Second-Party Fraud – Financial Fraud – Facilitated By Money Mules – What It Is – How It Works

Second-Party Fraud

When a Scam Victim’s Legitimate Identity Becomes Part of the Fraud

SCARS Institute Note

Second-party fraud deserves particular attention in scam victim education because it shows how a person can move from being the target of a crime to becoming an unwitting part of the criminal operation. The subject requires care because voluntary financial actions do not always mean informed criminal participation. Scam manipulation, emotional attachment, coercion, misplaced trust, and false explanations can influence what a victim believes about money moving through personal accounts. At the same time, knowledge can change, and continued conduct after clear warnings can raise very different questions. Understanding those distinctions helps families, advocates, institutions, and investigators examine what actually happened instead of forcing complicated cases into simple categories of victim or offender.

Introduction to 2nd Party Fraud

Fraud is commonly discussed in terms of first-party and third-party fraud. First-party fraud involves a genuine customer who deliberately abuses a financial relationship or misrepresents information for personal gain. Third-party fraud involves someone using another person’s identity, account, credentials, or financial access without authorization. Between those familiar categories sits second-party fraud, a less widely understood form of financial abuse that creates difficult questions about consent, knowledge, deception, coercion, and responsibility.

Second-party fraud occurs when a genuine customer knowingly gives another person access to an identity, financial account, device, payment service, credentials, or other legitimate financial relationship, and that access becomes involved in fraudulent activity. The customer is real, the identification can be genuine, and the bank account can have years of legitimate history. Nothing necessarily failed when the institution verified the person’s identity. The problem arises because another individual has gained access through the legitimate customer rather than stealing that customer’s identity outright.

For scam victims, this distinction becomes especially complicated. A person can knowingly allow someone to use an account without knowing that the person intends to commit fraud. A romance scam victim can knowingly receive money for the person believed to be a romantic partner while having no idea that the money was stolen from another victim. A supposed employer can instruct someone to process transactions as part of a fake job. An elderly person can allow a trusted companion to use an account because the companion has manufactured an explanation that sounds reasonable.

The person knows that access has been shared. That does not necessarily mean the person understands the criminal purpose behind it.

This distinction matters because second-party fraud sits in an uncomfortable place between ordinary authorized access and deliberate criminal participation. It can involve innocent assistance, deception, manipulation, reckless disregard, coercion, financial inducement, or knowing collaboration. The transaction record can look nearly identical in several of those situations, even though the people involved understood very different things.

Ordinary Shared Access Is Not Second-Party Fraud

People routinely allow other people to assist with financial matters. A spouse can use a partner’s phone to pay a household bill. An adult child can help an elderly parent use online banking. A parent can manage financial services for a child. Someone can help a disabled family member complete an online transaction. Those situations do not become fraudulent merely because one person has access to another person’s device or financial information.

The problem begins when that legitimate access becomes connected with deception or criminal activity. A genuine account can receive stolen money. A real identity can be used to open accounts for someone who cannot safely open them under the person’s own identity. A legitimate payment service can move fraud proceeds. A real customer can approve transactions while acting on instructions supplied by a criminal.

This creates a problem for institutions because successful authentication does not establish legitimate purpose. A customer can enter the correct password, receive the authentication code on the correct telephone, personally approve the payment, and still be acting under deception. The institution has confirmed who performed the transaction. It has not necessarily established why the person performed it or whose interests the transaction actually serves.

Scammers understand this distinction very well. Instead of defeating an institution’s security controls, they can persuade the legitimate customer to pass through them willingly. The customer becomes the authentication mechanism for the criminal.

The Spectrum of Second-Party Involvement

Second-party fraud is best understood as a spectrum because knowledge and intent do not remain identical in every case. At one end sits legitimate assistance with no fraudulent purpose. Somewhere beyond that sits a person who voluntarily shares account access because of trust but has no knowledge that the other person intends to commit fraud.

The circumstances become more serious when unfamiliar money begins entering the account. The person can be instructed to forward it elsewhere, convert it into cryptocurrency, withdraw it as cash, purchase cashier’s checks, send it through a payment service, or move it into another account. The explanation can still appear legitimate to the person receiving the instructions. A supposed business partner has paid an invoice, a relative has repaid a debt, a client has sent contract funds, or a financial restriction supposedly prevents the real owner from receiving the money directly.

Then warnings begin to appear. A bank questions a transfer. An account is restricted. A family member raises concerns. Another financial institution refuses a transaction. Someone explains that receiving money from strangers and forwarding it resembles money mule activity. Law enforcement can eventually make contact.

Each warning changes the person’s informational position. Someone who completed an initial transaction while completely deceived does not occupy the same position after three banks have closed accounts and investigators have explained why the transfers are suspicious.

At the other end of the spectrum sits deliberate participation. A person accepts payment for allowing criminal proceeds to pass through an account, provides debit cards and login credentials while knowing how they will be used, opens multiple accounts for criminals, creates businesses to conceal ownership, or recruits additional people into the arrangement. That person has moved well beyond being merely deceived about the purpose of financial access.

