Employment scam victims tripled at financial firms in 21 countries

Reported victims of employment scams more than tripled over the past 12 months at more than 370 banks and other financial institutions in 21 countries. The 258% rise outran every other scam type, while total reported scams across the same institutions grew 35%.

Scams by the numbers (Source: BioCatch)

Researchers at BioCatch, a fraud-detection vendor, compiled the figures from reports filed by the institutions that use its software. The numbers matter for anyone running fraud controls because of where the scams happen. Nine of every 10 scam sessions now start on a mobile device. Traditional unauthorized fraud, where a criminal works the account without the owner’s help, comes from mobile in 75% of cases.

Investment scams still cost the most

The average investment scam case reached $6,600, nearly five times the average across all scam types. Purchase scams stayed the most common, at almost one-third of reported cases. They also carried the lowest average case value in all four regions the researchers broke out: North America, Europe, Latin America and Asia Pacific. Romance scams grew slowest of any type tracked, with a 23% rise in victims. Everywhere but Latin America, romance scams also ran longest, often over weeks or months.

Fifteen minutes, five warning signs

The researchers walked through one scam session, which ran about 15 minutes, to show where a bank can step in before money leaves. At login, the customer was on an active phone call and had remote access software installed. The researchers treat the call as a weak signal on its own. On average, 30% of activity reported as a social engineering voice scam has an active call during the session, so most of those cases would pass that check.

On the account overview pages, the customer sat almost idle for two minutes. When adding a new payee, the customer typed the account number in groups of three digits with short pauses between them. The researchers tie that pattern to someone reading numbers aloud over the phone. The payment went to a first-time beneficiary for an amount well outside the customer’s history, and during the review screen, touch events piled up in the same spot.

The bank sent warnings into the app during the session. The customer hit “back” on the review screen and dropped the transfer before the bank ever requested a risk score. The researchers argue the customer had to reach that conclusion alone, because victims told that they are being scammed often push back. Scammers prepare them for that call: “The bank will try to stop you. Don’t listen to them. They don’t understand.”

Small payments, high stakes

Erin West, a former prosecutor who founded Operation Shamrock, spent time in Nigeria in July and came back with a warning about where banks look. Scam compound networks are already there. In December 2024, Nigeria’s Economic and Financial Crimes Commission arrested 792 people, including 148 Chinese nationals, at a crypto-investment and romance scam operation in a seven-story building on Victoria Island. The older, homegrown fraud she saw runs on gift cards, wire transfers, Venmo, Cash App and peer-to-peer payments split into small amounts. The money lands in mule accounts, including fintech wallets that take little more than a phone number to open.

The worst version targets children. In financial sextortion, a scammer talks a boy, usually 13 to 17, into sending a compromising photo, then demands $100, $200 or a gift card to keep it from his friends and family. FinCEN has counted at least 36 U.S. teenagers who died by suicide since 2021 in cases linked to the crime, and West calls that a floor because it covers only U.S. reports. NCMEC now logs 137 reports of financial sextortion a day.

“Boys are dying over amounts of money no monitoring system was ever built to notice,” West wrote.

West wants banks to watch receiving accounts as closely as sending ones, since mule accounts take money in and push it out in a single sitting. Recovery is possible when they do. One Nigerian investigator took an American police report on a pig butchering loss of about $50,000, a long-con investment scam, and traced the money through five bank accounts to two trucks bought with the proceeds. He impounded the trucks and filed for civil forfeiture. The case is still on appeal.

Download: 2026 Credential Risk Report