According to French payment security firm Sis ID, a single fraudulent bank account is used to target an average of 34 businesses within its network, allowing criminal organizations to repeatedly exploit the same account across multiple victims, industries, and countries.
The company has already identified and blocked more than 14,000 fraudulent International Bank Account Numbers (IBANs) in 2026 alone.
The findings challenge a common assumption about financial fraud. Many organizations still imagine cyber-enabled payment fraud as a series of isolated incidents carried out by individual criminals.
But emerging evidence suggests that payment fraud increasingly resembles a highly organized business operation complete with infrastructure, specialization, shared intelligence, and scalable processes.
To businesses, financial institutions, and regulators, the threat landscape is no longer defined by individual bad actors. It is increasingly defined by professionalized fraud ecosystems capable of targeting hundreds or even thousands of victims simultaneously.
What the Latest Findings Reveal
According to Sis ID, fraudulent bank accounts are not typically discarded after a successful scam. Instead, they are repeatedly reused across multiple fraud attempts, allowing organized criminal groups to maximize the value of each account they control.
Internal data showed that one fraudulent account targets an average of 34 companies, demonstrating a level of efficiency that resembles legitimate business operations.
The company monitors bank account information across more than 190 countries and territories and reported identifying more than 14,000 fraudulent IBANs as of late October.
According to Patrice Bouexel, President of Sis ID, the scale of activity strongly indicates the involvement of organized criminal networks rather than isolated fraudsters.
The firm’s findings also point to the increasingly international nature of fraud operations. According to Bouexel, many traces of fraudulent activity originate from the Asia-Pacific region or Russia, while large-scale scam operations have also been linked to locations such as Myanmar.
The observations reinforce a growing consensus among financial crime experts: modern fraud networks operate globally, exploit digital infrastructure, and leverage scale in ways that were not possible a decade ago.
Industrialization of Financial Fraud
The most important insight from the Sis ID findings is not the number 34 itself: it is what the number represents.
Historically, payment fraud often involved relatively intensive effort directed toward individual victims. Criminals had to establish fake identities, open accounts, recruit collaborators, or create new payment channels.
Today, criminal organizations increasingly treat fraudulent accounts as reusable infrastructure. Once an account successfully enters the financial ecosystem, it becomes a valuable operational asset.
Instead of retiring the account after one fraudulent transaction, criminal networks often continue using it repeatedly until its usefulness ends. This dramatically improves efficiency.
Every successful account opening creates opportunities for dozens of future attacks.
The economics become highly attractive from a criminal perspective because the cost of establishing infrastructure becomes spread across multiple victims.
The result is not merely more fraud, but a largely scalable fraud.
How Business Payment Fraud Works
One reason payment fraud remains effective is that it often exploits trust rather than technology.
Many schemes target routine business processes rather than cybersecurity vulnerabilities, and they do it by:
- impersonating suppliers
- spoofing executives
- altering payment instructions
- compromise email accounts
- exploiting vendor relationships
Eventually, legitimate funds are directed into accounts controlled by fraudsters. The challenge is that these transactions frequently appear genuine.
Employees may believe they are paying an authentic invoice. Procurement departments may assume the account information provided is legitimate. Treasury teams may see nothing unusual in the payment request itself.
The sophistication of these schemes means that cybersecurity defenses alone are insufficient.
Organizations must also address operational vulnerabilities and human decision-making processes.
Why Fraudulent Accounts Remain Active
A natural question is why fraudulent accounts are able to remain operational long enough to target dozens of victims.
Fraud detection often remains reactive, and in many cases, fraudulent accounts only become visible after a victim reports suspicious activity.
Until then, the account may appear legitimate, creating a window of opportunity for criminals.
The longer an account remains undetected, the greater the number of victims it can potentially affect. This reality explains why information sharing has become increasingly important.
According to Sis ID, approximately 36 percent of its automated verification decisions rely on intelligence contributed by companies within its network.
Collective intelligence allows suspicious accounts to be identified more quickly than would be possible through isolated investigations.
Significance for Banks and Financial Institutions
Financial institutions face increasing pressure to address account misuse before it results in widespread harm.
The reuse of fraudulent accounts suggests that traditional Know-Your-Customer (KYC) frameworks may be facing new challenges from increasingly sophisticated criminal methodologies.
Fraudsters may:
- exploit synthetic identities
- recruit money mules
- use shell companies
- rely on proxy account holders
Each strategy complicates customer verification efforts. Banks must therefore complement onboarding controls with ongoing monitoring and behavioral analysis.
Detecting suspicious account activity requires continuous vigilance rather than a one-time verification process.
The emergence of industrialized fraud reinforces the importance of risk-based monitoring frameworks across the banking sector.
DOPAY, as a BSP‑licensed EMI and VASP, offers OFWs a low‑cost remittance pathway through in‑app user‑to‑user transfers, allowing OFWs to send money from abroad using secure crypto‑to‑PHP conversion and direct wallet‑to‑wallet transfers.
For overseas Filipino workers (OFWs) and local employees, DOPAY provides a reliable way to manage money, send remittances, and access digital financial tools protected by strong KYC and AML/CFT controls.
With DOPAY’s crypto wallet, you can gain crypto rewards for every trade under our Trade & Earn program. Not just that, with DOPAY’s Refer & Earn program, Filipinos can unlock new doors for earning possibilities with every successful referral.
Download the DOPAY app today!