The difficulty lies in determining where the person stood at each stage. Second-party fraud cannot be understood responsibly by examining only whether the customer authorized the transactions.

Scam Victims Make Especially Valuable Second Parties

Scam victims can become particularly useful to criminals because they have something fraud networks constantly need: legitimate identities with legitimate financial histories.

A relationship scam victim can have a bank account that has been open for twenty years. The person has a real address, valid identification, established credit, familiar devices, normal transaction history, and a long-standing relationship with the financial institution. The account does not initially look like an account created for crime because it was not created for crime.

The criminal also has another advantage. The victim already trusts the person represented by the criminal identity.

The request to use an account does not arrive as a proposal from a stranger. It comes from the supposed romantic partner who has spent months creating emotional attachment. That person has listened to personal problems, discussed a future together, exchanged daily messages, offered reassurance, expressed affection, and perhaps become deeply involved in the victim’s daily life.

When the financial request eventually arrives, the victim interprets it through that relationship. A supposed engineer working overseas cannot receive payment from a client. A military officer supposedly cannot access an account while deployed. A business executive claims that funds need to be routed temporarily because of an international banking problem. A romantic partner says that a relative needs to repay money but cannot transfer it directly.

To an outsider, the request looks suspicious. Inside the relationship created by the scammer, it can look like an ordinary favor for someone trusted.

That difference in perception is precisely what the criminal has spent months constructing.

Knowing About Access Is Not the Same as Knowing About Fraud

The distinction between access and purpose deserves special attention. A scam victim can knowingly give another person a password, verification code, account number, debit card information, or access to a device. The victim can knowingly receive a payment and knowingly send that money elsewhere. None of those facts alone proves that the victim understood the transaction to be criminal.

A victim can believe that incoming money belongs to the scammer. The criminal can claim that the funds represent wages, a business payment, an inheritance, a loan repayment, an investment withdrawal, or money sent by a family member. The victim is not necessarily trying to conceal the money’s real owner because the victim believes the criminal’s explanation of ownership.

This is one reason second-party fraud becomes so difficult for families and institutions to understand. They see voluntary behavior and assume informed behavior. The two are not identical.

A person can voluntarily perform an action while being profoundly deceived about what that action means. Scam manipulation depends on precisely that condition. Victims send money voluntarily because they have been deceived about the reason for sending it. They can also receive and transfer someone else’s money voluntarily while being deceived about where the money came from.

The relevant question is not simply whether the person knew a transfer was occurring. It is whether the person understood the fraudulent purpose, the true source of the funds, and the role the transaction played in someone else’s crime.

Money Mule Activity and Second-Party Fraud

Money mule activity is one of the clearest examples of how second-party fraud enters scam victimization. A money mule receives or transfers funds on behalf of another person. Criminal organizations use these intermediaries to create distance between stolen money and the people controlling the fraud.

Some mules participate knowingly. They understand that the money is criminal proceeds and accept compensation for moving it. Others begin under deception. A fake employer claims that processing payments is part of a job. A romantic partner asks for help receiving money. A criminal tells a victim that another person owes money but cannot pay directly.

A victim can become useful to a fraud network without recognizing that another victim exists somewhere else in the transaction. The incoming money can appear to validate the scammer’s story. If the criminal previously claimed to have substantial financial resources, receiving a $20,000 transfer can actually strengthen the victim’s belief that those resources are real.

The truth can be very different. The $20,000 could have been stolen from another victim earlier that day.

The first victim sees money disappear. The second victim sees money arrive and follows instructions to move it elsewhere. The criminal controls the explanations given to both people while avoiding direct receipt of the stolen funds.

The second victim’s legitimate account has become part of the laundering and transfer structure surrounding the fraud.

Incoming Money Changes the Investigation

Families and victim advocates frequently concentrate on money leaving a scam victim’s accounts. That focus makes sense because the financial loss is usually one of the first visible signs of the crime. Yet second-party involvement requires equal attention to unexplained money coming into the victim’s accounts.

An account review should consider deposits and transfers involving unfamiliar individuals, companies, payment services, checks, cryptocurrency, and other sources that do not fit the victim’s normal financial activity. The fact that money arrived does not mean the victim benefited from it. The victim can have received $50,000 and forwarded nearly all of it according to the scammer’s instructions.

The amount a victim personally lost and the amount that passed through the victim’s accounts are two different questions. A person can lose retirement savings while simultaneously moving substantial sums stolen from other victims.

That creates another layer of harm. The original victim now faces account closures, financial investigations, demands for explanations, possible liability questions, damaged banking relationships, and law enforcement scrutiny. The victim can suddenly discover that the scam did not merely take personal money. It also used personal financial identity as part of a broader criminal operation.

Families who never ask about incoming funds can completely miss this part of the crime.

