spatial financeWhere capital meets hazard, exposure and transition
Cyber enabled financial crime
Cyber-enabled financial crime uses digital intrusion and deception to steal or extort: business email compromise, account takeover, ransomware payments and theft from crypto-asset platforms. Proceeds are laundered quickly, often through virtual assets. This page sets out how cyber-enabled crime and its laundering develop, how they are measured, and which institutions decide on prevention, reporting and recovery.
Cyber enabled financial crime on the record.
Cyber enabled financial crime: how the risk develops.
Cyber/fraud intersections. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Business email compromise
Criminals impersonate executives or suppliers by email to redirect payments. Losses per case can be large and recovery depends on speed.
Ransomware payments
Extortion payments, usually in crypto-assets, fund criminal groups. Payment decisions raise sanctions and reporting questions.
Crypto-asset theft and laundering
Hacks of exchanges and decentralised protocols are laundered through mixers, cross-chain bridges and unregulated exchanges. Blockchain analytics trace some flows.
Recovery needs cooperation
Freezing stolen funds requires rapid cooperation between banks, exchanges, FIUs and law enforcement across borders.
Alert triage and investigations.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Alert triage and investigations
Cyber enabled financial crime · Bank B monitoring · Today
- Alerts today940
- Escalated to cases4pct of alerts
- Open cases older than 30 days38Watch
- Reports filed this month74Normal
Alert queue
- HRapid in-out through new accountsScenario TM-07 · score 852 h
- MTrade invoice price outlierScenario TB-03 · score 757 h
- MStructuring below thresholdScenario TM-02 · score 603 h
- LName match, sanctions listLikely false positive3 h
Counterparty network, case CS-5615
red: accounts under review
Case path
- Alertscenario
- Triageanalyst
- Investigatecase
- DecideMLRO
- Reportto FIU
- Feedbacktuning
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Business email compromise losses | currency | annual | Law enforcement complaint data | REPORTED |
| Ransomware payments | currency, estimated | annual | Blockchain analytics and law enforcement | ESTIMATED |
| Crypto-asset hacks and thefts | currency and count | annual | Blockchain analytics | ESTIMATED |
| Funds frozen after rapid reporting | currency | annual | Law enforcement reports | REPORTED |
| Virtual asset service providers applying the travel rule | share of jurisdictions or firms | annual | FATF targeted updates | Published statistics |
| Cyber incidents with financial loss reported by firms | count | annual | Regulator incident data | Published statistics |
How a local shock becomes a system outage.
How much of the networks an operator, insurer or lender depends on stays working after a local shock, and how much the coupling between them amplifies it. Teaching model with stated illustrative values, not a prediction.
Controls
- Assets per layer
- 18
- Hazard footprint
- 8% of area
- Assets that depend on another layer
- 60%
- Spare capacity (tolerance)
- 30%
Readouts
- Assets hit by the hazard
- 9%
- Assets still working
- 44%
- Amplification of the initial damage
- 6.0 times
- Steps to settle
- 4
Numbers, methods and sources
| Step | Data centres working (%) | Networks working (%) | Power working (%) |
|---|---|---|---|
| 0 | 89 | 83 | 100 |
| 1 | 61 | 72 | 72 |
| 2 | 50 | 67 | 50 |
| 3 | 50 | 67 | 28 |
| 4 | 50 | 67 | 17 |
Methods
- Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
- Overload cascades Motter and Lai (2002), Physical Review E 66
- Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
- Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
- Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Major roads Natural Earth
- Railways Natural Earth
- Seaports Natural Earth
- Airports Natural Earth
- Urban extents Natural Earth
- Night lights tonight, outages (VIIRS Day/Night Band) NASA/NOAA VIIRS (Suomi NPP) · register nasa.gibs.context-live-layers
- Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Crime and Fraud Risk in Foundry
- Tested at Financial Crime and Fraud Risk in Universe
- Codified in Finance, Insurance and the Economy in Standards
- Published in Financial Crime and Fraud Risk in Reports
- Taught in Faculty of Finance and Economics in Academy
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FBI Internet Crime Complaint Center report | Business email compromise and cyber-enabled fraud complaints | Public domain |
| FATF targeted updates on virtual assets | Implementation of standards for virtual asset service providers | Free, FATF terms |
| Europol Internet Organised Crime Threat Assessment (IOCTA) | Trends in cyber-enabled crime | Free, Europol terms |
| Blockchain analytics firms' public crime reports | Estimates of illicit crypto-asset flows | Proprietary, reports free to read |
| FinCEN advisories on ransomware and business email compromise | Red flags and reporting expectations | Public domain |
What cyber enabled financial crime means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in cyber enabled financial crime reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
Who decides, and what the evidence serves.
Financial Crime and Fraud Risk prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Firm finance and security teams | How to verify payment instruction changes | Fraud patterns and control evidence |
| Boards facing extortion | Whether a ransom payment is lawful and whether to pay | Legal advice, sanctions lists and authority guidance |
| Virtual asset regulators | How to apply the FATF standards to service providers | Implementation evidence |
| Law enforcement and FIUs | How to trace, freeze and recover proceeds | Reports and analytics |
Outputs this topic produces
- Guide to cyber-enabled financial crime types
- Brief on ransomware payments, sanctions and reporting
- Method note on reading blockchain analytics estimates
- Questions for boards on payment verification controls
What experts ask.
Researchers at the cyber and fraud boundary ask how attacks become losses.
- How do cyber intrusions translate into fraud, theft and extortion?
- How do business email compromise and invoice fraud exploit organisational processes?
- How is ransomware monetised, and what role do digital assets play?
- How can cyber security and fraud functions share information and coordinate?
- How is AI changing both attacks and defences?
From intrusion to illicit funds.
Cyber-enabled financial crime uses technical compromise to steal credentials, take over accounts, divert payments or extort victims. Business email compromise impersonates executives or suppliers to redirect payments. Ransomware encrypts systems and demands payment, often in digital assets. Stolen data fuels identity fraud. The proceeds then pass through laundering networks.
Institutions often organise cyber security and fraud prevention separately, with different data, tools and reporting lines. Attacks that cross the boundary can fall between them. Coordination, shared intelligence and joint exercises help. AI is changing the landscape, enabling more convincing phishing and impersonation as well as better detection.
How the evidence is built, and where it stops.
- 01
Incident analysis
Studying attacks and their monetisation, with input from AI and machine learning for detection. Incidents are under-reported.
- 02
Digital asset tracing
Analysing ransomware flows with distributed ledgers methods. Attribution is uncertain.
- 03
Organisational research
Studying coordination between cyber and fraud teams. Practices vary widely.
- 04
Scenario exercises
Testing responses to combined attacks. Planned theme: a cyber-enabled fraud wave.
How it is studied, and what the methods cannot say.
- 01Distributed ledgers and digital assetsBlockchain analytics · Travel rule implementation · Obfuscation techniquesApplied here
- 02Network science and contagionMule network detection · Ownership chain analysis · Cross-institution patternsApplied here
- 03Artificial intelligence and machine learningReal-time fraud scoring · Alert prioritisation · Fairness in fraud controlsApplied here
- 04Data engineering, interoperability and stewardshipScreening data quality · Monitoring coverage checks · Retention and minimisationApplied here
Questions and answers.
What is business email compromise?
Can blockchain transactions be traced?
Is paying a ransom legal?
Why should cyber and fraud teams work together?
Does the platform publish exploit details?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.