The 13 types of financial fraud UK-regulated firms must detect and prevent

Financial fraud is any deliberate deception carried out to gain a financial advantage or cause financial loss to another person or organisation. It covers everything from a victim being manipulated into authorising a bank transfer to a criminal using stolen card details to make purchases online. The methods evolve constantly; the intent does not.

The scale of the problem in the UK is significant and growing. In the first half of 2025, criminals stole £629.3 million through payment fraud and scams across 2.09 million confirmed cases, a 3% increase in losses and a 17% increase in case volumes compared with the same period in 2024, according to UK Finance’s Half-Year Fraud Report 2025. For the full-year 2024 context, UK Finance’s Annual Fraud Report 2025 recorded £1.17 billion stolen across 3.13 million confirmed cases, the highest case volume on record.

For regulated financial institutions, the exposure extends well beyond financial loss. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017), the Financial Conduct Authority’s (FCA) Consumer Duty, and the Payment Systems Regulator’s (PSR) mandatory reimbursement framework all place direct obligations on firms to detect, prevent and report fraudulent financial activity.

This guide covers 13 types of financial fraud affecting UK firms, with detection and prevention guidance for each. From different types of scams targeting individual customers to systemic fraud risks in payment infrastructure, each section explains the fraud, what the latest UK data shows, and what your compliance function needs to do.

13 types of financial fraud affecting UK financial institutions

Financial fraud is not a single threat. It is a category of criminal activity that takes many forms, targets different vulnerabilities, and requires different responses from your compliance function. The 13 types covered below range from the highest-value fraud category in the UK payments system to emerging threats in online and social media channels, each with practical guidance on detection and prevention.

1. Authorised push payment (APP) fraud

Authorised push payment (APP) fraud occurs when a criminal manipulates a victim into sending money directly to the fraudster’s account. Unlike unauthorised fraud, where a criminal acts without the account holder’s knowledge, APP fraud exploits the victim directly. The bank sees an authenticated, authorised payment. By the time the victim realises what has happened, the money has moved.

APP fraud is the single largest fraud type by value in the UK, accounting for £450.7 million in losses across just under 186,000 cases in 2024 alone. Losses kept climbing the following year: according to UK Finance’s Half-Year Fraud Report 2025, APP fraud cost £257.5 million in the first six months of the year, a 12% increase on the same period in 2024, driven primarily by investment scams. Investment-related APP fraud alone reached £97.7 million in H1 2025, a 55% increase year-on-year, while 66% of cases originated online and 17% were enabled via telecommunications networks.

Common variants include:

• Purchase scams: a victim pays in advance for goods or services that never arrive, typically via an online platform or social media marketplace.
• Invoice and mandate fraud: a criminal intercepts a legitimate payment by convincing the victim that a supplier’s bank details have changed, then redirects the funds to an account they control.
• Impersonation of HMRC or bank staff: a fraudster contacts the victim posing as a trusted authority, claiming there is a problem with their account or a tax liability that requires urgent payment.
• Romance-led APP fraud: a criminal builds a relationship with the victim over time before fabricating a crisis, such as a medical emergency or travel problem, that requires money to be sent.
• CEO fraud: a criminal impersonates a senior executive, typically via email, to instruct a member of the finance team to make an urgent payment to a new account.

What UK firms are now legally required to do

The Payment Systems Regulator’s (PSR) mandatory reimbursement rules came into force on 7 October 2024, representing the most significant regulatory change to payment fraud liability in the UK to date. Under the rules, all in-scope payment service providers (PSPs) operating via Faster Payments and CHAPS must, in most cases, reimburse eligible victims of APP fraud. Reimbursement is capped at £85,000 per claim, with the cost split equally between the sending and receiving PSP. 

In-scope customers include consumers, micro-enterprises and charities. Claims must be made within 13 months of the fraudulent payment. This means your firm carries direct financial liability for APP fraud losses on both sides of a transaction, not just where your customer is the victim.

Detection signals your compliance function should monitor

APP fraud rarely arrives without warning. The following patterns, individually or in combination, should trigger enhanced scrutiny:

• First-time high-value payee: payments to a new beneficiary at an unusually high value are a primary indicator, particularly where no prior transaction history exists with that account.
• Urgency language: customers who describe being pressured to act quickly, told not to tell their bank, or asked to move money to a “safe account” are exhibiting classic APP fraud indicators.
• Unusual payment timing: transactions outside normal banking hours or outside the customer’s typical payment patterns warrant additional scrutiny.
• Short account history on the receiving end: a beneficiary account opened recently with little or no transaction history is a known risk signal.
• Mobile or telephone-originated interactions: transaction monitoring systems should apply enhanced scrutiny to Faster Payments above a defined threshold to a new beneficiary where the preceding customer interaction originated via mobile or telephone channels.

2. Identity theft

Identity theft occurs when a criminal uses another person’s personal details, without their knowledge or consent, to open accounts, take over existing ones, or commit fraud in their name. It is the most common fraud type recorded in the UK by case volume and the foundation for many others.

Cifas, whose National Fraud Database draws on reports from over 700 member organisations, recorded more than 444,000 fraud cases in 2025. Over 242,000 of those were identity fraud cases, accounting for 54% of all fraud-risk filings. Financial fraudsters increasingly use stolen identity data as a gateway to wider financial harm, combining it with account takeover, application fraud and payment fraud. 

Criminals are using AI and generative technologies to create convincing impersonations, fake documents and synthetic identities at speed and scale. Deepfake video and voice technology is now being deployed in verification processes, with documented cases of criminals using AI-generated video to defeat identity checks at onboarding. 