Relationship Manipulation Changes the Meaning of the Request

Money is not the only reason someone gives another person financial access. Relationship pressure can be far more persuasive.

A criminal who has created emotional attachment can frame cooperation as proof of loyalty. The victim can be told that refusing help means refusing the relationship. The scammer can claim that the victim is the only trustworthy person available. A financial request can be presented as the final obstacle before the couple can finally be together.

This turns an account transaction into an emotional test.

The victim is no longer evaluating only whether sending or receiving money makes financial sense. The victim is also evaluating what refusal supposedly says about love, commitment, trust, loyalty, or compassion. That emotional framing changes the decision.

Family members looking only at the financial facts can struggle to understand why the victim cooperated. They see a stranger asking to use a bank account. The victim did not experience the requester as a stranger.

The criminal constructed that difference deliberately.

Coercion Creates Another Form of Second-Party Involvement

Some people provide access under pressure rather than persuasion. An abusive partner can demand passwords and banking information. A criminal can threaten to release intimate images. A scammer can threaten the victim’s family, reputation, employment, or immigration status. Someone who has already lost substantial money can be told that continuing to cooperate is the only way to recover it.

The victim in such a situation can understand that another person is using an account while lacking meaningful freedom to refuse. That distinction matters when institutions or investigators assess the person’s behavior.

Coercion does not disappear because the customer typed the password personally. Emotional pressure does not become irrelevant because the customer clicked the transfer button.

This is another reason authentication records cannot tell the full story. They document actions. They do not document the psychological conditions under which those actions occurred.

Investigators need to understand the relationship surrounding the transaction, particularly where threats, intimate relationships, dependency, blackmail, or coercive control appear in the communications.

A Victim’s Position Can Change

One of the most uncomfortable aspects of second-party fraud is that a person’s position can change during the same criminal relationship.

A victim can begin with no knowledge of wrongdoing. The person believes the scammer and follows instructions. Later, doubts arise. A bank employee raises concerns. A family member identifies the relationship as fraudulent. An account closes. Another bank asks why money from strangers keeps arriving.

At first, the victim can reject those warnings because the criminal has already built strong emotional attachment and provided explanations for suspicious events. The victim remains psychologically invested in the relationship and can see the bank or family member as interfering rather than protecting.

But warnings accumulate.

There is a point at which investigators have to examine whether the person continued acting despite understanding what was happening. That determination cannot be made responsibly through a simple label. It requires evidence showing what information the person received, how clearly the risk was explained, what the person said afterward, and whether behavior changed.

A person who immediately stops after learning the truth presents one set of facts. Someone who opens replacement accounts after previous accounts were closed, lies repeatedly to bank employees, recruits other people, and continues moving money after explicit warnings presents another.

Victimhood and criminal participation are not mutually exclusive across time. A person can enter a scam as a victim and later make decisions that create separate questions of responsibility.

Why Financial Institutions Have Difficulty Detecting It

Traditional fraud controls are designed very effectively for many forms of unauthorized activity. An unknown device appears. A password is compromised. A card is suddenly used thousands of miles away. A customer reports that a transfer was never approved.

Second-party fraud behaves differently because the genuine customer can personally complete every security step.

The account holder logs in through a familiar device, approves the recipient, enters the authentication code, calls the bank when questioned, and confirms that the transaction is authorized. The institution is not dealing with an intruder impersonating the customer. It is dealing with a genuine customer whose decisions are being directed by another person.

Scammers can prepare victims for bank intervention. They explain that bank employees will ask intrusive questions or try to stop the transaction. They can instruct victims to conceal the real relationship and provide a safer explanation. A romantic payment becomes a home repair expense. A transfer for the scammer becomes money for a relative. Cryptocurrency supposedly becomes an investment made independently by the customer.

A bank employee now faces a customer who appears to insist on controlling personal money. Preventing the transaction can feel paternalistic, yet allowing it can expose the customer and other victims to greater loss.

Second-party fraud sits directly inside that conflict.

What Banks and Other Institutions Need to Understand

Financial institutions need to look beyond whether a transaction was authorized and consider whether another person appears to be directing the customer’s financial behavior.

A customer’s financial history provides context. Someone who has maintained predictable banking behavior for decades and suddenly begins receiving large transfers from unrelated strangers deserves attention. Rapid movement of those funds into cryptocurrency, overseas transfers, new beneficiaries, cashier’s checks, or cash withdrawals creates additional concern.

The explanation surrounding the activity matters just as much. A customer who says that an online romantic partner owns incoming funds but cannot explain why that person cannot receive the money directly presents a serious scam indicator. The concern grows when the customer has never met the supposed partner, has opened accounts at that person’s direction, or has been coached about what to tell bank staff.

Institutions also need to distinguish intervention from accusation. Treating a potentially manipulated customer like a criminal during the first conversation can strengthen the scammer’s control. The criminal may already have warned the victim that banks, family members, or authorities will try to interfere.

