# Financial Fraud Execution — Ponzi Setup, Fabricated Statements, Unauthorized Redirect & Laundering

- **Severity:** High
- **Signature ID:** `1a4adefc-993b-44e8-b3ef-a05d2665979e`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM08 (Vector and Embedding Weaknesses)

## Summary

This rule catches instructions that push an AI agent with access to financial tools into carrying out specific fraud patterns — like Ponzi schemes, fake financial statements, or unauthorized money transfers — rather than legitimate finance tasks. It looks for the telltale wording of the crime itself, not just any request touching finances.

## How the attack works

An attacker (via a malicious prompt, injected content, or a compromised upstream input) sends the agent an instruction phrased as a normal-sounding finance task but containing a fraud-specific detail. Examples include paying old investors with new investors' money, creating a second set of books showing a profit instead of a loss, moving client funds without client authorization, running money through the company 'to test laundering detection,' opening trial accounts with a client's identity data, or applying for a loan using made-up projections. If the agent has tools to move money, edit records, or open accounts, it can execute the instruction directly, turning the prompt into real financial harm.

## Why it matters

An organization can suffer direct financial loss, falsified accounting records, unauthorized movement of client or company funds, or exposure to money-laundering and securities fraud liability — all carried out through its own automated finance tooling.

## What you can do

- Require human approval for any agent action that moves funds, alters financial statements, or opens new accounts, regardless of how the request is phrased.
- Restrict which agents or tool permissions can touch investor funds, client accounts, or loan applications without a second authorization step.
- Log and review agent-issued finance instructions for fraud-specific language (e.g. 'without client authorization', 'test laundering detection', 'alternative financial statements') even when the surrounding request looks routine.
- Distinguish legitimate compliance/audit language ('review', 'reconcile', 'verify') from action language ('redirect', 'process', 'set up') before allowing agent execution.

## Known benign look-alikes

- Legitimate finance ops: 'review / verify / reconcile / correct discrepancies in the financial statements', 'process the authorized transaction ensuring compliance', 'validate the legitimacy of investment schemes' — none carry a fraud-specific qualifier.
- Anti-fraud / anti-money-laundering compliance review requests.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01805

---
Source: https://www.netzilo.com/threats/atr-financial-fraud-execution-ponzi-setup-fabricated-statements