Building a Fraud Program from Zero

Standing up transaction fraud defenses at a young company: what the first hire should be, a 30/60/90-day plan, the first controls on each money path, and what to defer.

Core components

The first hire

Profile	When it fits	Risk
Strategy-minded generalist (SQL, rules, SOPs, comfortable talking to engineers and execs)	Most early-stage companies; the default	May underinvest in ops scale
Ops leader	High manual review volume already exists (marketplaces, receipts, claims)	May not build the data and rules foundation
Data scientist	Large clean data, existing ops, clear labels	Builds models with no labels, governance or deployment path
Compliance hire doubling as fraud	Regulated product with small fraud volume	Fraud becomes a checklist; slow to respond to attacks

The first hire needs authority as well as skill: access to production data, a path to ship rules without waiting on a sprint, a seat in launch planning, and a named executive sponsor who owns the loss line. See Fraud Operating Model and Fraud Team Hiring and Career Paths.

Priorities in order

Protect money-out. Value that hasn't left can still be saved. Withdrawals, payouts, redemptions and transfers get controls first.
See the losses. One loss ledger, reconciled to finance, tagged by money path and mechanism.
Map reversibility. For each money-in rail, know how long until value is final, and don't let more value leave before then than you can afford to lose.
Get into launches. Every new promo, payment feature and payout option gets a fraud review.
Build response capacity. Kill switches, an on-call, and an incident path.

How to build it

30/60/90-day plan

Days 1–30: see and stop the bleeding

Draw the money map: every way value enters, moves and leaves, with rails, timing and reversibility (see Payment Rails Map)
Pull 12 months of losses: chargebacks, ACH returns, check returns, refund and claim costs, promo spend, write-offs. Start the loss ledger (see Loss Taxonomy and Attribution).
Interview support, finance, payments, growth and engineering: "Where do you think we're losing money?" (see Cross-Functional Partnerships)
Read 50–100 confirmed fraud cases end to end. Write down the patterns.
Ship quick wins on money-out: holds on payouts to newly added destinations, limits for new accounts, and step-up after account changes (see Withdrawal and Payout Controls, Contact Change Cooling-Off Periods, Velocity and Exposure Limits)
Put kill switches on every live promo, or at least a documented way to pause each one fast
Set up a basic fraud on-call (even if it's you) and an incident channel (see Fraud Incident Response)

Days 31–60: foundations

Choose a rules engine approach: vendor, processor-native or in-house (see Rules Engine, Vendor Selection and Evaluation)
Turn on or tune basic signals: device fingerprinting, IP and proxy, email and phone risk, velocity (see Device Fingerprinting, IP Reputation and Proxy Detection, Velocity Signals)
Stand up a review queue with an SOP for the highest-risk decision (see Manual Review Queues, Alert Review Operations)
Define labels: what counts as confirmed fraud, by type, and where the label comes from (see Fraud Labeling and Feedback Loops)
Build the first dashboard: losses by money path, approval and decline rates, review volume (see Fraud Metrics and KPIs)
Map regulatory obligations with legal and compliance: Reg E, Nacha, card network rules, BSA/AML handoffs, broker-dealer rules where relevant (see US Regulatory Overview)

Days 61–90: governance and scale

Write the fraud policy (short) and decision rights (see Three Lines of Defense for the outline)
Put launch review into the product process (see New Product and Promo Launch Review)
Set up a rule inventory with owners and a change log (see Rule Governance and Change Management)
Start lightweight QA on manual decisions (see Fraud QA Program)
Run a first fraud risk assessment across money paths (see Fraud Risk Assessment)
Draft a 12-month roadmap with headcount, tooling and target maturity (see Fraud Maturity Model)
Present to leadership: losses, exposure, what's been fixed, what's next, and what you need