Questions should establish facts while preserving the possibility that the customer is being exploited. Who owns the incoming money? Who instructed the customer to receive it? How does the customer know the person? Why does that person require someone else’s account? Has the customer been asked to conceal the relationship or provide a different explanation?

Those questions expose the human structure behind the transaction.

Families and Advocates Need the Same Broader View

Families confronting a scam should not limit their financial review to money the victim lost. They need to determine what access the criminal obtained and what financial activity occurred through that access.

That means examining unfamiliar incoming deposits, checks, payment transfers, cryptocurrency transactions, packages, business registrations, new accounts, and financial services opened during the relationship. Families should also determine whether another person has login credentials, debit card information, PIN numbers, identification documents, authentication codes, recovery information, remote access software, or physical access to a device.

The conversation requires care because the victim can already feel ashamed, frightened, and defensive. Discovering that other people’s money passed through personal accounts can intensify those reactions dramatically.

Accusatory questioning can cause the victim to conceal information at exactly the moment when full disclosure becomes most necessary. The purpose is to establish what happened, what access remains active, and whether anyone else has been harmed.

A family does not need to decide whether a crime was committed by the victim. It needs to help stop continuing access, preserve evidence, and ensure that qualified institutions and authorities receive accurate information.

Law Enforcement Needs a Timeline, Not a Label

Second-party fraud becomes most understandable when investigators reconstruct the sequence of events.

The financial records establish where money went. Communications help establish why the account holder believed the money was moving. Bank warnings, account closures, family interventions, law enforcement contacts, and later transactions help establish how the person’s knowledge changed.

An investigator needs to know what explanation accompanied the first incoming payment and whether the victim knew the sender. The timing of later warnings matters because the person’s understanding at the tenth transfer can be very different from the understanding surrounding the first.

Messages can reveal whether the scammer coached the victim to lie, threatened the victim, manufactured explanations, promised financial recovery, or used emotional attachment to maintain cooperation. They can also reveal whether the person knew that money was stolen, discussed commissions, deliberately concealed activity, or recruited others.

That human timeline prevents two serious mistakes. It prevents a manipulated victim from being automatically treated as a knowing criminal simply because a personal account received stolen money. It also prevents someone who knowingly continued criminal activity from using original victimization as a permanent explanation for later conduct.

The history matters.

Second-Party Fraud Is a Fraud Classification, Not a Single Criminal Offense

The term second-party fraud describes a relationship between a genuine customer, another person using that customer’s access, and fraudulent activity connected with that access. In the United States, it is not itself the name of one criminal charge.

Legal consequences depend on the actual conduct and the evidence surrounding knowledge, intent, participation, coercion, and other facts. Depending on the circumstances and jurisdiction, knowingly helping move criminal proceeds can expose someone to investigation for offenses involving fraud, conspiracy, money laundering, or related conduct.

Financial institutions operate under a different set of responsibilities. A bank can restrict or close an account because the activity presents unacceptable fraud or compliance risk without making a criminal determination about the customer.

These distinctions matter because families sometimes interpret an account closure as proof that their relative has been declared a criminal. Victims can interpret an investigation the same way. Neither conclusion is necessarily correct.

The institution evaluates financial risk. Law enforcement investigates conduct. Prosecutors decide whether evidence supports charges. Courts determine criminal responsibility.

When a Scam Victim Discovers the Account Was Used

A victim who discovers that personal accounts, identity, devices, or credentials have been used to receive or move other people’s money needs to stop the activity and preserve the evidence surrounding it.

Messages should not be deleted because they are embarrassing. Those conversations can show what the criminal claimed, what the victim believed, what instructions were given, whether threats occurred, and when the victim began questioning the transactions. Bank statements, transfer receipts, cryptocurrency addresses, payment records, telephone numbers, email addresses, shipping records, photographs, identification information, and account instructions can all help reconstruct what happened.

The financial institution needs an accurate explanation. Appropriate law enforcement reporting should follow. When substantial funds belonging to other people have passed through an account, or when investigators have already contacted the victim, obtaining qualified legal advice can also be appropriate.

The temptation to improve the story can be strong. A victim can believe that admitting to providing a password, forwarding money, or concealing a relationship will make the situation worse.

Inventing a cleaner version can create a much greater problem.

The facts already exist in account records, communications, device histories, and transaction data. Accurate disclosure gives investigators and institutions the information needed to distinguish deception, coercion, poor judgment, continued denial, and deliberate participation.

Why Second-Party Fraud Matters to Scam Victims

Second-party fraud exposes one of the hardest truths about modern scams. Criminals do not always need to steal an identity or break into an account. Sometimes they can manipulate a legitimate customer into providing exactly what they need.

The victim’s identity becomes useful because it is genuine. The account becomes useful because it has history. The device becomes useful because the bank recognizes it. The victim becomes useful because the institution trusts that person’s authority to move personal money.

And the relationship becomes useful because the victim trusts the criminal.

