Which action is a method used to remove funds during an account takeover?

• A. Donations
• B. Tax refunds
• C. Transfers
• D. Loans

Answer: (C)

When an attacker gains control of an account, the fastest way to pull funds out is to move them to another account. Initiating transfers—bank-to-bank transfers, wires, or ACH—lets the criminal relocate money quickly and often to accounts they control or to money mules. This direct movement out of the compromised account matches the goal of exfiltrating funds, which is why transfers is the best answer.

Donations might redirect funds to a recipient, but it’s not the typical rapid exfiltration method from a compromised account and can raise red flags. Tax refunds involve government processes and aren’t something a attacker can reliably execute from the victim’s account to immediately remove funds. Loans would create new debt and are not a straightforward way to drain an existing account, making them much less practical for rapid fund removal.