Common methods include:

• Data breach exploitation: stolen personal data from third-party breaches, including names, dates of birth, addresses, and financial details, is used to open accounts or submit applications in the victim’s name.
• Synthetic identity fraud: a criminal combines real and fabricated personal data to construct a fictitious identity that passes standard verification checks.
• SIM swap fraud: unauthorised SIM swaps increased 38% in 2025, allowing criminals to intercept one-time passcodes and bypass multi-factor authentication on financial accounts. Cifas
• Deepfake impersonation: criminals are using AI-generated imagery and video to defeat biometric verification checks at onboarding, an increasingly viable attack on Know Your Customer (KYC) controls.

What UK firms are now legally required to do

Customer Due Diligence (CDD) obligations under the MLRs 2017 require regulated firms to verify customer identities at onboarding and on an ongoing basis. For higher-risk customers, Enhanced Due Diligence (EDD) applies. Firms should ensure their identity verification processes can detect synthetic identities and AI-generated documents, not just match data against static reference sources.

Detection signals your compliance function should monitor

The following patterns warrant enhanced scrutiny at onboarding and during the customer lifecycle:

• Inconsistent identity data: mismatches between name, address, date of birth and device data at onboarding are a primary indicator of synthetic or stolen identity use.
• Multiple applications from a single device: several account applications submitted from the same device or IP address in a short window suggest coordinated identity fraud.
• Sudden account detail changes: a customer updating contact details, registered device or authentication credentials shortly after onboarding is a known account takeover indicator.
• One-time passcode interception: customers reporting they did not request a passcode, or authentication events occurring outside normal patterns, may indicate SIM swap activity.

3. Unauthorised payment fraud

Unauthorised payment fraud occurs when a criminal obtains a victim’s card details or banking credentials and uses them to make transactions without the account holder’s knowledge. The victim has no interaction with the criminal. Their details have been stolen, whether through a data breach, phishing, or by being captured over the phone, and used to make fraudulent transactions without them ever being aware.

Unauthorised fraud losses totalled £722 million in 2024 across 3.13 million confirmed cases, a 14% increase in case volumes on 2023. The dominant and fastest-growing category is remote purchase fraud, in which a criminal uses stolen card details to make purchases online, by phone, or by mail order. Remote purchase fraud cases rose 22% in 2024 to 2.58 million incidents, the highest ever recorded, with losses of £399.6 million. 80% of those cases involved e-commerce transactions, with 75% occurring at merchants acquired outside the UK.

What your firm is now legally required to do

Victims of unauthorised fraud are legally protected under the Payment Services Regulations 2017. Your firm is required to refund customers in the vast majority of unauthorised fraud cases, and UK Finance data indicates that customers are fully refunded in more than 98% of cases. Your transaction monitoring and fraud detection controls need to identify unauthorised payment patterns in real time, before funds leave the account.

Detection signals your compliance function should monitor

Unauthorised payment fraud leaves distinct patterns that differ from APP fraud. The following should trigger immediate review:

• Unexpected OTP alerts: a customer reporting an OTP they did not request for a transaction they did not initiate is a signal that their card details have been compromised and are being used without their knowledge.
• Card-not-present anomalies: multiple low-value card-not-present transactions within a short window, particularly at overseas merchants, are a known indicator of stolen card details being tested before higher-value fraud attempts.
• Remote banking access from a new device: account access from an unrecognised device, particularly combined with a payment instruction to a new beneficiary, warrants intervention before the transaction is processed.
• Unusual e-commerce transaction patterns: transactions at merchants outside the customer’s normal spending geography or category, particularly in high volumes, should trigger a real-time fraud alert.

4. Account takeover fraud

Account takeover fraud occurs when a criminal gains full, unauthorised control of an existing account belonging to a legitimate customer. The criminal is not making a single fraudulent transaction and disappearing. They have persistent access to the account itself, allowing them to change contact details, disable alerts, redirect payments and extract value over time, often across multiple sessions before the genuine account holder realises anything is wrong.

The personal data and credentials used to execute account takeovers are typically obtained through large-scale data breaches and phishing campaigns used to harvest login credentials. According to the NCA’s Fraud Assessment 2025, phishing is the most prevalent initial attack method used by organised crime groups against UK individuals and businesses. Cifas notes that criminals are increasingly shifting to automated methods, including credential stuffing, testing stolen username and password combinations across multiple institutions simultaneously.

More than 78,000 account takeover cases were recorded in the UK in 2025, accounting for 18% of all fraud-risk filings to the Cifas National Fraud Database, a 6% increase on 2024. That followed a 76% surge in 2024 itself. Mobile phone accounts are the dominant target, with telecoms, online retail and personal credit cards together accounting for 90% of all takeover cases. The pattern is significant: criminals increasingly target the phone layer first because controlling a mobile account allows them to intercept OTPs, reset passwords and gain access to financial accounts downstream. Criminals are increasingly using subtle methods to avoid detection once inside an account. Rather than acting immediately, they make small, gradual changes over time, disabling alerts, updating contact details incrementally and building a credible pattern of activity before executing the fraud.

Common methods used to take over accounts include:

• Credential stuffing: automated tools test large volumes of stolen username and password combinations at speed, exploiting customers who reuse credentials across multiple services. This is increasingly AI-assisted, with attack scripts running continuously across thousands of accounts simultaneously.
• SIM swap: a criminal convinces a mobile network operator to transfer a victim’s phone number to a SIM card they control. Once they have the number, they can intercept OTPs and reset passwords across any account linked to that number. Unauthorised SIM swaps increased 1,055% in 2024 and by a further 38% in 2025.
• Phishing for credentials: a criminal sends a victim a fraudulent message impersonating their bank or a trusted service, directing them to a fake login page to silently capture their credentials. Those credentials are then used to access the genuine account independently, often days or weeks later.
• Social engineering via customer support: criminals impersonate account holders to convince customer service teams to reset credentials or update contact details, handing them full control of the account without any technical compromise.
• Remote access malware: criminals, typically posing as bank fraud teams, convince victims to install software that grants them remote access to victims’ devices and their online banking. Individual account losses from this method have exceeded £1 million in documented UK cases.

