Ilia Zavialov explains the vocabulary of fraud and the borders between its terms
Every scam arrives with a story, and every report about it arrives with a label. The label is usually chosen within minutes, often by the person who has just lost money, and almost never by anyone who knows what the choice will cost later. Yet that single word decides which desk opens the file, which rule governs the refund, and which column the event lands in when the year is counted. This article takes the terms apart one at a time and marks the borders between them. The question underneath it is narrow: when four different words could describe the same hour, which one is accurate.
Ilia Zavialov explains the vocabulary of fraud and the borders between its terms
The label is the first decision anyone makes
The vocabulary of fraud was built by institutions that had to sort events at scale rather than by anyone trying to describe experience. A bank needs to know within a minute whether a transfer left an account with the holder pressing the button or without it. A police service needs a category before a file can be opened at all. Every one of those needs produced a term, and the terms have long outlived the forms that created them.
The volume explains why the sorting became mechanical. Federal Trade Commission data for 2025 records three million reports and 15.9 billion dollars in stated losses, against 2.6 million reports and more than 12 billion dollars the year before. Nobody reads three million accounts of an evening and decides carefully what each one was. A category is applied at intake, and everything downstream inherits it.
This is why one evening can carry four correct names at the same time. A call arrives from a number belonging to a real bank, a calm voice explains that an account has been compromised, and a transfer leaves twenty minutes later. The identity was false, the displayed number was substituted, the channel was voice, and the payment was made by the account holder. Four terms, one hour, and each answers a different question about it.
Imposter scams name the identity and nothing else
An imposter scam is one where the entire event rests on who the other side claims to be. A bank, a delivery firm, a tax office, a grandchild in trouble. No password is stolen, no software is broken, and no device is compromised. The person on the receiving end behaves reasonably and correctly on premises that are false, which is the whole of the mechanism.
It is the largest reported family. The same Federal Trade Commission figures for 2025 count more than a million imposter reports and 3.5 billion dollars in losses, which is close to one report in every three. The scale comes from how little the approach requires. A borrowed name costs nothing and works on anyone who has a reason to hear from that name.
The border matters as much as the definition. Imposter describes the claim and says nothing about how the claim arrived. A text message pretending to be a courier and a phone call pretending to be a fraud department are both imposter events, and they have almost nothing in common in practice. Naming an event as impersonation identifies what went wrong in the room and leaves the delivery question open.
Spoofing is a property of the channel
Spoofing is the substitution of a sender. A phone number, an email address, a message header, a sender name in a chat thread. It happens in the plumbing that carries the message and touches nothing inside any account belonging to the recipient. That distinction is the reason it deserves its own word.
The display of a caller number was never built to prove identity. It was built to route calls and to bill them, and the little line of text on a screen was added on top of a system that had no way of checking it. The same is true of the visible sender line in an email, which is a label written by whoever sent the message. Treating either as evidence gives away the first thirty seconds of a call before a word has been spoken.
The border here runs against account takeover. In a spoofed message the genuine mailbox or phone line is untouched, and the real owner has no idea the conversation is happening. In a takeover the attacker holds working credentials and is sending from inside. The practical test is whether replies reach the real person, and it decides whether the response is a warning or a password reset.
Phishing, vishing and smishing name the delivery
These three terms answer one question only, which is what carried the lure. Phishing is the written form at scale, usually email. Vishing is the same deception carried out by voice in a live call. Smishing is the text message version, cut down to a sentence and a link. The deception can be identical across all three, and the defences are completely different, which is why the distinction survives.
Voice removes the pause. A written message can be reread, forwarded to somebody calmer, or left until morning, while a call holds a person inside the frame the caller built and keeps the pressure continuous. Text works the other way, by shrinking the message until nothing is left to inspect. A short line about an unpaid fee or a parcel held at a depot fits the format of every genuine notification a person has ever received on that screen.
Put beside imposter, these words fit cleanly rather than competing. Impersonation records who the other side claimed to be, and the delivery term records the pipe it came down. A useful report carries both, because the first shapes what the victim believed and the second shapes what can be blocked next time.