First controls by money path

Money path	First controls	Mechanisms they address
Card funding / checkout	Processor risk tools on; 3DS for risky segments; velocity on cards per account and accounts per card; card-testing defenses	Card-Not-Present Fraud, Card Testing
ACH funding	Account ownership verification; funds availability tiered by tenure; limits for new links	ACH Funding Fraud, Instant Funding Abuse (Kiting)
Mobile check deposit	Holds; duplicate detection; limits for new accounts	Check and Mobile Deposit Fraud
Withdrawals / payouts	Holds on new destinations; cooling-off after contact changes; limits by tenure	Payout Redirection, Account Takeover (ATO)
P2P / instant send	Limits for new accounts and new payees; scam warnings	Real-Time Payment Rail Fraud, Authorized Push Payment (APP) Scams
Promos / referrals / sign-up bonuses	Per-identity caps, vesting, clawback terms, budget caps	Sign-Up Bonus Abuse, Referral Abuse, Promo Code Abuse
Receipts / offers (rewards apps)	Duplicate-image detection; per-account submission velocity; review queue for high-value claims	Receipt Fraud (Cashback), Card-Linked Offer Abuse
Refunds / claims	Claim velocity per account; refund-to-original-method; review for high-value claims	Refund and Return Fraud, Buyer Protection Claim Abuse (INR and SNAD)
Login / account changes	MFA; breached-password checks; bot management; step-up on contact change	Credential Stuffing, Account Recovery Abuse

Build vs buy at stage zero

Buy signals that need cross-industry data (device reputation, email and phone risk, consortium data). You can't build that network effect yourself.
Buy or use processor-native rules and scoring to start, unless you have engineers to spare.
Build the loss ledger, labels, money map and SOPs. These are yours and no vendor can do them.
Defer custom ML until you have labels, volume and someone to monitor the model (see Machine Learning Models, Model Risk Management).

Artifacts and templates

90-day leadership readout outline

Where value moves. The money map
What we're losing. Losses by money path and mechanism, with trend
Exposure. Worst-case loss if the top 3 risks materialize
What we've shipped. Controls, and their estimated loss avoided and friction cost
What's still open. Top risks without adequate controls
Decisions needed. Loss appetite, friction trade-offs, headcount, tooling budget
Next 6 months. Roadmap and target maturity

Day-one questions for the business

Which money path would hurt most if it were attacked tonight?
Who can pause a promo, and how long does it take?
Who approves a new payout method today?
What do our payment partners and sponsor bank expect from us on fraud? Do we have it in writing?
Where do confirmed fraud cases get recorded today, if anywhere?
Which support actions can move or release value?

What to defer (and the risk of deferring)

Defer	Until	Risk of deferring
Custom ML	Labels and volume exist	Rules become complex; manage with governance
Graph analytics	Ring activity becomes material	Ring detection is manual and slow
Full second line	Regulatory or partner requirement	Use safeguards meanwhile (see Three Lines of Defense)
Dedicated threat intel	Stage 3	Rely on regulators' alerts and peers
Formal champion-challenger	Enough volume to measure	Measure with before/after plus a small holdout where you can

Metrics

At stage zero, keep it to a few:

Metric	Why
Net fraud loss by money path (weekly)	Are we bleeding?
Loss as bps of volume per money path	Normalizes for growth
Approval / decline rate per money path	Friction check
Manual review volume and SLA	Ops capacity
Launches reviewed / total launches	Process coverage
Time to mitigate the last attack	Response capability

Pitfalls

Starting with ML. Without labels, governance and a deployment path, the model becomes a science project.
Blocking everything. Early fraud leaders under pressure often over-correct. Approval rates crash and the business stops trusting fraud. Lead with holds, limits and step-up before declines.
No loss ledger. If finance and fraud disagree on the loss number, every conversation becomes about the number.
Ignoring support. Support is often the most exploited control in a young company (see Customer Support Verification Protocols, Support Team Fraud Training).
Single-threaded knowledge. Document from day one. The first fraud hire can't be the only person who knows how the rules work.
Not getting it in writing. Agree loss appetite and decision rights with the exec sponsor early, before the first incident tests them.

Fraud Program Overview · Fraud Operating Model · Fraud Maturity Model · Cross-Functional Partnerships
Vendor Selection and Evaluation · Vendor Landscape · Open Source Tools for Fraud Teams
Neobanks and Consumer Fintech · Cashback, Coupons and Rewards · Online Marketplaces · Brokerage and Investing

Sources and further reading

GAO-15-593SP Highlights: commit, assess, design and implement, evaluate and adapt, as a sequencing guide for a new program
COSO/ACFE Fraud Risk Management Guide, 2nd ed., Executive Summary (2023): the five principles a new program should eventually cover
Nacha, Fraud Monitoring Phase 1: risk-based ACH fraud monitoring obligations that apply to many fintechs originating or receiving ACH
CFPB, Regulation E §1005.11: error-resolution obligations a new EFT-offering company must staff for