What your firm is now legally required to do

Under the MLRs 2017, your firm is required to conduct ongoing monitoring of customer accounts, including identifying activity inconsistent with your knowledge of the customer. Account takeover patterns fall squarely within that obligation. Strong Customer Authentication (SCA) requirements under the Payment Services Regulations 2017 also apply, requiring multi-factor authentication for online account access and payment initiation.

Beyond the legal baseline, your firm should also consider whether SMS-based OTPs, as the sole authentication factor, remain adequate given the documented rise in SIM swap attacks. This is not a prescriptive regulatory requirement, but the NCSC and Cifas both identify it as a material vulnerability that your risk assessment should address.

Detection signals your compliance function should monitor

Account takeover fraud typically unfolds in stages. Early detection depends on identifying the reconnaissance and preparation phase before funds are moved:

• Contact detail changes: any request to update an email address, phone number, or registered device should trigger re-authentication through a separate, confirmed channel and a cooling-off period before the change takes effect.
• Login from an unrecognised device or location: access from a new device, IP address or geography outside the customer’s established pattern warrants step-up authentication before account access is granted.
• Incremental account changes: small, gradual alterations to account settings over a short period are a known indicator of a criminal testing access before executing a larger fraud.
• Sudden high-value activity on a dormant account: a previously inactive account that suddenly initiates payments or changes beneficiary details should be treated as a high-risk signal.
• Unexpected OTP requests following contact detail changes: where a customer reports OTPs they did not request shortly after account details were updated, treat it as an active takeover attempt until ruled out.
• Remote banking access combined with a payment instruction: account access from a new device followed immediately by a payment instruction to a new beneficiary is a strong combined signal warranting intervention before the transaction is processed.

5. Mortgage fraud

Mortgage fraud occurs when false or misleading information is provided to a lender to obtain a mortgage that would not otherwise be approved, or on terms that would not otherwise be offered. It ranges from a borrower exaggerating their income on an application to organised criminals using stolen identities or fabricated documents to take out mortgages on properties they do not own.

The scale in the UK is likely significantly larger than enforcement figures suggest. A Freedom of Information request to the FCA revealed only 17 enforcement investigations into mortgage fraud between 2018 and 2024, averaging three to four cases per year since 2022. Industry data and Cifas research present a different picture. One in six UK adults (16%) admits to, or knows someone who has, misled a mortgage lender about their income to secure a mortgage. 14% did not believe it was illegal to provide misleading information to a lender, and 9% considered it reasonable to exaggerate their income. Cifas research also points to AI-generated fake documents as a growing obstacle for lenders at the application stage, with fabricated payslips and identity documents becoming increasingly difficult to detect through standard verification processes.

Mortgage fraud typically falls into two categories:

• Borrower fraud: the applicant misrepresents their income, employment status, existing liabilities or the intended use of the property, for example, declaring a property as owner-occupied when it will be let out.
• Organised fraud: criminals use stolen or synthetic identities, forged payslips and fabricated bank statements to obtain mortgages, often with the involvement of complicit brokers, solicitors or valuers. Properties are sometimes used as vehicles to launder the proceeds of other criminal activity.

What your firm is now legally required to do

Under the MLRs 2017, mortgage lenders are required to apply Customer Due Diligence (CDD) to all customers, verify the source of funds for deposits, and apply Enhanced Due Diligence (EDD) when higher risk factors are present. The FCA’s Financial Crime Guide sets out the expectation that firms maintain robust controls to prevent their services from being used to facilitate fraud, including at the mortgage application stage. Where a suspicious activity report (SAR) is required under the Proceeds of Crime Act 2002 (POCA), your firm must submit it to the National Crime Agency (NCA) before proceeding with the transaction.

Detection signals your compliance function should monitor

Mortgage fraud often involves a combination of document manipulation and identity misrepresentation. The following should trigger enhanced scrutiny at the application stage:

• Income inconsistencies: payslips, bank statements and employer references that do not corroborate one another, particularly where salary credits do not match declared income.
• Unusual deposit sources: a lump-sum deposit arriving shortly before the application, particularly from an unverified third party, warrants source-of-funds verification.
• Property valuation anomalies: a valuation significantly above comparable properties in the area, or a valuer with a prior relationship to the applicant or broker, should be flagged.
• Multiple applications across lenders: a pattern of applications to multiple lenders within a short window, using similar documentation, is a known indicator of organised mortgage fraud.
• AI-generated documents: inconsistencies in font rendering, metadata, formatting, or employer details on payslips and bank statements may indicate AI-assisted document fabrication.

6. Investment fraud

Investment fraud occurs when a criminal persuades a victim to transfer money into a fictitious fund, a nonexistent asset, or a scheme entirely under the criminal’s control. The victim believes they are making a legitimate investment. They are not. The promised returns never materialise, and the funds are rarely recovered.

It is one of the highest-value fraud categories in the UK. According to the City of London Police, Action Fraud received 25,843 reports of investment fraud in 2024, with total losses of £649 million, a 13% increase in losses despite a 7% fall in case volumes. By 2025, losses had risen further to £879.8 million across 34,673 reports, a 31% year-on-year increase, according to the City of London Police. (Reports were made to Report Fraud, which replaced Action Fraud in December 2025.)  In 2024, UK Finance data on investment-related APP fraud showed that case volumes fell while average losses per case rose sharply. By 2025, case volumes had reversed course, rising 31% year-on-year, with losses following suit. People aged 55 to 64 suffer the greatest financial losses, while those aged 35 to 44 are the most frequently targeted.

