Four things a fraudster needs
A framework drawn from the cases and patterns on this site, not a checklist every scam must meet or a diagnosis of a person. Disrupting one of these elements can make a scam harder to carry out, but does not guarantee protection.
1. Identity
The fraudster needs a name, a role or an identity document that the other person will trust, genuine or forged. In the digital-doubles case, verification involved video, a selfie and an image of an ID. An attacker able to generate all three could pass the same checks as a genuine customer.
What you can do: periodically check for accounts or credit applications in your name and review your credit report. A credit application you did not make is a warning sign.
2. A controlled channel
The fraudster needs verification to happen somewhere they control: a call, message or website of their choosing. In the Telegram case, the conversation moved to a private channel. In the Texas licence case, changed contact details meant later alerts did not reach the victim.
What you can do: disconnect and call a number you found independently. Do not dismiss an alert from your bank about changed contact details as spam.
3. Pace and emotion
The fraudster needs the victim to act before they have time to think: urgency, fear, shame or hope. The analysis on this site is that, in many scams, emotion moves before money does. In an advance-fee loan scam, the initial sum can be set low enough not to feel significant.
What you can do: slow down. Give yourself time to verify the story independently. Intense urgency is a reason to pause.
4. Infrastructure and documents
The fraudster needs a request that looks legitimate. In the property-investment case, the document itself is part of the product. In the Singapore case, ordinary-looking steps combine into a request that passes scrutiny.
What you can do: check with an independent source, not only the material supplied by the other party. Before investing, ask who the registered owner is, whether the promise makes sense and where the money will go.
Mechanisms
Each case on the site has one or more mechanism tags. The tag is an editorial interpretation based on the case text, not a finding about a person. The case archive can be filtered by topic.
Exploiting identity
Stolen or fabricated identity details used to seek a loan, mortgage or bank account. The attacker enters through the front door with an ID.
Your identity is worth a lot of money. The question is: to whom?
A NIS 1.2 million mortgage on their home, without a single signature
Suspected digital-identity fraud: using AI and stolen identities to open bank accounts
The SIM swap: how a phone number became the key to a bank account
A forged temporary licence, two loans and vehicle finance: an identity-fraud case from Texas
One step away from $2.9 million: the fraud that began with a land-authority letter
Impersonating authority
The scammer claims to represent a bank, card company, the police or a government body. People tend to comply with someone who sounds official.
"Your account has been hacked": the anatomy of bank impersonation
Your loan is approved, just one small payment: the anatomy of an advance-fee loan scam
The money taxi: the courier collecting the cash was booked through an app
The fraudster does not break down the door. They get you to open it
Controlling the channel
The other party chooses the phone, message or website, and therefore what you see. Verification takes place in the channel they selected.
"Your account has been hacked": the anatomy of bank impersonation
The SIM swap: how a phone number became the key to a bank account
The Telegram trap: a date that led to extortion of more than half a million shekels
A forged temporary licence, two loans and vehicle finance: an identity-fraud case from Texas
Professional preparation and infrastructure
Fraud built as a project: documents, companies and official paperwork. Each step looks ordinary; together they make a request look clean.
NIS 44 million raised using forged documents: the anatomy of a property-investment fraud
One step away from $2.9 million: the fraud that began with a land-authority letter
The front person
A deal is in one person's name, but someone else holds substantial control or receives the money.
The straw borrower: a loan in one name, the risk in another
The straw borrower: your signature, their loan
Division of work
Several people form a chain, with no one directly meeting the victim. Whoever collects the money does not necessarily know who sent them.
The money taxi: the courier collecting the cash was booked through an app
Building trust and emotion
Fear, shame or hope can come before the request for money. Pausing to recognise the emotional pressure can help you protect your money.
The Telegram trap: a date that led to extortion of more than half a million shekels
In many scams, emotion comes before money
Selecting a victim
Some scams deliberately select a target; others use mass or random approaches. In each documented case, check for evidence of deliberate selection, such as prior knowledge of the property owner or their circumstances, rather than assuming it.