Authorised push payment is the line that decides the claim
This is the term worth learning before any of the others, because it records whose finger moved. In an authorised push payment the victim makes the transfer personally, having been deceived into wanting to make it. The instruction reaching the bank is genuine in every technical sense, and every field in it is correct. What was false sat outside the payment system entirely.
UK Finance recorded 248,070 such cases for 2025, with 576.4 million pounds taken. The origin data is the more interesting half: 66 per cent of those cases began online and a further 17 per cent came through telephone networks. The persuasion therefore starts far upstream of the bank, in a marketplace listing or an advertisement or a message thread, and arrives at the payment screen already finished.
Knowing the phrase changes the conversation that follows. A customer describing a mistake is making a complaint, and a customer describing an authorised push payment is opening a defined procedure with its own rules about evidence and timing. The words also set expectations honestly, since the recovery route for a payment the customer sent themselves is genuinely different from the route for a card used by a stranger.
Unauthorised fraud sits on the other side of that line
Unauthorised fraud covers everything where the instruction did not come from the account holder at all. Card details lifted from a compromised shop, a session hijacked in a browser, a device taken over remotely. The holder learns about the payment after it has happened, usually from an alert or a statement. Nothing was believed, because nothing was said to them.
The two categories argue about different things, which is the practical reason for keeping them apart. In an unauthorised case the dispute is whether the instruction was genuine, and the evidence is technical: device fingerprints, locations, timings, authentication records. In an authorised case none of that is contested, and the dispute moves to what the customer was told and what warnings appeared. One is an argument about machines and the other is an argument about persuasion.
The border blurs in one place worth naming. Remote access sessions, where a caller walks the victim through installing a support tool and then guides them to the confirmation button, sit awkwardly between the two. Sometimes the victim pressed it and sometimes the software did. Anyone reporting such a case is better served by describing the sequence in plain sentences and letting the institution choose its own label.
Business email compromise is the corporate form of the same border
Business email compromise describes a genuine conversation between genuine parties where the payment details are altered near the end. An invoice thread between a supplier and a client, running for weeks with real attachments and real signatures, until one message changes the account number. Nothing about the thread reads as suspicious, because for most of its life nothing about it was.
The FBI recorded 3.046 billion dollars in losses to it for 2025, placing it second among all categories behind investment fraud. Those sums move through ordinary accounts payable processes rather than through anything exotic. The amounts are large because the invoices being intercepted are large, and because the payment was already expected and budgeted before the attacker touched anything.
This is the case where training people to spot suspicious messages achieves the least. The message that matters looks exactly like the eleven before it, arrives from the address it should, and continues a thread the recipient started. The control that works is procedural: any change of bank details is confirmed by voice on a number already held from before the thread began. Written confirmation is worthless here, since the written channel is the compromised one.
Investment fraud, romance and purchase scams share fuzzy edges
Investment fraud names a fabricated venue rather than a single false instruction. A platform exists, or appears to, with a dashboard showing balances that grow, small withdrawals that succeed early, and a person available to answer questions. The deception is a relationship maintained across weeks or months, and the money arrives in instalments the victim chooses to send.
Its border with romance fraud is drawn by the ledger rather than by the story. A connection that begins as affection and ends at a trading platform is logged as investment fraud, because classification follows where the money went. Anyone reading the statistics should hold that in mind, since a romance figure counts only the cases where affection was also the payment reason. The lived experience of the two is frequently identical.
The border with purchase scams is cleaner and worth keeping clean. A purchase scam is a single payment for goods or services that never arrive, and it ends when the parcel does not turn up. Investment fraud promises a return, which is what keeps the victim sending more, and what makes the eventual loss a multiple of the first payment. The recovery routes differ accordingly, because a marketplace has a dispute process and a fabricated platform has nobody to dispute with.