Cryptocurrency accounted for 66% of all investment fraud reports in 2024. AI-generated videos featuring fabricated celebrity endorsements, including from Martin Lewis, Elon Musk and Jeremy Clarkson, are now a primary recruitment tool for fraudulent schemes, with over £10 million lost to celebrity-impersonation investment fraud in 2024 alone. Social media platforms accounted for 36% of all investment fraud reports in 2024.

Common variants include:

• Cryptocurrency scams: victims are directed to fraudulent trading platforms that show fabricated returns, building confidence before the platform disappears or withdrawals are blocked.
• Clone firm fraud: criminals impersonate FCA-regulated firms using cloned websites, email addresses and regulatory numbers to give the appearance of legitimacy. The FCA received 10,379 reports of clone firm fraud in 2024.
• Boiler room fraud: high-pressure cold callers, typically operating from overseas, push victims into buying worthless or non-existent shares, bonds, or carbon credits, promising exceptional returns.
• Recovery fraud: victims of previous investment fraud are targeted again by criminals posing as recovery specialists or law enforcement, charging upfront fees to retrieve funds that do not exist.

What your firm is now legally required to do

Under the Financial Services and Markets Act 2000 (FSMA), promoting or facilitating investment products without FCA authorisation is a criminal offence. Your firm must ensure that any investment products it offers or promotes are within the scope of its regulatory permissions. Where your firm identifies a customer who may have been a victim of investment fraud, the FCA’s Consumer Duty requires you to act in their best interests, which includes providing appropriate warnings and, where relevant, filing a suspicious activity report (SAR) with the NCA under POCA 2002.

Detection signals your compliance function should monitor

Investment fraud payments are often preceded by a distinct pattern of customer behaviour compared to other fraud types. The following should trigger review:

• Payments to unregulated entities: a customer making payments to a firm not on the FCA register warrants a proactive conversation before processing the transaction.
• Unusually high transfer values from older customers: large transfers by customers aged 55 and over to unfamiliar investment platforms should be treated as a heightened risk indicator.
• Urgency around time-limited investment opportunities: a customer citing pressure to invest before a deadline is a classic investment fraud indicator.
• Multiple transfers to the same new beneficiary: a pattern of escalating payments to an investment platform, particularly one that the customer cannot clearly describe, suggests active fraud.
• Withdrawal difficulties: a customer reporting they cannot access funds or are being asked to pay fees to release returns is almost certainly the victim of an active investment fraud.

7. Insurance fraud

Insurance fraud occurs when false or misleading information is provided to obtain an insurance policy, or when a claim is fabricated, exaggerated or staged to obtain a payout the claimant is not entitled to. It ranges from an individual inflating the value of a stolen item on a home insurance claim to organised criminal networks staging road traffic accidents to generate fraudulent motor insurance claims.

Insurers detected £1.16 billion in fraudulent general insurance claims in 2024, a 2% increase on 2023, across 98,400 fraud-related claims, a 12% rise in case volumes on the previous year. Motor insurance remains the most targeted area, with 51,700 motor fraud cases worth £576 million detected in 2024, representing 53% of all fraudulent claims. Property insurance fraud accounted for a further 18,700 claims worth £189 million, up 11% on 2023. Exaggerated loss is the most common fraud method, where claimants deliberately inflate the value of a claim beyond its true worth. Exaggerated loss claims rose 10% in 2024, totalling £466 million. Insurers also prevented an estimated 684,800 fraudulent insurance applications in 2024, a 7.4% increase from 2023.

Common variants include:

• Exaggerated claims: a genuine incident occurs, but the claimant inflates the value of losses or damage beyond what actually occurred.
• Staged accidents: organised criminal networks deliberately cause or fabricate road traffic collisions to generate fraudulent personal injury and vehicle damage claims, commonly known as ‘crash-for-cash’ fraud.
• Ghost broking: fraudsters sell fake or invalid insurance policies, often via social media, leaving buyers unknowingly uninsured. Young drivers are a primary target.
• Application fraud: false information is provided at the point of taking out a policy, for example, misrepresenting a vehicle’s primary driver or a property’s security measures, to obtain a lower premium.
• AI-generated claims: criminals are using generative AI to create fake images of vehicle damage or fabricated incident footage to support fraudulent claims, a trend the FCA identified in its Motor Insurance Claims Analysis 2025.

What your firm is now legally required to do

Insurance firms regulated by the FCA are required under the Senior Managers and Certification Regime (SM&CR) to maintain adequate systems and controls to detect and prevent fraud. The FCA’s Financial Crime Guide applies directly to insurers and sets out the expectation that firms take a risk-based approach to fraud detection across both claims handling and policy inception. Where fraud is detected, your firm must consider whether a SAR is required under POCA 2002 before making any payment or taking further action.

Detection signals your compliance function should monitor

Insurance fraud signals vary by product type, but the following patterns apply broadly across general insurance:

• Claim timing anomalies: a claim filed shortly after a policy is taken out, particularly for a high-value item or event, warrants enhanced scrutiny before settlement.
• Inconsistencies between the claim and the policy: discrepancies between the asset’s declared use at inception and the circumstances described in the claim are a known indicator of application fraud.
• Staged accident indicators: include multiple claimants from the same vehicle, a high number of personal injury claims relative to vehicle damage, or a pattern of claims involving the same solicitor or medical assessor, which should be flagged for investigation.
• Repeated claims history: a customer with a pattern of frequent claims across multiple policies or providers, particularly for similar incidents, warrants review.
• AI-generated supporting evidence: inconsistencies in image metadata, lighting, shadows or vehicle damage patterns in photographs submitted with claims may indicate AI-assisted fabrication.

8. Money laundering

Money laundering is the process by which the proceeds of criminal activity are made to appear legitimate. It typically occurs in three stages: placement, where criminal funds enter the financial system; layering, where the origin of those funds is obscured through a series of transactions; and integration, where the funds re-enter the economy as apparently clean money. For regulated financial institutions, money laundering is not a peripheral risk. It is the mechanism through which almost every other fraud type described in this article is carried out.