How fraudsters choose a victim, and why it is not always chance
A NIS 1.2 million mortgage on their home, without a single signature
The money taxi: the courier collecting the cash was booked through an app
The fraud glossary
Terms recurring in the site's cases and patterns, and in official warnings. Each term includes a brief definition, how it appears, what to check and a source. Details rely on a published site case or an official page listed beside the term, checked in the Hebrew review on 20 October 2026. This is not legal advice. Case descriptions preserve reported allegations or suspicions, not court findings. The translation is not a fresh source audit.
Social engineering
In the Bank of Israel definition quoted in the case, a psychological attack exploits innocence, lack of knowledge or a wish to help. There is no technological answer to an attack aimed at human weakness.
What it looks like: No technical system is breached. A call, message or reasonable-sounding request reaches a person. In case #004, the impersonator obtained a username and password from someone who believed their account had been hacked, rather than breaking into it.
What to check: Who initiated contact, and what am I being asked to do now? Requests for codes, passwords or card details are the signal, regardless of the story's quality. The Bank of Israel says banks and card companies do not ask customers for identification and authentication details.
Source: Related case or behavioural pattern
Impersonating an authority
The scammer assumes the authority of a bank, card company, police or government body. Apparent official status does some of the persuasion.
What it looks like: The Bank of Israel warns of people posing as representatives of banks, card companies, the central bank and police, sometimes sending forged police IDs or central-bank letters. Case #004 used changing roles: bank representative, security, bank manager.
What to check: Authority is not verification. Hang up an unsolicited approach and reconnect through a channel you found yourself. See Callback.
Source: Related case or behavioural pattern
Channel control
The impersonator chooses the phone, message or website and therefore what you see. Verification happens inside their chosen channel. Familiar caller ID is not verification.
What it looks like: The Chameleon pattern involves borrowed identity, channel control and pace-setting. A bank name appears on the screen and the caller knows your name. The Bank of Israel warns about forged addresses and numbers resembling the bank's.
What to check: Who initiated contact and chose the channel? Do not verify through a channel the other party controls.
Callback: returning through an official channel
Hang up, then dial the number on your card or official website yourself. This moves verification outside the caller's control. A genuine story can wait five minutes.
What it looks like: The Bank of Israel recommends supplying identifying details only after calling the institution's line at a number you found on its site. The Russian-language gov.il guidance also says to hang up and dial the official number yourself.
What to check: Find the number independently, not in the received call or message. Do not continue a call by dialling "the number just sent to you." This last point is the site's inference from the rule, not a quotation.
Source: Related case or behavioural pattern
Overwhelming emotional pressure
An urgent problem triggers fear: a hacked account, stuck parcel or card about to be blocked. Emotional pressure comes before the transfer of money.
What it looks like: The Bank of Israel describes threats, intimidation and pressure about hostile activity or an urgent bank-server fault. gov.il lists phrases such as "It is urgent" and "If you hang up, harm will follow."
What to check: Stop. Urgency is a scammer's tool. Someone genuinely handling an account can wait for a callback.
Source: Related case or behavioural pattern
Straw borrower
Someone allows a loan controlled by another person to be taken out in their name. If payments stop, the loan remains their legal debt. This is a general explanation, not legal advice.
What it looks like: Often someone familiar says: "Take a small loan in your name; I will repay it." In the site's explainer, the signature is the commodity and promised money is the bait. Once payments stop, only one name remains on the loan.
What to check: Who will actually repay? Who uses the money? Why do the details fail to fit? Someone genuinely helping usually does not need you to sign a loan in your name.
A specific legal assessment requires a lawyer. See the straw-loan explainer and case #011, the straw borrower.
Front person
A deal uses one person's name while someone else holds substantial control. Do not confuse knowing cooperation, exploitation and legitimate assistance such as power of attorney.
What it looks like: In the hypothetical pattern, paperwork and signature are complete, but the signer cannot explain the deal. Another person answers most questions. The stopping point is a gap between intention, identity and money movement.
What to check: Distinguish the name on the documents from whoever manages, decides or benefits.
Another person's involvement does not prove fraud. Each case stands on its facts. The pattern scenario is hypothetical.