The artificial intelligence marker records what someone noticed
The FBI added a flag for artificial intelligence involvement to its reporting for 2025, and the result is a lesson in how to read a category. Of more than eight billion dollars in investment losses, only 632 million carried that marker. The flag was applied where a victim or an investigator recognised a synthetic element and said so. It measures detection rather than occurrence, and the two numbers have no reason to be close.
Voice work shows why the gap is expected. In one experiment, people distinguished a genuine voice from a cloned one in 37.5 per cent of cases, which is worse than a coin toss and closer to noise. A person who was never going to identify the imitation will not tick a box about it afterwards. The marker therefore tracks awareness across a population, and awareness lags the technique by a wide margin.
The vocabulary consequence is straightforward. Deepfake and voice clone are descriptions of technique, and they sit alongside the older terms rather than replacing any of them. A cloned voice arriving on a spoofed number and ending in a transfer the victim made is still impersonation, still vishing, still an authorised push payment. Dropping the older words in favour of the newer one loses every piece of information that decides what happens next.
What the categories cannot tell you
Counted data describes reports, and reports describe the people who chose to file. In the 2025 Federal Trade Commission figures, four out of five imposter reports involved no money lost at all, which means the recorded attempts vastly outnumber the recorded successes. That ratio is useful and also incomplete, because the people most badly hurt are the least likely to fill in a form.
Labels are also applied once and revised rarely. A case opened as phishing because the first contact was an email may turn out to be business email compromise once someone examines the thread properly, and the file will usually keep its original name. Anyone comparing figures across years is comparing intake decisions as much as events. This is an argument for reading several sources rather than for distrusting all of them.
The practical habit that follows is to write the sequence before choosing the word. Who claimed to be whom, what carried the message, who moved the money, and at which point a detail quietly changed. Four plain sentences answering those questions contain everything a bank, a platform or an investigator needs, and the correct label falls out of them without effort. The order matters, because the label determines the route and the sequence determines the label.
Seven terms and the question each one settles
Term
What it names
What it settles
Imposter scam
A false identity on the other side
That nothing technical was broken
Spoofing
A substituted sender in the channel
That a familiar number proves nothing
Vishing and smishing
Voice and text as the delivery route
Which warning could have blocked it
Authorised push payment
The victim sent the money themselves
Which procedure a bank applies
Unauthorised fraud
An instruction the holder never gave
That the dispute is about evidence
Business email compromise
A real thread with altered details
Where in the thread to look
Investment fraud
A fabricated venue and a long relationship
Why the loss grew in instalments
Questions and answers
What is the difference between phishing and vishing?
Both name the delivery route rather than the deception itself. Phishing is the written form, usually email, while vishing is the same approach carried out by voice in a live call. The distinction matters because a call removes the chance to reread, forward or postpone.
What does authorised push payment mean?
It means the account holder made the transfer personally after being deceived into wanting to. The instruction reaching the bank was genuine in every technical detail, and the falsehood sat entirely outside the payment system. That places the case under a different procedure from a stolen card.
Is spoofing the same as hacking?
No. Spoofing substitutes the sender that gets displayed to you and touches nothing inside your accounts or devices. That is exactly why a familiar number on the screen or a correct address in a message carries no evidential weight.
What counts as business email compromise?
A genuine thread between real parties where payment details are altered near the end, usually after the conversation has been read or taken over. The defining feature is that everything before the final step was authentic. Confirming any change of bank details by voice on a previously known number is the control that works.
Is a deepfake voice call a separate category of fraud?
It is a technique rather than a category, and it stacks on top of the existing terms. A cloned voice on a substituted number ending in a transfer the victim sent is impersonation, vishing and an authorised push payment at the same time. Reporting only the deepfake element loses the details that determine the recovery route.
Why does the term used in a fraud report matter?
Because the label chosen at intake decides which desk handles the file and which rules govern any refund. A report filed under the wrong heading travels through the wrong queue while the money is still moving. Describing the sequence of events in plain sentences lets the correct label be chosen by someone who knows the routing.
Written by Ilia Zavialov, digital security consultant. All glossary terms