The UK’s National Risk Assessment of Money Laundering and Terrorist Financing 2025, published jointly by HM Treasury and the Home Office in July 2025, assesses the money laundering threat to the UK as high. The NCA estimates that money laundering impacting the UK likely runs into the hundreds of billions of pounds annually, though precise figures are not possible given the clandestine nature of the activity. 

In 2024-25, the UK Financial Intelligence Unit (UKFIU) received 866,616 suspicious activity reports (SARs), according to the NCA’s SARs Annual Report 2025. The banking and financial services sector accounted for 78.55% of all SARs, reflecting its role as the primary line of defence against money laundering in the UK. In 2024-25, the UKFIU recorded the highest number of assets ever denied in a single year under Defence Against Money Laundering (DAML) requests.

Common methods used to launder money through the UK financial system include:

• Structuring: breaking large sums of criminal proceeds into smaller deposits across multiple accounts or institutions to avoid detection thresholds, also known as smurfing.
• Money mule networks: criminal networks recruit individuals, often unwittingly, to receive and transfer criminal funds through their personal bank accounts, thereby obscuring the funds’ origin. The NCA identifies exploitation of money mules as a priority threat in its 2025 economic crime priorities.
• Shell companies and complex corporate structures: criminal proceeds are layered through chains of UK and offshore companies, exploiting gaps in beneficial ownership transparency. The National Risk Assessment 2025 identifies money laundering through UK corporate structures on behalf of organised criminal groups as a high-priority threat.
• Cryptocurrency: digital assets are used to layer criminal proceeds rapidly across jurisdictions, taking advantage of pseudonymity and the speed of crypto transactions.
• Trade-based money laundering: criminal proceeds are concealed within legitimate international trade transactions through over- or under-invoicing of goods and services.

What your firm is now legally required to do

The MLRs 2017 require all regulated firms to maintain a written AML/CTF programme, appoint a nominated officer responsible for SAR submissions, apply a risk-based approach to customer due diligence, and conduct ongoing transaction monitoring. Failure to submit a SAR where one is required is a criminal offence under the Proceeds of Crime Act 2002 (POCA). Your firm must also apply Enhanced Due Diligence (EDD) to higher-risk customers, including Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, and customers with complex corporate structures where beneficial ownership is unclear.

Detection signals your compliance function should monitor

Money laundering detection depends on understanding what normal looks like for each customer and identifying deviations. The following should trigger a SAR review:

• Unusual transaction patterns: transactions that are inconsistent with the customer’s known business activity, source of funds or stated purpose, particularly where the customer cannot provide a credible explanation.
• Structuring indicators: multiple cash deposits or transfers just below reporting thresholds, or a pattern of small deposits across multiple accounts that aggregate to a significant sum.
• Unexplained wealth: a customer whose transaction volumes are disproportionate to their known income, occupation or business profile warrants enhanced scrutiny.
• Complex layering activity: funds moving rapidly through multiple accounts, particularly across jurisdictions, with no clear commercial rationale.
• Money mule indicators: a personal account receiving multiple inbound transfers from unconnected third parties, followed immediately by outbound transfers, is a known money mule pattern.

9. Pension fraud

Pension fraud occurs when a criminal targets an individual’s pension savings, either by convincing them to transfer their pension into a fraudulent scheme, by impersonating them to take over their pension account, or by pressuring them into high-risk or fictitious investments using their pension funds as the source of capital.

The average loss per victim makes pension fraud one of the most financially devastating types of fraud an individual can experience. Action Fraud recorded 519 reports of pension fraud in 2024, with total losses of £17,567,249, an average of £33,848 per victim and £48,129 lost every day of the year. People aged 50 to 69 are most at risk, according to analysis by The Pensions Regulator and City of London Police. The two most prevalent attack methods in 2024 were investment fraud, pressure tactics and account takeover through impersonation of the pension holder.

Pension fraud is significantly under-reported. Victims often do not realise they have been defrauded until they approach retirement and attempt to access their pot, sometimes years after the fraud occurred. The true scale of losses is therefore likely to be considerably higher than reported figures suggest.

Common variants include:

• Pension transfer fraud: a criminal persuades a victim to transfer their pension into a fraudulent scheme, often promising higher returns, early access or tax advantages that do not exist.
• Pension liberation fraud: victims are led to believe they can access their pension before age 55, which typically results in significant tax penalties and the loss of funds to the fraudster.
• Account takeover via impersonation: a criminal uses stolen personal data to impersonate the pension holder and gain control of their account, redirecting funds or changing contact and payment details.
• Fake-free pension reviews: unsolicited approaches offering a free pension review are used to gather personal and financial information, which is then exploited for fraud.

What your firm is now legally required to do

Cold calling about pensions is illegal in the UK under the Pension Schemes Act 2021. Your firm must not initiate unsolicited contact about pension products. Where your firm administers or advises on pension transfers, the FCA’s rules on pension transfer advice under COBS 19 apply, requiring appropriate due diligence and suitability assessments before any transfer proceeds. 

The Pensions Regulator’s guidance on combating pension scams sets out the controls trustees and administrators are expected to maintain, including member verification processes and transfer due diligence. Where fraud is suspected, a SAR must be submitted to the NCA under POCA 2002 before proceeding.

Detection signals your compliance function should monitor

Pension fraud often involves a combination of third-party influence and unusual transfer activity. The following should trigger enhanced scrutiny:

• Undue third-party influence: a member who appears to be acting under instruction from a third party, or who cannot explain the destination or purpose of a transfer in their own words, warrants intervention before the transfer proceeds.
• Transfer to an unrecognised scheme: a request to transfer to a scheme your firm cannot verify against The Pensions Regulator’s register of occupational pension schemes should be treated as high risk.
• Unusual contact detail changes: changes to a member’s registered address, phone number or email shortly before a transfer request are a known account takeover indicator.
• Early access requests: any request to access pension funds before the minimum pension age, currently 55 and rising to 57 in 2028, should be treated as a potential indicator of pension liberation fraud.
• Pressure to act quickly: a member citing urgency or a time-limited opportunity in relation to a pension transfer is exhibiting a textbook indicator of pension fraud.