That combination allows one victim’s legitimate financial life to become part of crimes committed against other victims. It also explains why second-party fraud deserves much greater attention in victim education, fraud prevention, family intervention, financial investigations, and law enforcement training.

The central question is not simply whether the customer authorized access. It is what the customer understood about that access, how the criminal obtained cooperation, what happened when warning signs appeared, and whether the person’s behavior changed as knowledge changed.

For a scam victim, that distinction can determine whether an unfamiliar deposit looks like evidence of good fortune or evidence that the criminal has already brought another victim into the room.

Conclusion

Second-party fraud deserves greater attention because it exposes a part of financial crime that does not fit comfortably into the familiar categories of stolen identity and unauthorized transactions. A legitimate customer can knowingly share access to an account, device, credential, or financial service while remaining completely deceived about the criminal purpose behind that access. The same person can later receive warnings, acquire additional information, and face a very different question about continued participation. Understanding that progression requires attention to knowledge, intent, coercion, manipulation, and the sequence in which information became available.

For scam victims, the danger extends beyond personal financial loss. A criminal can turn a victim’s legitimate identity, established bank account, trusted device, and good financial history into tools for moving money stolen from other victims. Relationship manipulation makes this especially dangerous because financial instructions arrive through someone the victim believes is trusted, loved, or dependent upon them. What appears externally to be suspicious cooperation can initially feel like helping someone important.

Families and advocates need to examine incoming money as carefully as outgoing payments. Financial institutions need to recognize that successful authentication does not prove that a customer understood the true purpose of a transaction. Law enforcement needs the human timeline behind the account activity, including what the person believed, what warnings were received, whether coercion existed, and how behavior changed afterward.

Second-party fraud cannot be understood responsibly through a single transaction or label. The account can be genuine while the purpose is fraudulent. The customer can authorize the action while being deceived about its meaning. And a victim’s position can change as knowledge changes. Recognizing those distinctions protects exploited people without excusing deliberate participation and gives investigators, institutions, families, and advocates a clearer picture of how criminal networks use real people to move fraudulent activity through legitimate financial systems.

