PhishingCredentials harvested by a fake carrier message
An email or text that looks like it came from the carrier collects the login. The attacker signs in with the real password.
What ForMotiv seesA login from a device and network the policyholder has never used, then a direct path to payout details.
ImpersonationPosing as the policyholder to reset access
The attacker contacts support as the policyholder to reset the password or change the email on file.
What ForMotiv seesThe next portal session doesn’t behave like any session before it on the account.
SIM swap & MFA interceptionOne-time codes sent to the attacker
The policyholder’s number is moved to the attacker’s phone, so multi-factor checks pass.
What ForMotiv seesAuthentication succeeds, but behavior after login is unfamiliar with the account and moves straight to money.
Coached policyholderA real policyholder, talked through by a scammer
A fake adjuster or support agent walks the policyholder through changing payout details over the phone.
What ForMotiv seesThe right person with the wrong intent: dictated pacing, pasted bank details and unusual navigation.