10. Tax fraud

Tax fraud occurs when an individual or organisation deliberately provides false information to HMRC, conceals income or assets, or exploits the tax system to avoid paying what is legally owed. It ranges from an individual failing to declare cash income to organised criminal networks running systematic VAT fraud schemes involving hundreds of shell companies. Unlike tax avoidance, which exploits legal loopholes, tax fraud is a criminal offence.

The UK tax gap, the difference between tax owed and tax actually collected, stood at £46.8 billion in 2023-24, representing 5.3% of total theoretical tax liabilities, according to HMRC’s own published estimates. Deliberate evasion accounts for £5.5 billion of that figure annually, though HMRC acknowledges this may be a significant underestimate given the inherent difficulty of detecting concealed activity. In 2024-25, HMRC’s Fraud Investigation Service delivered £1,516 million in Exchequer benefits through criminal investigations and a further £2,430 million through civil investigations, against a total compliance yield of £48 billion. Despite increased enforcement investment, prosecutions for tax fraud in 2024-25 remained less than half the number recorded in 2019-20, reflecting the scale of the enforcement gap.

For financial institutions, tax fraud is directly relevant because firms are frequently used, wittingly or otherwise, as the infrastructure through which proceeds of tax fraud are moved. HMRC has extensive information-gathering powers enabling it to require financial institutions to produce data on customer transactions, and firms that fail to report suspicious activity connected to tax fraud may face regulatory and criminal exposure.

Common variants include:

• VAT fraud: businesses submit false VAT returns, claim repayments they are not entitled to, or participate in missing trader intra-community (MTIC) fraud, also known as carousel fraud, where VAT is charged and collected but never remitted to HMRC.
• Payroll fraud: employers operate ghost employee schemes, submit fraudulent PAYE registrations or manipulate payroll records to reduce their tax liability or obtain fraudulent tax credits.
• Offshore tax evasion: individuals and companies conceal income, assets or beneficial ownership in overseas jurisdictions to avoid UK tax obligations. HMRC continues to draw on international data-sharing agreements and leaked data sources, including the Panama and Pandora Papers, to identify offshore tax evasion.
• Research and development credit fraud: fraudulent or inflated R&D tax credit claims have been a sustained enforcement priority for HMRC, and the National Audit Office has qualified HMRC’s accounts every year since 2019-20 due to high levels of fraud and error in this area.
• Construction industry scheme fraud: criminal networks exploit the Construction Industry Scheme (CIS) to submit fraudulent deduction claims or operate phoenix company structures to evade tax liabilities.

What your firm is now legally required to do

Financial institutions are subject to HMRC’s information powers under Schedule 36 of the Finance Act 2008, which enables HMRC to require the production of documents and information relevant to a tax investigation. Your firm must also comply with the Common Reporting Standard (CRS) and the Foreign Account Tax Compliance Act (FATCA) framework, which require the automatic exchange of financial account information with relevant tax authorities. 

Where your firm identifies transactions connected to suspected tax fraud, a SAR must be submitted to the NCA under section 330 of POCA 2002. The Corporate Criminal Offence of Failure to Prevent the Facilitation of Tax Evasion under the Criminal Finances Act 2017 also applies directly to your firm: if an employee or associated person facilitates tax evasion on your firm’s behalf, your firm commits a criminal offence unless you can demonstrate reasonable prevention procedures were in place.

Detection signals your compliance function should monitor

Tax fraud involving financial institutions typically manifests as unusual transaction patterns around tax payment periods or as complex structures with no evident commercial rationale. The following should trigger review:

• Large cash deposits around tax deadlines: significant cash deposits shortly before a VAT return submission date or corporation tax payment deadline, particularly from a customer whose business profile does not support that volume of cash, warrant scrutiny.
• Complex corporate structures with no evident purpose: a customer operating through multiple layers of UK and offshore companies, with funds cycling between them and no clear commercial rationale, are known indicators of tax fraud and money laundering.
• Frequent changes to payroll bank accounts: a business repeatedly changing the account to which PAYE payments are made, particularly to accounts with short transaction histories, should be flagged.
• R&D credit receipts disproportionate to business activity: a customer receiving HMRC R&D tax credit repayments significantly in excess of what their declared business activity would support warrants a source of funds review.
• Mismatch between declared turnover and transaction volumes: a customer whose account transaction volumes are substantially higher than their declared turnover to HMRC is exhibiting a known tax evasion indicator.

11. Cyber-enabled fraud

Cyber-enabled fraud refers to fraudulent activity facilitated or significantly amplified by digital technology and online systems. It is distinct from cybercrime in the pure sense, where the attack targets systems directly. In cyber-enabled fraud, the technology is the delivery mechanism, but the ultimate objective is financial deception, whether through phishing, business email compromise, ransomware or social engineering carried out via digital channels.

Phishing remains the dominant attack method across the UK. According to the Cyber Security Breaches Survey 2025/2026, published by the UK government in April 2026, phishing was experienced by 38% of businesses and rated as the most disruptive breach type by 69% of those affected, making it by far the most prevalent attack vector. The NCSC Annual Review 2025 identifies ransomware as the most pressing cyber threat to the UK, with incident volumes more than doubling year-on-year. Cyber-facilitated fraud carries significantly higher financial burdens than other cyber incidents, with an average cost of £5,900 per affected business, according to the Cyber Security Breaches Survey 2025.