Advance fee
An upfront payment demanded after an unverified approach calls for checking. A fee alone does not prove fraud: examine who charges it and on what terms.
What it looks like: In the allegations in case #008, people posing as loan-company representatives gathered details, announced approval and demanded a percentage as an "application fee." After payment, the representative disappeared. These are suspicions and the proceedings were not concluded in the source.
What to check: Who approached whom? Who takes the fee, under what conditions? A regulated lender does not hand out ready approvals by unsolicited phone call.
The site interprets that people seeking non-bank loans may have already been refused, weakening scrutiny. This is interpretation, not a finding.
The document as the product
In some scams the product is a polished contract or "partnership" letter. Check independently with a land registry or alleged partner, rather than inspecting only the document.
What it looks like: The indictment in case #010 alleged forged documents, fictitious cooperation with known organisations and promised returns. An indictment is an allegation; defendants are presumed innocent.
What to check: Contact the independent source: land registry, alleged partner, trust account. Professional-looking paperwork is not proof.
Red flag
A signal to stop and check, not proof. One indicator is a reason to investigate, not grounds for accusing someone. Example: the same photo on two different IDs.
What it looks like: In case #002, the family alleged identical ID and driving-licence photos inconsistent with birth dates, and a mortgage registered soon after a break-in. These are lawsuit allegations. The company rejected similar claims in another case and said proceedings would be heard in court.
What to check: One warning sign is a reason to investigate. Several in one transaction justify pausing and clarifying with the official body.
Planned versus opportunistic
Advance purchases, target selection, recurring sequences and reused infrastructure contrast with taking a one-off opportunity.
What it looks like: The Professional pattern treats fraud as a project: knowledge of the target, answers to objections, and websites, documents or references as a setting. Trust serves the financial request.
What to check: Infrastructure such as domains, references and accounts may be the strongest evidence because it predates the first victim meeting.
These are things to examine, not conditions all scams must meet or an offender-identification test.
Neutralisation techniques
Justifications for an offence, such as denying harm or responsibility. A framework for examining justifications, not knowing a person's self-talk without evidence.
What it looks like: The site uses this only as a hypothesis. "It is only a loan, I will repay it" is a hypothetical illustration, not an interview quotation.
What to check: Without evidence of a particular person's thought or intent, it remains a hypothesis.
Possible interpretation, not diagnosis. See the Operator and Front Person patterns.
Coordinators and people moving the money
The Police Foundation report cited by the site describes coordinating cores alongside peripheral service providers and money movers, not a fixed hierarchy.
What it looks like: Its 25 serious UK fraud investigations identified 104 people; some worked separately. In Utica, 42.4% of 517 identity-theft cases, 219 cases, involved two or more offenders, ranging from 2 to 45.
What to check: Map who gave instructions, when contact started and where money went. Do not assume a peripheral actor does not know the operator.
These are UK and Utica research figures, not Israeli data.
SIM swap
The attacker approaches the mobile operator and gains control of the number and its incoming codes. When identification relies on phone codes, control of the number matters. Sudden unexplained signal loss is an early warning.
What it looks like: In case #005, a 71-year-old British businessman lost control of his number; about £250,000 was stolen from his account, according to Cheshire Police reporting carried by the BBC. The target was the mobile provider rather than the bank. The Bank of Israel review says line takeover commonly uses fraudulent porting or remote-control software.
What to check: If signal disappears without explanation, call the provider from another device immediately, then the bank. Prefer app-based authentication over SMS where possible.
The case's nearly 3,000 cases in 2024 versus 289 a year earlier concerns the UK only.
Moving to a private channel
Moving from a public platform to a private, anonymous channel without witnesses or a record. In the Telegram case, this is the first move.
What it looks like: The indictment in case #009 alleged fake Telegram profiles lured men to meetings where an ambush replaced a date. These are indictment allegations; defendants are presumed innocent.
What to check: When moved from a recorded platform to an anonymous channel, pause and ask why.
Dispersal of funds
Dividing stolen money into medium-sized transfers, sometimes with innocent descriptions, and purchases of assets easily converted back to cash.