Glossary

• Account Access Sharing — Account access sharing occurs when a legitimate customer permits another person to use a financial account, device, password, payment service, or related credential. Shared access can be innocent when it supports legitimate assistance, but it becomes dangerous when another person uses that access for deception or criminal activity. Scam victims can knowingly share access while remaining unaware of the fraudulent purpose behind the activity. — Financial Access Risk
• Account Authentication — Account authentication is the process through which a financial institution confirms that a recognized customer is accessing or approving activity on an account. Successful authentication does not prove that the customer understands why a transaction is occurring or whose interests it serves. A scammer can manipulate a legitimate customer into completing every authentication step personally while the criminal controls the purpose of the transaction. — Institutional Fraud Risk
• Account Closure Risk — Account closure risk arises when suspicious financial activity causes an institution to end its relationship with a customer. A scam victim whose account has been used to receive or transfer unfamiliar funds can face closure even when the person originally acted under deception. Repeated closures also change the person’s informational position because they provide increasingly strong warnings that the activity is unsafe or suspicious. — Financial Consequence
• Account Direction by Another Person — Account direction by another person occurs when a legitimate customer continues to control an account technically while another individual determines how the money, credentials, or services are used. Scam victims can personally log in, approve recipients, and enter verification codes while following instructions supplied by a criminal. This arrangement makes second-party fraud difficult to detect because the institution sees a genuine customer performing genuine account actions. — Scam Tactics
• Account Restriction — Account restriction occurs when a financial institution limits transactions or access because activity appears suspicious or presents unacceptable risk. A restriction can become an important warning to a scam victim that account activity has departed from normal patterns. It does not by itself establish criminal guilt, but it signals that the institution has identified a serious concern requiring review. — Institutional Risk Control
• Accurate Financial Disclosure — Accurate financial disclosure means providing banks, investigators, attorneys, or other appropriate authorities with a truthful account of how money, accounts, credentials, or devices were used. Scam victims can feel tempted to hide embarrassing details such as password sharing, unusual deposits, or transfers made for a criminal. Accurate disclosure helps others distinguish deception, coercion, poor judgment, continued denial, and deliberate participation. — Evidence and Reporting
• Authentication Code Sharing — Authentication code sharing occurs when a customer gives another person a temporary security code that was intended to verify account access or a transaction. A scam victim can knowingly provide the code while believing a false explanation about why it is needed. Criminals benefit because the customer helps them pass a security control that would otherwise block access. — Financial Access Risk
• Authentication Mechanism for the Criminal — Authentication mechanism for the criminal describes a situation in which a legitimate customer becomes the means by which a scammer passes an institution’s security controls. The criminal does not need to defeat authentication technically when the customer can be persuaded to complete it. This changes fraud detection because authorized account activity can still serve a criminal purpose. — Scam Tactics
• Authorized Transaction — An authorized transaction is a financial action approved by the person who legitimately controls the account or payment service. Authorization confirms that the customer permitted the transaction, but it does not prove that the customer understood the true source, destination, or purpose of the money. Scam manipulation can produce authorized transactions based on false information supplied by a criminal. — Financial Transaction Risk
• Bank Intervention — Bank intervention occurs when financial institution staff question, delay, restrict, or stop activity that appears inconsistent with a customer’s normal behavior or presents signs of fraud. Scam victims can interpret intervention as interference when a criminal has already prepared them to distrust bank employees. Effective intervention seeks facts while preserving the possibility that the customer is being manipulated rather than deliberately committing fraud. — Institutional Fraud Prevention
• Bank Warning — A bank warning is information given to a customer indicating that a transaction, recipient, relationship, or account pattern appears suspicious. The first warning can conflict sharply with a scam victim’s belief in the criminal’s story, especially after strong emotional attachment has formed. Repeated warnings change what information the person possesses and become relevant when later conduct is evaluated. — Fraud Awareness
• Coached Bank Explanation — A coached bank explanation is a false or misleading account of a transaction that a scammer instructs a victim to give financial institution staff. The criminal can tell the victim to describe a romantic payment as a home expense, family transfer, personal investment, or another ordinary transaction. Such coaching helps the scammer preserve control while preventing bank employees from seeing the relationship behind the payment. — Scam Tactics
• Criminal Purpose of Access — Criminal purpose of access refers to the fraudulent objective behind another person’s use of a legitimate identity, account, device, credential, or financial service. A customer can understand that access has been shared without understanding that the access serves fraud, theft, laundering, or concealment. Distinguishing knowledge of access from knowledge of its criminal purpose is central to understanding second-party fraud. — Fraud Classification
• Deliberate Participation — Deliberate participation occurs when a person understands that financial access or transactions support criminal activity and continues assisting intentionally. Examples include accepting payment to move criminal proceeds, opening multiple accounts for criminals, supplying credentials with knowledge of their purpose, or recruiting additional participants. This conduct occupies a very different position from initial participation based on deception. — Criminal Participation
• Device Access — Device access refers to permission or control that allows another person to use a customer’s telephone, computer, tablet, or other device connected with financial services. A familiar device can help fraudulent activity appear legitimate because institutions recognize its previous history. Scam victims should understand that giving another person control of a trusted device can expose multiple accounts and security functions at the same time. — Digital Access Risk
• Evidence Preservation — Evidence preservation involves keeping messages, bank statements, transaction receipts, cryptocurrency addresses, photographs, telephone numbers, emails, shipping records, and other material connected with suspicious activity. Embarrassing communications can show what a criminal claimed, what the victim believed, and whether threats or coaching occurred. Deleting those records can remove information needed to reconstruct deception, coercion, knowledge, and the sequence of events. — Verification Practice
• Financial Access Sharing — Financial access sharing occurs when a legitimate customer gives another person some ability to use an account, payment service, credential, card, or device. The sharing itself does not establish fraud because families and trusted individuals sometimes share access for legitimate reasons. Risk develops when the person receiving access uses it for fraudulent activity or when the customer begins following criminal financial instructions. — Financial Access Risk