For financial institutions specifically, cyber-enabled fraud presents a layered threat. A successful phishing attack against a customer or employee does not just cause immediate financial loss. It creates the access conditions for account takeover, data theft and downstream fraud across multiple systems.

Common variants include:

• Phishing and spear phishing: mass or targeted emails impersonating trusted organisations, including banks, HMRC and the FCA, are used to harvest credentials, capture card details, or deliver malware. AI is now being used to generate highly personalised spear phishing campaigns at scale.
• Business email compromise (BEC): a criminal gains access to or spoofs a legitimate business email account to intercept payment instructions, divert funds or manipulate suppliers into changing bank details. BEC is a primary enabler of invoice and mandate fraud.
• Ransomware: malicious software encrypts an organisation’s systems and data, with criminals demanding payment for the decryption key. Financial institutions are a primary target given the sensitivity of their data and the regulatory pressure they face to restore services quickly.
• Smishing and vishing: fraudulent SMS messages and voice calls impersonating banks, HMRC or delivery services are used to trick victims into divulging credentials or authorising payments. Vishing is a primary enabler of APP fraud via telephone channels.
• Malware and keylogging: malicious software installed on a victim’s device captures keystrokes, harvests credentials and transmits them to criminals, enabling account takeover and payment fraud without the victim’s knowledge.

What your firm is now legally required to do

The FCA’s operational resilience framework, set out in PS21/3, requires firms to identify their important business services, set impact tolerances and ensure they can remain within those tolerances during severe but plausible disruption scenarios, including cyber attacks. Your firm must also comply with the Network and Information Systems (NIS) Regulations 2018, where applicable, and with the ICO’s requirements under the UK GDPR to report data breaches within 72 hours of becoming aware of them. The FCA and PRA’s joint cyber resilience requirements, reinforced by DORA for firms with EU operations, require board-level accountability for cyber risk.

Detection signals your compliance function should monitor

Cyber-enabled fraud targeting financial institutions often involves a combination of technical indicators and behavioural signals. The following should trigger immediate review:

• Unusual email domain activity: emails purporting to come from known counterparties but originating from slightly altered domains, for example, substituting a letter or adding a character, are a primary BEC indicator.
• Unexpected payment instruction changes via email: any instruction to change payment details received by email alone, without verbal confirmation from a known contact, should be treated as a potential BEC or phishing attack until verified.
• Employee credential anomalies: logins from unrecognised IP addresses or locations, particularly outside business hours or from geographies inconsistent with the employee’s profile, should trigger immediate step-up authentication.
• Ransomware early indicators: unusual file-encryption activity, and large volumes of file renames or access requests to multiple directories within a short window are early ransomware deployment signals that warrant immediate isolation of affected systems.
• Customer reports of unsolicited authentication requests: customers reporting OTPs, push notifications, or calls from individuals claiming to be from your firm that they did not initiate should be treated as an active credential-harvesting attempt.

12. Sanctions evasion

Sanctions evasion occurs when an individual, entity, or financial institution deliberately circumvents the restrictions imposed by a financial sanctions regime, enabling a designated person or entity to access funds, assets, or economic resources that they are prohibited from using. For UK-regulated firms, sanctions compliance is not optional. Processing a transaction that benefits a sanctioned party, even unknowingly, constitutes a breach of UK financial sanctions law and can result in civil penalties, criminal prosecution and significant reputational damage.

The UK’s financial sanctions regime is administered by the Office of Financial Sanctions Implementation (OFSI), a department of HM Treasury. In 2024-25, OFSI recorded 394 suspected breach cases, the vast majority of which related to Russia sanctions. Frozen assets reported to OFSI increased from £24.4 billion to £37 billion year-on-year. Despite the volume of cases, only two monetary penalties were issued in 2024-25, a posture that drew significant criticism. The FCA’s £29 million fine against Starling Bank in 2024 for sanctions controls described as “shockingly lax” signals the direction of travel for firms that fall short.

Russia sanctions dominate the current enforcement landscape, but the UK’s consolidated sanctions list now contains 4,733 designations across multiple regimes, including global anti-corruption, counter-terrorism, cybercrime and human rights. OFSI is shifting to a more proactive, intelligence-led enforcement model, with 151 of its 240 active cases as of April 2025 identified proactively rather than through self-reports.

Common evasion methods used to circumvent UK sanctions include:

• Correspondent banking exploitation: sanctioned entities route transactions through chains of correspondent banks in jurisdictions with weaker sanctions screening controls, obscuring the ultimate beneficiary from the originating UK firm.
• Shell company and complex ownership structures: designated individuals conceal their beneficial ownership through layers of UK and offshore entities, making it difficult to identify sanctioned parties at the point of transaction.
• Cryptocurrency: digital assets are used to move sanctioned funds across borders rapidly, exploiting gaps in sanctions screening coverage for cryptoasset transactions.
• Trade-based evasion: sanctioned goods or financial flows are disguised within legitimate trade transactions through misdescription of goods, falsified documentation or third-country routing.
• Proxy transactions: a non-sanctioned third party, acting on behalf of a designated person, conducts transactions with UK firms without disclosing the sanctioned ultimate beneficiary.

What your firm is now legally required to do

Under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), your firm is legally required to comply with all UK financial sanctions and to report any knowledge or reasonable suspicion of a sanctions breach to OFSI. Failure to comply is a criminal offence. Your firm must also maintain sanctions screening controls capable of identifying designated persons and entities across all customer-facing and payment processing activities. 

The MLRs 2017 require your firm to apply Enhanced Due Diligence (EDD) to customers from high-risk jurisdictions and to screen against the OFSI consolidated list as part of your Know Your Customer (KYC) process. Where a transaction is suspected to involve a sanctioned party, your firm must not proceed without OFSI’s consent and must file a report immediately.