What it looks like: According to documentation published in ynet for case #004: thousands and tens of thousands of shekels transferred to different people, NIS 14,000 described as "birthday for a friend who helped me," and NIS 20,000 for a car through three transfers.
What to check: Trace who received funds, when and where they went next. An innocent transfer description proves nothing.
This is the site's interpretation of the published records in this case, not a description of every scam.
Repeat targeting of a victim
Someone already scammed may be targeted again. The impersonator does not necessarily disappear after the first harm.
What it looks like: In case #004, the impersonator kept calling after the account was frozen, asking for the new password and instructing a vehicle-app download and licence photo "to return the money." The FTC also describes imposters buying lists of previously deceived people and approaching them with recovery promises.
What to check: Treat a recovery call like the initial approach: who initiated it and what do they want? This is the site's inference from the case.
One case description, not a rule about every victim. General-pattern source: FTC Refund and Recovery Scams.
Phishing
A suspicious message asks for personal details such as card information, password or code, or urges opening a link or file. The National Cyber Directorate describes it as an easy, common way to begin a cyberattack.
What it looks like: gov.il lists aims such as collecting personal details, downloading malware, stealing money or information and taking over accounts. Its page includes warning signs and a quiz.
What to check: If unsure, do not click. Open the official service or app yourself. The Bank of Israel advises against signing in through an SMS or email.
Vishing
Telephone phishing: a caller impersonates a familiar body to obtain login details or money.
What it looks like: A 2020 Cyber Directorate alert described calls appearing to come from an organisation's IT department, asking staff for remote-login credentials. The Bank of Israel review lists phishing and vishing among prominent 2024 fraud patterns.
What to check: The apparent origin does not verify a request. Hang up and contact the department or organisation officially.
Spoofing
A call or message looks like it came from a bank or another body, but its number or address is forged.
What it looks like: The Bank of Israel warns about messages sent from apparently legitimate addresses and forged numbers resembling a bank's.
What to check: The display is not proof. Familiar caller ID is not verification.
One-time code
A code sent by SMS or an app to approve an action or login. Someone receiving it may perform that action as you.
What it looks like: The Bank of Israel says banks and card companies will not request code details in calls the customer did not initiate. gov.il says genuine representatives will not request one-time codes, passwords, card details or personal-document photos by phone.
What to check: Do not give unsolicited contacts one-time codes or enter them into a link received in a message. Verify through a channel you chose.
Spoofed website
A site imitates a bank or official organisation to collect login and card details.
What it looks like: The Bank of Israel warns messages may link to imitation sites. It recommends checking address spelling, especially when signing in after searching with a search engine.
What to check: Use an address you typed yourself or the official app, not a received message link.
Remote access software
An app lets someone on the other end see or operate your phone or computer.
What it looks like: gov.il calls requests to install an app, click a link, share a screen or permit device access a clear warning. The Bank of Israel warns against installing remote-control software.
What to check: Do not install or grant access at the caller's request. Hang up and check with family or the official body.
The "safe account" claim
A claim that your money is in danger and must move to another account for protection.
What it looks like: gov.il says attackers may claim an account was hacked, a loan taken in the victim's name, suspicious activity detected, or a transfer to a "safe account" is needed.
What to check: Do not transfer money or act during the call. Contact your bank only through its official number.
AI voice cloning / deepfake
AI tools imitate another person's voice or face.
What it looks like: gov.il warns attackers may clone a voice to sound like a genuine relative. The Bank of Israel's 2024 review describes growing use of AI for voice and visual impersonation.
What to check: Do not rely on voice alone. Hang up and call your relative at their usual known number.
Family code word
A word known only to family, agreed in advance for emergencies.
What it looks like: gov.il suggests a simple family rule: do not act under pressure, hang up and call the relative's known number. A code word may be added. If agreed, ask for it.
What to check: Discuss this with parents and grandparents before a suspicious call happens.
Secrecy as a warning sign
A demand to keep the conversation secret forms part of the pressure.
What it looks like: gov.il lists "Tell no one," "Do not involve family," "It is urgent" and "If you hang up, harm will follow" as warning signs.
What to check: Tell a relative, neighbour, caregiver or trusted person immediately. Do not face the call alone.
