Action Fraud: Action Fraud is the UK’s national reporting centre for fraud and cybercrime.

Artificial intelligence: AI is the ability for a computer to display human-like capabilities such as reasoning, learning, planning and creativity.

Boiler room: A boiler room is an operation, usually a call centre, where high-pressure salespeople call lists of potential investors to sell highly speculative or fraudulent investments.

Business email compromise: BEC is an attack designed to steal money from a business or gain access to sensitive information via email or other digital communication tools.

‘Bust out’: Bust out is a credit card fraud. The individual applies for a credit card, then uses it over time, establishing a normal usage pattern and repayment history. Eventually the credit cards are maxed out. The individual has no intention of ever repaying.

Catfishing: Catfishing describes someone who pretends to be another person or creates a fake identity online. They intend to form relationships with people, romantic or otherwise, to steal from them.

Cifas: Cifas is the UK’s largest cross-sector fraud sharing organisation.

Consumer Sentinel Network Data Book: This aggregates information about what consumers told the Federal Trade Commission about problems they experienced, like fraud, identity theft and other consumer protection topics.

Cryptocurrency: Cryptocurrency is a form of digital money.

Dark web: The dark web is a part of the internet that cannot be accessed through normal web browsers. It is only accessible using special web browsers (for example Tor browser).

Data breach: A data breach is when information held by an organisation is stolen or accessed without authorisation (NCSC, 2021).¹

DDoS as a service: DDoS as a service provides DDoS attacks for money.

Deepfake: Deepfake technology can seamlessly insert anyone into a video or photo.

Denial-of-service attack: A DoS attack is a cyber attack. It is when malicious individuals or groups use a small number of computers to flood their target computer with the aim to stop it from working as designed.

Digital footprint: Your digital footprint is the entirety of information you post online, including photos and status updates.

Distributed denial of service: A DDoS attack uses thousands of computers to launch DoS attacks against any internet-connected computer.

Double extortion: Double extortion is a ransomware tactic used by cybercriminals. Victim data is stolen, and then the victim’s copy of the data is encrypted. If the victim doesn’t pay the ransom, they are threatened a second time with exposure of the data to the public.

Drive-by attack: A drive-by attack is when someone visits a compromised website, and through no action of their own the website installs malicious software on their computers.

Email spoofing: Email spoofing is a technique used in spam and phishing attacks to trick users into thinking a message came from a person or entity they either know or trust.

Eurojust (European Union Agency for Criminal Justice Cooperation): Eurojust works with national authorities to combat a wide range of serious and complex cross-border crimes involving two or more countries.

Europol: Europol is the European Union’s (EU’s) law enforcement agency.

Federal Trade Commission: The FTC is a US federal agency that protects consumers and promotes competition.

Financial Conduct Authority: The FCA regulates the financial services industry in the UK.

General Data Protection Regulation: GDPR is an EU regulation for data protection and privacy in the EU.

Identity fraud: Identity fraud is when a stolen identity is used to commit fraud.

Identity theft: Identity theft is when someone’s identity (such as name, address, birthday etc.) is stolen and used to commit identity fraud.

Internet Crime Complaint Center (IC3): The IC3 is the mechanism for anyone reporting cybercrime to the Federal Bureau of Investigation in the US.

Internet of Things: The IoT is the concept of connecting any device to the internet and other connected devices.

Interpol: Interpol is an inter-governmental organisation. They have 194 member countries that they share and access data on crimes and criminals with, along with providing technical and operational support.

Jailbreaking: Jailbreaking is the removal of restrictions on operating systems.

Keylogger: A keylogger is a piece of software that logs every key pressed on a keyboard. It can capture personal messages, passwords, credit card numbers and anything else that is typed.

‘Love bombing’: Love bombing is when a cybercriminal targets a romance fraud victim with an endless stream of daily messages and calls professing their love.

Machine learning: Machine learning is software learning and adapting to new data without human intervention.

Malware: Malware is an umbrella term for any malicious program or code that harms computers.