Detection signals your compliance function should monitor

Sanctions evasion is designed to avoid detection. Effective screening goes beyond name-matching against the consolidated list. The following should trigger enhanced scrutiny:

• Transactions involving high-risk jurisdictions: payments routed through or to jurisdictions subject to UK sanctions or identified by FATF as high-risk warrant enhanced due diligence, regardless of whether named parties appear on the consolidated list.
• Unusual correspondent banking patterns: transactions routed through an unusually high number of intermediary banks, particularly through jurisdictions with weaker sanctions regimes, should trigger a review of the ultimate beneficiary.
• Beneficial ownership opacity: a customer or counterparty whose ultimate beneficial ownership cannot be clearly established, or whose corporate structure appears designed to obscure it, is a known sanctions evasion indicator.
• Cryptoasset transactions linked to sanctioned wallets: transactions involving cryptoasset addresses associated with sanctioned entities or jurisdictions should be flagged immediately. Your firm should ensure its screening tools cover known sanctioned wallet addresses.
• Inconsistencies between trade documentation and stated purpose: mismatches between the declared nature of goods, the transaction value and the counterparties involved in a trade transaction may indicate trade-based sanctions evasion.

13. Bribery and corruption

Bribery is the offering, promising, giving, requesting or receiving of a financial or other advantage to induce or reward improper conduct. Corruption is the broader category of abuse of entrusted power for private gain. For regulated financial institutions, bribery and corruption risk arises both externally, where a firm’s customers or counterparties are involved in corrupt activity, and internally, where employees or associated persons act corruptly on the firm’s behalf.

The scale of the problem in the UK is larger than enforcement figures suggest. The Home Office Economic Crime Survey 2024 found that approximately 1 in 35 businesses with employees experienced a bribery incident in the previous 12 months, with an estimated 117,000 bribes offered by UK businesses or individuals, cumulatively worth over £300 million. Despite this, only 15 offences were prosecuted under the Bribery Act 2010 in 2024, according to the UK Anti-Corruption Strategy 2025, published by the Home Office in March 2026. The SFO opened eight new criminal cases in 2024-25 and took one case to court over the same period.

The gap between the scale of the problem and the enforcement response is a recognised challenge. The UK Anti-Corruption Strategy 2025 commits to expanding the Domestic Corruption Unit in the City of London Police, strengthening corporate self-reporting incentives and deploying AI to accelerate SFO investigations.

Common variants relevant to financial institutions include:

• Third-party bribery: a firm’s agents, intermediaries or joint venture partners offer or receive bribes on the firm’s behalf, creating corporate criminal liability under section 7 of the Bribery Act 2010 unless adequate prevention procedures are in place.
• Facilitation payments: small payments made to public officials to expedite routine processes, sometimes referred to as grease payments, are illegal under the Bribery Act 2010, regardless of their value or local custom.
• Procurement and contracting corruption: employees with authority over purchasing decisions accept gifts, hospitality or kickbacks from suppliers or counterparties in return for awarding contracts or favourable terms.
• Politically Exposed Person (PEP): related corruption: customers who are Politically Exposed Persons (PEPs) or their associates present an elevated bribery and corruption risk, particularly when funds cannot be traced to a legitimate public-sector salary or declared income.
• State capture and institutional corruption: in higher-risk jurisdictions, entire regulatory or enforcement processes may be subject to systemic corruption, undermining the reliability of local due diligence and documentation.

What your firm is now legally required to do

The Bribery Act 2010 creates four offences: bribing another person, being bribed, bribing a foreign public official, and the corporate offence of failing to prevent bribery. The corporate offence applies to your firm if an associated person bribes another to obtain or retain business for your firm. The only defence is to demonstrate that adequate procedures were in place to prevent bribery. 

The Ministry of Justice’s guidance on adequate procedures sets out six principles your firm must be able to evidence: proportionate procedures, top-level commitment, risk assessment, due diligence, communication, monitoring and review. The MLRs 2017 require your firm to apply Enhanced Due Diligence (EDD) to PEPs and to establish the source of wealth and source of funds for any PEP customer or high-risk relationship.

Detection signals your compliance function should monitor

Bribery and corruption indicators in a financial institution context often appear as unusual payment patterns or relationship characteristics rather than obvious fraudulent transactions. The following should trigger enhanced scrutiny:

• Unusual third-party payments: payments to agents, consultants or intermediaries that are disproportionate to the services described, lack a clear commercial rationale or are routed to jurisdictions with no obvious connection to the business relationship warrant review.
• Gifts and hospitality above policy thresholds: any gift, hospitality or entertainment offered to or received by employees above your firm’s declared threshold should be logged and reviewed, particularly where it involves a counterparty with pending business decisions.
• PEP transactions inconsistent with declared income: a PEP customer whose transaction volumes or asset base cannot be explained by their known public-sector role or declared income is exhibiting a primary corruption and money-laundering indicator.
• Requests to use unusual payment routes: a counterparty insisting on payment to a third-party account, an offshore jurisdiction or a recently opened account with no prior transaction history is a known corruption red flag.
• Employees with unexplained wealth: internal audit or HR flags relating to employees living beyond their apparent means, particularly those with procurement, credit or transaction approval authority, warrant investigation under your firm’s anti-bribery programme.

Ready to strengthen your financial crime controls?

Financial fraud takes many forms, and the 13 types covered in this guide reflect the breadth of the threat facing UK-regulated firms. What they share is that each one leaves a trail, and the firms best placed to detect it are those with monitoring, screening and due diligence controls that work together rather than in isolation.

RelyComply is an end-to-end AML platform built for regulated firms operating in the UK under the MLRs 2017 and the broader financial crime framework.

We hope you found this guide useful. If you are reviewing your firm’s financial crime controls, request a demo to see the platform in action.

Frequently asked questions about financial fraud in the UK