Promise of money, a prize or an attractive investment
An approach promises money, lottery winnings or an attractive investment to obtain details or account access.
What it looks like: The Bank of Israel describes promises of money or lottery winnings and claims that account login is needed for an attractive investment. The indictment in case #010 alleged 8-11% returns in one project and 26% within three months in another.
What to check: Which organisation is making the offer? Is it regulated? Where can that be verified independently? Guaranteed returns call for checking.
Case figures are indictment allegations. Defendants are presumed innocent.
Two-factor authentication
An additional verification layer beyond a password. The Cyber Directorate recommends it for email access.
What it looks like: If the code comes by SMS and an attacker controls the number through SIM swapping, this protection fails. In case #005, codes reached the attacker along with other messages.
What to check: Prefer app-based verification to SMS where possible, as discussed in case #005.
Where to report in Israel
The Hebrew source recorded the following as checked against Bank of Israel and gov.il on 20 October 2026. This translation is not a new availability check.
- Police emergency: 100. Information: 110.
- National Cyber Directorate: 119 for cyber incidents such as phishing. This does not replace reporting to police.
- Bank or card company: a fraud-reporting line operating 24/7 under Proper Conduct of Banking Business Directive 426. Each institution's numbers are on the Bank of Israel list.
Intelligence in fraud prevention
Intelligence is a process of collecting, analysing and sharing information with the person who needs to decide. These are general concepts, not an account of any organisation or its working methods.
Types of intelligence
- HUMINT, Human Intelligence: information from people, such as sources, witnesses or someone with first-hand knowledge of a case. In fraud, often a conversation with the victim or someone who witnessed events from within an organisation.
- SIGINT, Signals Intelligence: information from communications and electronic signals. In a civilian context, for example, analysing messages and communications data where permitted by law.
- VISINT, Visual Intelligence: information from images, aerial photographs and video: what is visible, what a detail conceals, and what can be verified.
- OSINT, Open-Source Intelligence: information from public reporting, social media and public databases. It is available to everyone; the challenge is assessing reliability and meaning.
The intelligence cycle
- 1. Information needs: define the question before searching for an answer.
- 2. Collection: gather information from different sources and preserve where each detail came from.
- 3. Research: analyse data and look for patterns and connections.
- 4. Assessment: evaluate how much each detail can be trusted and what it means.
- 5. Dissemination: communicate conclusions clearly to the decision-maker.
How intelligence helps prevent fraud
- Complete the picture: apparently unrelated details gain meaning when connected.
- Cross-check information: the same name, number or method across incidents can point to a connection.
- Spot risks early: understanding the pattern can help identify a threat and prevent further harm.
Why not everything is public
- Protecting sources: exposure may endanger them.
- Protecting methods: someone who knows how they are identified can learn to evade detection.
- Privacy and proper process: not all information may lawfully be collected.
Method and sources
The site presents three kinds of content. For each, I mark what is known and what is interpretation.
Cases
Analysis of an event reported in the press or a public source. Each case ends with its source and date. There is no confidential information, client details or workplace case material here.
Insights
Short explanatory articles about mechanisms that recur in fraud. They explain an idea, rather than describe a particular event.
Patterns
The "How fraudsters operate" section contains six patterns of behaviour, not personality types. It does not diagnose people. Any scenario not based on a public source is marked as a hypothetical learning example. Each source is labelled by what was actually checked: what was reviewed and what remains open, in the pattern section's source list.
Distinguishing findings, suspicions and interpretation
A finding is something verifiable from a source. An allegation or suspicion is something published or attributed but not yet decided. A publication is an information source; publication alone does not turn it into a proven fact. Interpretation is my explanation as an investigator. Where there is a difference, I try to state it explicitly.
What is not here
This is not legal or financial advice, and there are no client stories. The content reflects my personal views only and does not represent my employer.
Sources appearing in cases
Calcalist, ynet, mako, Bizportal, ice, Walla Real Estate, BBC, KWTX and The Straits Times. The pattern section has its own source register.
Victim selection: some approaches are targeted; others are mass or random. As on the dedicated mechanisms page, evidence is needed before concluding that a victim was deliberately selected.