Money mule: A money mule is a person who receives money in their bank account from a third party and transfers it to another person. It is a type of money laundering.

Multi-factor authentication: MFA is when there is an additional step needed to log in to something, beyond just a password. It could be several things:

• a code sent by SMS or an authentication app on a phone;
• a fingerprint or a face scan;
• using a special USB stick to plug into a computer to confirm your identity.

National Cyber Security Centre: The NCSC is the technical authority for cyber threats in the UK.

National Security Agency: The NSA is the intelligence agency for the US Department of Defense.

Online smear campaigns: An individual or business receives a threatening message that says they will be targeted with an online smear campaign unless they pay a ransom. A smear campaign is an intentional effort to damage someone’s reputation.

Organised Crime and Corruption Reporting Project: The OCCRP is a consortium of investigative centres, media and journalists fighting organised crime and corruption.

Personally identifiable information: PII is any piece of information meant to identify a specific individual. This often includes data such as a current or present address, driver’s licence number, financial accounts, email addresses, login credentials and passwords, phone numbers and birth date.

Phishing: Phishing attacks are when attackers attempt to trick users into doing ‘the wrong thing’, such as clicking a bad link that will download malware or directing them to a dodgy website. Phishing can be conducted via a text message, social media or by phone, but the term ‘phishing’ is mainly used to describe attacks that arrive by email. Phishing email campaigns can reach millions of users directly, and hide amongst the huge number of benign emails that busy users receive.

Ponzi schemes: Ponzi schemes are ‘get rich quick’ investment scams that pay returns to investors from their own money or from money paid in by subsequent investors. There is no actual investment scheme as the fraudsters siphon off the money for themselves.

Pyramid schemes: See Ponzi schemes.

Ransomware: Ransomware is a type of malware that prevents users from accessing their system or personal files until a ransomware payment has been made.

Ransomware as a service: Ransomware as a service enables even novice cybercriminals to launch ransomware attacks without much difficulty. It allows ransomware developers to sell or lease their ransomware variant to others to use to launch their own ransomware attacks and then share the profits.

‘Review bombing’: Review bombing is when multiple negative reviews are left online for a product or service.

Romance attacks: Cybercriminals use fake online profiles on dating websites and apps to commit fraud.

Securities and Exchange Commission: The US Securities and Exchange Commission is an independent federal government regulatory agency responsible for protecting investors, maintaining fair and orderly functioning of the securities markets, and facilitating capital formation.

Sextortion: Sextortion is a form of cyber extortion. Instead of data, it is private images, videos or messages that are released if payment isn’t received. The price is usually financial compensation or to get further personal pictures or videos from the victim.

Shodan: Shodan is a search engine for internet-connected devices.

Sideloading: Sideloading is installing an app outside Google Play or the Apple App Store.

SIM port hacking: A SIM port hack involves a cybercriminal who has convinced your mobile phone carrier to activate your phone number on another device.

Smishing: Smishing is similar to phishing except instead of email, text messages are used for the attack.

Social engineering: Social engineering is the art of persuading someone to do something against his or her best interests.

Spear phishing: Spear phishing are phishing attacks targeted to specific individuals.

‘Suckers list’: A suckers list is a list of previous fraud victims.

Sunk cost fallacy: The sunk cost fallacy reasoning states that further investments or commitments are justified because the resources already invested will be lost otherwise. Therefore, the sunk cost fallacy is a mistake in reasoning in which the sunk costs of an activity are considered when deciding whether to continue with the activity. This is also often known as throwing good money after bad.

Sunk costs: A sunk cost is an incurred cost that is not recoverable.

Synthetic identity fraud: Synthetic identity fraud is when someone uses a combination of real and fake personal information to create an identity and commit identity fraud.

Vishing: Vishing are phishing attacks made via phone calls. They can be made by humans or autocalls.

1 NCSC (2021) Data breaches – Protecting yourself from the impact of data breaches. Available from https://www.ncsc.gov.uk/files/data-breaches-
ind-fam-infographic.pdf