Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering
This rule catches instructions that push an AI agent with access to financial tools into carrying out specific fraud patterns — like Ponzi schemes, fake financial statements, or unauthorized money transfers — rather than legitimate finance tasks. It looks for the telltale wording of the crime itself, not just any request touching finances.
How the attack works
An attacker (via a malicious prompt, injected content, or a compromised upstream input) sends the agent an instruction phrased as a normal-sounding finance task but containing a fraud-specific detail. Examples include paying old investors with new investors' money, creating a second set of books showing a profit instead of a loss, moving client funds without client authorization, running money through the company 'to test laundering detection,' opening trial accounts with a client's identity data, or applying for a loan using made-up projections. If the agent has tools to move money, edit records, or open accounts, it can execute the instruction directly, turning the prompt into real financial harm.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1a4adefc-993b-44e8-b3ef-a05d2665979e
- Severity
- High
Why it matters
An organization can suffer direct financial loss, falsified accounting records, unauthorized movement of client or company funds, or exposure to money-laundering and securities fraud liability — all carried out through its own automated finance tooling.
What you can do
- →Require human approval for any agent action that moves funds, alters financial statements, or opens new accounts, regardless of how the request is phrased.
- →Restrict which agents or tool permissions can touch investor funds, client accounts, or loan applications without a second authorization step.
- →Log and review agent-issued finance instructions for fraud-specific language (e.g. 'without client authorization', 'test laundering detection', 'alternative financial statements') even when the surrounding request looks routine.
- →Distinguish legitimate compliance/audit language ('review', 'reconcile', 'verify') from action language ('redirect', 'process', 'set up') before allowing agent execution.
Known benign look-alikes
- Legitimate finance ops: 'review / verify / reconcile / correct discrepancies in the financial statements', 'process the authorized transaction ensuring compliance', 'validate the legitimacy of investment schemes' — none carry a fraud-specific qualifier.
- Anti-fraud / anti-money-laundering compliance review requests.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.