Enter Title

Modus Operandi

50

FYI Our alerts picked up suspicious fraud activity in ____ _____ this week

• New accounts sending multiple quick orders
• Adding .card or multiple cards from BENDIGO AND ADELAIDE BANK LIMI
• Shared cards / recipient / device id
• email domain such as @exdonuts.com, nekosan.uk, moimoi.re

What is WR Australia-Nigeria

100

• Flag in Frontplugin is: 'BLOCKED_RECIP'
  • recipient has been blocked for various reasons, not only as a scammer.
• transactions is in the first 30 days, and the user has a blocked recipient in their recipient list:
  • Please note: recipient could be used in one of the past transactions, or they tried to add the blocked recipient to their account at some point.
• Please check the 'blocked recipient' drop down in Frontplugin as usual for linkings, and if the SW user seems fraudulent or a scam victim, please leave the account blocked and cancel the transaction. If deemed safe then unblock the user account and release the transaction as usual.

What is SW GBP-KES and GBP-XOF_ci corridors?

150

I did re-simulation on the check_scammer_early_txs defence, and change the thresholds to trigger the defence and block the account when:

• send amount is £300 between £900
• user is born before 2010 (so basically any SW user)
• user has made max 2 successfull transactions
• user account was created 520 minutes or less ago.

What is SW UK-KES 

200

Key characteristics of this trend include:

• It involves tenured users ranging anywhere from 30 days to over 2,000 days.
• Users are adding new FIRST HORIZON BANK cards, resulting in AVS failure orders.
• Card details are being shared across different users, and some individuals are adding multiple First Horizon cards.
• Device IDs and recipient payouts are not being shared.
• We've seen instances where users also added REGIONS bank cards. We already have controls for this, but it is likely connected to the recent fraud attack associated with that issuer earlier this year.
• A few orders exhibit ATO characteristics, but these are being captured by our existing ATO controls.

Because the device IDs belong to the actual account holders, these patterns strongly suggest that existing users are colluding with fraudsters using stolen card details.

What is WorldRemit United States > Ghana corridor 

250

4 countries (most countries gets the points)

We have picked up a new card issuer that has the same pattern on US-Ghana First Horizon Bank fraud stolen cards.

This time fraudsters are using  BOEING EMPLOYEES CREDIT UNION card,
Sending from US to ___ ____ ____ ____. We added also a cancellation control for this new corridor bank

What is Kenya, PH, ZW, Mozambique. 

Death Row

50

Generally refers to unauthorized activity such as stolen identity, stolen card information where the genuine customer is not involved in the account creation or transactions created. These are not initiated by the customer.

What is Fraud?

100

is authorised activity where the genuine customer is manipulated into sending money to a third party. These are usually initiated by the customer.

What is Scam?

150

is a specific type of fraud when a fraudster gains access to a legitimate, existing account belonging to a real customer and creates unauthorized transactions. This could be by tricking the customer into giving away their details or gaining access to their account in another way

What is Account Take Over?

200

 is the process of making large amounts of money generated by criminal activity (such as drug trafficking, cybercrime, or fraud) appear to have come from a legitimate source. It involves concealing the origin of "dirty" money so it can be used without detection by law enforcement.

What is Money Laundering

250

this occurs when a third party threatens to reveal sensitive, private, or damaging information about a customer unless a payment is made. This is a form of coercion where the customer is often the one initiating the transaction, but they are doing so under duress rather than through traditional manipulation or deception.

What is Blackmail and Extortion?

Know Your Customer

50

This newly accepted ID is a new add on to Nigeria, What ID is this

What is NIN (National Identity Number?

100

This newly accepted ID is a new add on to Qatar, what ID is this?

What is Residency Permit?

150

Ireland, Belgium and Portugal what do these 3 countries have in common?

What is KYC Ascend?

200

Please explain the actions to be done for GenericTask_USER_PROTECTION_SUPPORT tasks.

 Expected Action for Holds Analysts
To avoid duplication of work, please follow these guidelines:

• Do Not Review by Default: If a task was generated solely because the FI team blocked the account, keep the user blocked and do not conduct a proactive review.
• The "Appeal" Exception: Only proceed with an investigation if the user submits an account appeal. In this case, you may move the user to Customer Finance (CF) or clear the block based on your findings.
• Multiple Fraud Flags: If an account has other fraud blocks in addition to the FI block, do not ignore it—proceed with your standard review process as normal.

250

With the new updated on Japan IP mismatch. Give the 2 steps in reviewing the transaction and explain briefly.

In order to resolve this hold, analysts must follow the steps below: 

Step 1: Check ID validity

1. Analyst must review if Residence card on file is valid (not expired). This information is noted down by Japanese speakers during customer onboarding and is available in the Operations comments

   1. If the Residence card is expired: Cancel the transaction and requested the customer to submit another ID

   2. If the Residence card is not expired: Continue to hold the transactions, however, request the customer to clarify the reason for IP mismatch 

If a Japanese National is held for IP mismatch please refer to step 2

Step 2: Clarifying IP Mismatch

2. Using the custom template via RFI request, request the following information: Your transaction is currently on hold as we identified that you are currently outside of Japan. Please confirm if you are traveling or any other reason.  

   1. If customer confirms they are travelling: If the Residence card is valid then proceed with releasing the transfer. 

   2. If customer confirms they have permanently moved from Japan: Cancel the transaction and immediately close the account

Tip of my tongue

50

On April 10 a reminder from LOD2 was sent, what was the reminder?

What is stricter rules in requesting for a selfie? The face is obscured by any object, including shadows and the lighting is too low to clearly view the entire face.

100

How do we access SW Onfido w/o going to okta?

What is change your domain to @zepz.io

150

Last April 14 the leadership team released a new send country as part of UW. Which country is this?

Philippines

200

Give the 4 Onfido/Entrust results

Clear, Caution, Suspected, Rejected

250

What are the 4 main status in AWS?

Available, Break, Lunch, Offline

Update! Update! Update!

50

This area’s license was recently reinstated on both WR and SW.

What is New Jersey License?

100

Based on TM pretty’s video, who are the people authorized to make changes on your schedule?

What is Team Manager and Senior Analyst?

150

What is the correct action when we encounter a repeat attempt in UW?

Repeat Attempts 

(Note: When a task is flagged for "repeat attempts," do not immediately reject it. First, investigate the reason for the flag:

If the flag is due to the same document being resubmitted: Verify the document. If it is valid and genuine, approve the task.

If the flag is due to a "duplicate account": Reject the task.)

200

Pastor Jackson J., Apostle Danny G., Brother Apsostle Ramonique. These are all acceptable SA recipients true or false? Why?

What is False, must have first and last name

250

Give us a very quick step by step on how to send an outreach when a SW doesn't have a task. 6 steps total (most steps gets the points)

What is Customer details/Customer Tab - customer actions - Outreach - Choose Outreach - Click Blaze Outreach - Check outreach history if it was sent