• Financial History as Criminal Cover — Financial history as criminal cover describes the advantage criminals receive when they operate through an established customer with years of normal banking activity. A long-standing account, genuine address, valid identification, established credit, and familiar devices can make suspicious activity appear less immediately abnormal. Scam victims become attractive intermediaries partly because their legitimate histories provide criminals with credibility they cannot easily create themselves. — Financial Crime Tactics
• Financial Intermediary Role — A financial intermediary role develops when a person receives, transfers, converts, withdraws, or forwards money on behalf of someone else. A scam victim can occupy this role without realizing that the funds belong to another victim or originate in criminal activity. Criminal networks use intermediaries to place distance between stolen money and the people controlling the fraud. — Money Movement
• Financial Relationship Abuse — Financial relationship abuse occurs when a criminal exploits a legitimate customer’s established relationship with a bank, payment provider, cryptocurrency service, or other institution. The institution trusts the customer because the identity and account history are genuine. The criminal takes advantage of that trust by persuading the customer to perform transactions or share access for fraudulent purposes. — Financial Crime
• Fraud Classification — Fraud classification describes the way institutions and investigators organize fraudulent behavior according to how customers, outsiders, identities, accounts, and access are involved. Second-party fraud identifies a relationship between a genuine customer, another person using that customer’s access, and fraudulent activity. The classification describes the structure of the activity rather than serving as the name of a single criminal offense. — Fraud Classification
• Fraud Proceeds Movement — Fraud proceeds movement refers to receiving, forwarding, converting, withdrawing, or otherwise transferring money that originated in fraudulent activity. A scam victim can move these funds while believing they belong legitimately to the criminal or another person identified by the criminal. The movement becomes especially significant when unfamiliar money enters a personal account and leaves quickly under someone else’s direction. — Money Movement
• Genuine Customer — A genuine customer is a real person who legitimately established a relationship with a financial institution using an authentic identity. Second-party fraud creates difficulty because the customer can remain genuine even while account activity serves another person’s criminal purpose. Security systems designed primarily to identify impersonation can struggle when the recognized customer personally approves the suspicious activity. — Institutional Fraud Risk
• Genuine Identity — A genuine identity is an authentic personal identity belonging to the actual customer rather than an identity stolen or fabricated by a criminal. Criminals can gain substantial value by persuading a real person to let that identity support accounts, transactions, devices, or financial services. The authenticity of the identity can make the resulting activity harder to distinguish from normal customer behavior. — Identity Exploitation
• Genuine Payment Service Access — Genuine payment service access occurs when a real customer legitimately controls a banking, payment, or cryptocurrency service but permits another person to direct or use that access. The institution sees an authentic customer relationship rather than a fabricated account. Criminal misuse can remain hidden because the financial access itself was created legitimately before the scammer became involved. — Financial Access Risk
• Incoming Funds Review — Incoming funds review is the examination of money entering a scam victim’s accounts, especially transfers involving unfamiliar people, companies, checks, payment services, or cryptocurrency sources. Families can focus so heavily on money the victim lost that they overlook funds the victim received and forwarded. Reviewing incoming transactions can reveal that a victim’s account became part of a broader fraud operation involving other victims. — Financial Investigation
• Informational Position — Informational position describes what a person knew, had been told, or had reason to understand at a particular point in the sequence of suspicious activity. A person completing an initial transaction under deception occupies a different informational position after banks, relatives, or investigators have provided repeated warnings. Changes in informational position help explain why responsibility cannot be evaluated accurately without considering chronology. — Knowledge and Intent
• Knowledge of Access — Knowledge of access means that a customer understands another person has been given permission, credentials, device control, or financial access. This knowledge does not automatically mean the customer understands that the other person intends to commit fraud. Scam victims can knowingly share access because they trust a romantic partner, supposed employer, friend, or other manipulated relationship. — Knowledge and Intent
• Knowledge of Fraud — Knowledge of fraud refers to understanding that an account, transaction, payment, identity, or credential is being used for criminal activity. This differs from merely knowing that another person has access or that money is being transferred. Investigators need evidence showing when a person understood the fraudulent purpose before evaluating later participation. — Knowledge and Intent
• Law Enforcement Timeline — A law enforcement timeline reconstructs how a scam relationship, financial activity, warnings, account closures, communications, and later behavior developed over time. It helps investigators compare what the person believed during early transactions with what the person knew after receiving stronger evidence. This chronology can distinguish initial deception from later knowing participation. — Investigative Practice
• Legitimate Assistance — Legitimate assistance occurs when one person helps another manage financial activity for a lawful and honest purpose. A spouse paying a household bill or an adult child helping an elderly parent with online banking does not become fraudulent merely because access is shared. The distinction depends on the purpose of the access and how it is actually used. — Financial Relationship
• Legitimate Financial Relationship — A legitimate financial relationship is an authentic customer connection with a bank, payment provider, cryptocurrency service, or other financial institution. Scam criminals value these relationships because established customers have trusted identities, familiar devices, and histories of normal transactions. Criminals can exploit that legitimacy without having to create a fraudulent identity themselves. — Financial Relationship
• Money Mule Activity — Money mule activity occurs when a person receives or transfers money on behalf of another person, allowing funds to move farther away from the people controlling the underlying fraud. Some participants understand the criminal purpose, while others begin under deception created through fake employment, relationship scams, or fabricated financial explanations. The mule function describes how money moves and does not by itself establish what the person knew. — Financial Crime
• Other Victim Funds — Other victim funds are money stolen or obtained from one victim and then routed through the account of another person. A scam victim can believe such money belongs to a romantic partner, employer, business associate, or other person described by the criminal. Discovering these funds can reveal that the victim’s financial identity was used in crimes against additional people. — Financial Harm
