Pass Through Criteria
Standard Note Template
Scam or Mule?
Outgoing Wire Review
General Fraud Knowledge
100

According to our SOP, this is the amount of time in which pass through activity generally occurs.

What is 72 business hours?

100

The first line of the template is labeled...?

What is "Summary"

100

This is when a member is coerced, manipulated, or deceived into sending their own money to a bad actor,

What is a scam

100

The queues you should always be monitoring for Outgoing Wire requests?

What are Outgoing Wire Review and ZD Wire Requests?

100

True or False: Fraud can be generally defined as the act of intentionally lying, stealing, or deceiving for financial gain, or for access to information. 

True

200

True or False: newly opened accounts (under 60 days) and accounts with long stretches of dormancy (6 months of more of no activity) are both red flags for pass through activity?

What is true

200

We should be looking this far back for any changes to the member's PII.

What is 60 days?

200

This activity can be broadly definied as when a member uses their own account to move another entity's funds through SoFi, sometimes without even knowing they are taking part in it.

What is mule activity?

200

If we have a link for Biometrics in Atlas, clicking it will open this program so we can review an Identity Verification attempt?

What is Veriff?

200

These are the two most common types of Third party fraud.

What are IDT and ATO?

300

Even if we are 100% sure we'll be closing the account due to pass thorugh criteria- we still must always do this.

Make an Outbound Call to the member's verified POF.

300

Name one tool used for Open Source Analysis, according to our Job Aid.

Lexis Nexis, Veriff, Forge, SentiLink.

300

True or false: one can be both the victim of a scam and engage in mule activity. 

True! These two are not mutually exclusive. 

300

Before we refer an alert to the PnD High Level Wire queue we must first ---- the request and place a ------- ------ --- on the funds the member attempted to wire out.

What are "Deny" and "Partial Balance Hold"?

300

Sudden password changes, changes to POF/2FA, and unusual IP locations on login are all red flags pertaining to this type of fraud?

ATO

400

Pass through criteria closures do NOT require this, which we would normall send to Investigations when we confirm any other type of fraud?

What is a UAR (Unauthorized Activity Report)?

400

Reviewing the following in Datavisor would provide great information for this line of the template? 

Prior alerts, recently closed alerts with similar risk, any other open or active review, and Past ATO claims

What is Customer History?

400

We should always try to make sense of the relationship between the member and the ---------- of an outgoing wire. This context will help us undersatnd whether or not the member might be falling victim to a scam.

What is beneficiary? Know who they are sending funds to and why, then ask yourself if it makes sense for the member to enagge in that activity. 

400

True or false: we should always attempt to understand who the benficiary is ona  wire transfer, as well as gain context as to the reason for the transfer.

True- understanding this is crucial to preventing someone from becoming the victim of a scam

400

True or false: If the funds present in the account do not pose a risk of return there are no further concerns of fraud on the account or its activity?

False- just because SoFi isn't liable on a  return or recall attempt doesn't mean thjat there is no fraud being attempted. 

500

This is the only acceptable way to send the member funds from an account closed due to pass through criteria?

What is a check mailed to their address on file?

500

The following is a good example of which line on the template?

"Account opened on 3/24/25. All logins geolocal to member's location with consistent IP, Device, and kdt sessions. Account funded by regular direct deposits (payroll) and external transfers from established source (Bank of America, transfers over 60 days old). Funds moved from 'House Vault' prior to atempted outgoing wire to Acme Title Co for home purchase. No red flags for fraud present. Wire approved."

What is Conclusion

500

This type of scam involves gaining the confidence of the victim and getting them to pour their own money, sometimes even loans they've taken out, into a supposed investment over the course of multiple transactions over an extended period of time often, but not always, involving cryptocurrency. 

Hint: remember the John Oliver video I shared out a while back

What is Pig Butchering?

500

If we cannot confirm fraud on an account, but we suspect the activity may constitute a violation of our member agreement, we should file this?

What is an AML (Anti-Money Laundering) Referral using the #fraud-ops-aml-referral

500

True or False: There is an expectation that only people with prior fraud knowledge will be reading yuor fraud claims or case notes.

False- your notes may well be used in further investigations or even legal proceedings. They should be written in a way that a reasonable person could read your conclusion and know exactly why you did or did not clear the account of fraud. 

M
e
n
u