Glossary

Payment card fraud is the unauthorised or deceptive use of credit, debit or prepaid cards, or their details, to obtain goods, services or cash, whether the card is present or not.

Phishing is a deceptive message, by email, phone call or text, that poses as a trusted sender to trick people into revealing information, installing malware or making a payment.

Physical climate risk is the risk of damage and loss from climate hazards, either sudden events such as floods and storms or slow shifts such as rising seas and sustained heat.

Placement is the first stage of money laundering, in which cash or other criminal proceeds are put into the financial system or converted into other assets so that they can be moved and used.

A policy framework is the organised structure of an organisation's policies, standards and procedures, with defined owners, approval routes and review cycles, so rules are consistent, findable and kept up to date.

A Ponzi scheme is an investment fraud in which the operator settles old investors' claims out of fresh deposits from new ones, so promised profits are never earned, and it fails once new money slows.

A post-incident review is a structured look back at a security or operational incident, after it is resolved, to establish what happened, why, how well the response worked and what must change.

Preventive controls are measures that stop an error, loss or breach from happening in the first place, such as approvals, access restrictions, training and system blocks.

Least privilege is the rule that every person, account or application gets the smallest set of permissions that lets it do its job, and keeps them only while the need lasts.

A privacy notice is the statement an organisation gives people to explain what personal data it collects, why, how it is used and shared, how long it is kept, and what rights they have.

Privileged access management is the set of tools and rules that control, record and limit the use of powerful accounts, such as system administrators, database owners and service accounts.

Procurement fraud is dishonest conduct in buying goods or services, such as rigging bids, taking kickbacks, favouring a supplier improperly or submitting false invoices, to gain advantage or cause loss to the buyer.

Project risk management is the practice of identifying, assessing and responding to uncertain events that could help or harm a project's cost, schedule, scope or quality, from planning through delivery.

Prudential regulation is the set of rules that keep financial firms financially sound, covering capital, liquidity, risk management and governance, so they can survive losses and protect depositors, policyholders and the wider system.

Public accountability is the duty of governments, public bodies and those who handle public money or power to explain and justify their decisions and results to citizens, and to face consequences if they fall short.

This is the due diligence step of finding out why a customer wants the relationship and what kind of activity is expected, so that later transactions can be compared with a clear baseline.

Purpose limitation is the principle that personal data should be gathered for a clear, stated and lawful reason and not reused for something that does not fit that reason.

A pyramid scheme is a scam in which participants pay to join and earn mainly by recruiting others who also pay, rather than from any real product or service, so it collapses once recruitment slows.