• Payment Processing Scam — A payment processing scam uses a false job, business arrangement, relationship, or other explanation to persuade a person to receive and forward funds. The person can believe that processing payments is legitimate work while serving as an intermediary for stolen money. The arrangement becomes especially dangerous when the person is allowed to keep part of the transferred funds. — Scam Tactics
• Personal Financial Identity — Personal financial identity refers to the combination of a person’s authentic identity, accounts, banking history, devices, credentials, and established customer relationships. Criminals can exploit this identity without stealing it if they persuade the person to provide access willingly. A scam victim can later discover that personal financial credibility was used to support transactions involving other victims. — Identity Exploitation
• Relationship-Based Account Access — Relationship-based account access occurs when a person shares financial access because of trust created within an intimate, family, friendship, or other close relationship. Scam criminals can spend months creating attachment before asking to use an account or receive money. The request can appear to be an ordinary favor because the victim no longer experiences the requester as a stranger. — Emotional Manipulation
• Relationship-Based Financial Direction — Relationship-based financial direction occurs when a trusted or supposedly trusted person tells another person how to receive, transfer, withdraw, convert, or conceal money. Relationship scammers can frame cooperation as evidence of love, loyalty, commitment, or compassion. This emotional framing changes how a victim evaluates a financial request that would appear suspicious if it came from an unknown person. — Emotional Manipulation
• Replacement Account Opening — Replacement account opening occurs when a person creates new financial accounts after previous accounts have been restricted or closed because of suspicious activity. This behavior becomes significant when the person has already received warnings explaining why earlier transactions were dangerous. Investigators can examine replacement accounts as part of determining whether participation continued after the person’s knowledge changed. — Investigative Indicator
• Second-Party Fraud — Second-party fraud occurs when a genuine customer knowingly provides another person with access to an identity, financial account, device, payment service, credentials, or other legitimate financial relationship that becomes involved in fraudulent activity. The customer can be deceived about the true criminal purpose even while knowingly sharing access. Understanding the person’s knowledge, intent, coercion, warnings, and later behavior is necessary for distinguishing victimization from deliberate participation. — Fraud Classification
• Shared Device Access — Shared device access occurs when a customer allows another person to use a telephone, computer, tablet, or other device connected with financial accounts. Such access can be harmless in ordinary family assistance but dangerous when a criminal gains control of authentication, account recovery, or payment functions. Familiar devices can also make suspicious activity appear more consistent with the customer’s established behavior. — Digital Access Risk
• Source of Funds — Source of funds identifies where money originated before entering a customer’s account or payment service. Scam victims can receive money while believing a criminal’s false explanation that it represents wages, business payments, debt repayment, inheritance, investment proceeds, or family funds. Determining the actual source can reveal that money belonged to another fraud victim. — Financial Investigation
• Spectrum of Second-Party Involvement — Spectrum of second-party involvement describes the progression between legitimate assistance, deceived participation, growing suspicion, reckless continuation, and deliberate criminal cooperation. Different people can perform similar transactions while possessing very different levels of knowledge and intent. The spectrum prevents investigators, families, and institutions from assuming that every authorized suspicious transaction represents the same level of responsibility. — Fraud Assessment
• Suspicious Incoming Deposits — Suspicious incoming deposits are payments entering an account from people, companies, or sources that do not fit the customer’s ordinary financial activity. Scam victims can interpret these deposits as proof that a criminal’s story is legitimate, especially when the criminal previously claimed to possess substantial resources. The funds can instead represent money stolen from another victim and routed through the account. — Financial Investigation
• Transaction Authorization — Transaction authorization is the customer’s approval of a financial action, such as adding a recipient, entering a security code, or confirming a transfer. Authorization proves that the account holder permitted the action but does not establish informed understanding of the transaction’s criminal purpose. Second-party fraud frequently exploits this difference between customer approval and customer knowledge. — Financial Transaction Risk
• Transaction Purpose — Transaction purpose describes the actual reason money is being received, transferred, withdrawn, converted, or sent. A scammer can give a victim one explanation while the real purpose is to move stolen funds or conceal criminal ownership. Financial institutions and investigators need to examine purpose separately from whether the account holder personally authorized the transaction. — Financial Investigation
• Transaction Sequence — Transaction sequence is the chronological order in which deposits, transfers, warnings, account restrictions, communications, and later financial actions occurred. Sequence matters because a person’s understanding can change between an early transaction and later activity. Investigators who reconstruct the sequence can evaluate how deception, warnings, and continued behavior developed over time. — Investigative Practice
• Unfamiliar Beneficiary — An unfamiliar beneficiary is a recipient added to an account who does not fit the customer’s previous financial relationships or normal transaction pattern. Sudden transfers to unfamiliar recipients can become more concerning when they follow incoming payments from strangers or instructions supplied by an online relationship. Financial institutions can use this change as part of a broader assessment of possible second-party fraud. — Institutional Fraud Indicator
• Unwitting Financial Participation — Unwitting financial participation occurs when a person performs actions that support fraud without understanding the criminal purpose behind those actions. A victim can receive and forward money, provide credentials, or open an account while believing a false explanation supplied by someone trusted. The person’s role must be evaluated according to what was known at the time rather than solely according to what investigators discover later. — Victim Exploitation
• Victim-to-Participant Progression — Victim-to-participant progression describes how a person can enter a criminal relationship as a deceived victim and later face different questions about continued conduct as warnings and knowledge accumulate. The progression does not occur automatically, and original victimization does not prove later criminal intent. Investigators examine whether behavior changed after the person received information showing that the activity was fraudulent. — Knowledge and Intent
• Warning Accumulation — Warning accumulation occurs when multiple banks, relatives, investigators, account closures, transaction refusals, or other events repeatedly signal that financial activity is suspicious. Each warning adds information that can alter how a person understands the situation. Continued activity after clear and repeated warnings creates a different factual record from activity performed before those warnings existed. — Fraud Awareness