Financial Crime and Fraud Risk
The Global Risks Alliance (GRA)
Cyber-enabled financial crime uses digital intrusion and deception to steal or extort: business email compromise, account takeover, ransomware payments and theft from crypto-asset platforms. Proceeds are laundered quickly, often through virtual assets. This page sets out how cyber-enabled crime and its laundering develop, how they are measured, and which institutions decide on prevention, reporting and recovery.
GRA · In development · service level R0
Cyber-enabled financial crime is theft or extortion carried out through digital intrusion and deception, such as business email compromise, account takeover, ransomware and crypto-asset hacks, with proceeds laundered quickly. Finance and security teams, boards, virtual asset regulators and law enforcement hold the decisions.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Cyber enabled financial crime · Bank B monitoring · Today
red: accounts under review
Cyber/fraud intersections. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Criminals impersonate executives or suppliers by email to redirect payments. Losses per case can be large and recovery depends on speed.
Extortion payments, usually in crypto-assets, fund criminal groups. Payment decisions raise sanctions and reporting questions.
Hacks of exchanges and decentralised protocols are laundered through mixers, cross-chain bridges and unregulated exchanges. Blockchain analytics trace some flows.
Freezing stolen funds requires rapid cooperation between banks, exchanges, FIUs and law enforcement across borders.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Business email compromise | Fraud using compromised or spoofed email to trick staff into making payments. |
| Mixer | A service that pools and redistributes crypto-assets to obscure the link between sender and recipient. |
| Virtual asset service provider | A business that exchanges, transfers or safekeeps virtual assets for others, as the FATF defines it. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Business email compromise losses | currency | annual | Law enforcement complaint data | REPORTED |
| Ransomware payments | currency, estimated | annual | Blockchain analytics and law enforcement | ESTIMATED |
| Crypto-asset hacks and thefts | currency and count | annual | Blockchain analytics | ESTIMATED |
| Funds frozen after rapid reporting | currency | annual | Law enforcement reports | REPORTED |
| Virtual asset service providers applying the travel rule | share of jurisdictions or firms | annual | FATF targeted updates | OFFICIAL |
| Cyber incidents with financial loss reported by firms | count | annual | Regulator incident data | OFFICIAL |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FBI Internet Crime Complaint Center report | Business email compromise and cyber-enabled fraud complaints | Public domain |
| FATF targeted updates on virtual assets | Implementation of standards for virtual asset service providers | Free, FATF terms |
| Europol Internet Organised Crime Threat Assessment (IOCTA) | Trends in cyber-enabled crime | Free, Europol terms |
| Blockchain analytics firms' public crime reports | Estimates of illicit crypto-asset flows | Proprietary, reports free to read |
| FinCEN advisories on ransomware and business email compromise | Red flags and reporting expectations | Public domain |
Financial Crime and Fraud Risk prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Firm finance and security teams | How to verify payment instruction changes | Fraud patterns and control evidence |
| Boards facing extortion | Whether a ransom payment is lawful and whether to pay | Legal advice, sanctions lists and authority guidance |
| Virtual asset regulators | How to apply the FATF standards to service providers | Implementation evidence |
| Law enforcement and FIUs | How to trace, freeze and recover proceeds | Reports and analytics |
Researchers at the cyber and fraud boundary ask how attacks become losses.
Cyber-enabled financial crime uses technical compromise to steal credentials, take over accounts, divert payments or extort victims. Business email compromise impersonates executives or suppliers to redirect payments. Ransomware encrypts systems and demands payment, often in digital assets. Stolen data fuels identity fraud. The proceeds then pass through laundering networks.
Institutions often organize cyber security and fraud prevention separately, with different data, tools and reporting lines. Attacks that cross the boundary can fall between them. Coordination, shared intelligence and joint exercises help. AI is changing the landscape, enabling more convincing phishing and impersonation as well as better detection.
Studying attacks and their monetisation, with input from AI and machine learning for detection. Incidents are under-reported.
Analysing ransomware flows with distributed ledgers methods. Attribution is uncertain.
Studying coordination between cyber and fraud teams. Practices vary widely.
Testing responses to combined attacks. Planned theme: a cyber-enabled fraud wave.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.