Employment scam victims tripled at financial firms in 21 countries

Reported employment scams involving financial institutions have more than tripled over the last twelve months across 370 banks and other financial institutions in 21 countries, with investment scams being the most costly at an average of $6,600. These incidents are increasingly originating from mobile devices, with 75% of unauthorized fraud occurring via mobile. Investment scams remain the highest value, while purchase scams were the most common reported type. Romance scams experienced a modest rise in victims, and while they were not the fastest-growing, some persisted longer than other scam types across regions.
Analysis of a typical scam session revealed specific behavioral cues where attackers engaged during interactions, such as using active calls, patterned entry methods for account numbers, and piled-up touch events during review screens. Victims were reportedly discouraged from pausing or seeking risk scores, with scammers preemptively warning them against intervention by the bank. Furthermore, illicit financial networks utilize small payments and mule accounts to move funds, sometimes involving fintech wallets that require minimal identification.

* Reported employment scam victims more than tripled over the past 12 months across more than 370 banks in 21 countries.
* Investment scams averaged $6,600, nearly five times the average across all scam types.
* Purchase scams remained the most common reported case type, accounting for almost one-third of reports.
* Nine of every 10 scam sessions now begin on a mobile device.
* Unauthorized fraud originating from mobile devices accounts for 75% of cases.
* Romance scams saw a 23% rise in victims.
* Scam sessions were observed to last approximately 15 minutes.
* During a session, customers exhibited behavior like typing account numbers in three-digit groups with pauses, and touch events accumulated on review screens during payee addition.
* In some cases, customers dropped transfers before receiving risk scores.
* Fraud networks use gift cards, wire transfers, Venmo, Cash App, and peer-to-peer payments to move money through mule accounts.
* Financial sextortion targets minors, with linked cases resulting in reported suicides.

The data highlights a shift where the volume of financial fraud is outpacing traditional detection mechanisms. The fact that mobile devices dominate scam initiation and unauthorized fraud suggests that defenses must move beyond static account monitoring to dynamic behavioral analysis within session flows. The specific observations made during the simulated session—the pattern recognition regarding numerical input, the use of live calls, and the pressure placed on victims to act without independent risk assessment—reveal a sophisticated manipulation technique designed to trigger reflexive obedience over critical thinking.
The nexus between large-scale investment fraud and low-value transactional schemes routed through mule accounts underscores an ecosystem where illicit finance is intentionally fragmented and obfuscated across various digital payment rails. This structure allows bad actors to exploit the inherent latency in cross-system reconciliation, effectively creating avenues for money laundering that bypass traditional anti-money laundering scrutiny focused solely on sender/receiver AML. The threat against minors through financial sextortion reveals a profound failure of protective systems where monitoring is entirely absent, leaving vulnerable populations as an unmonitored and exposed risk pool.
What are the systemic implications if institutions focus only on outbound activity rather than the dynamic process occurring during user-initiated interactions? If behavioral anomalies like patterned input or rapid sequence shifts can be flagged—even when users resist official prompts—how does that change the calculus of operational security for both victims and perpetrators? And what is the responsibility of financial infrastructure to monitor the flow *within* a session, rather than just the endpoints, especially when these sessions are increasingly mobile-first?