Controls
Every prevention, detection and response control in the library, grouped by family, with friction, cost and reach.
33 controls in 8 families.
Authentication
| Control | Summary | Layer | Friction | Cost | Mechanisms |
|---|---|---|---|---|---|
| Bot Management and CAPTCHA | Separating automated traffic from humans at sign-up, login, checkout, funding and redemption endpoints; CAPTCHA is one weak, costly tool among several. | Prevent, detect | Medium | Medium | Credential Stuffing, Account Takeover (ATO), Gift Card Fraud, Card Testing, Fake Account Creation (Bots), Promo Code Abuse, Sign-Up Bonus Abuse, Referral Abuse, Device Farms and Emulators, Receipt Fraud (Cashback), Business Logic Exploitation |
| Breached Password Detection | Checking passwords against known-breached and commonly used values at creation, reset and login, so reused credentials are retired before a stuffing wave turns them into withdrawals. | Prevent, detect | Low | Low | Credential Stuffing, Account Takeover (ATO), Session Hijacking and Infostealers, Loyalty and Rewards Redemption Fraud |
| Contact Change Cooling-Off Periods | Temporarily restricting payouts, payee changes and other high-risk actions after a change to email, phone, MFA or payout destination, so a takeover can't cash out before the owner notices. | Prevent, detect | Medium | Low | Payout Redirection, Account Takeover (ATO), SIM Swap and Port-Out Fraud, Account Recovery Abuse, ACATS Transfer Fraud, Loyalty and Rewards Redemption Fraud, Seller Non-Delivery and Fake Listings, Elder Financial Exploitation |
| Device Binding and Trusted Devices | Cryptographically binding an account to devices it has used before, so money-moving actions from a new or unbound device face more scrutiny than those from a long-trusted one. | Prevent, detect | Low | Medium | Account Takeover (ATO), Credential Stuffing, Session Hijacking and Infostealers, SIM Swap and Port-Out Fraud, Device Farms and Emulators, Multi-Accounting, Digital Wallet Provisioning Fraud, Payout Redirection |
| Multi-Factor Authentication (MFA) | Requiring two independent factors at login and, more importantly, at the money-moving moments: payout changes, withdrawals, new payees, contact changes and authenticator changes. | Prevent | Medium | Low | Account Takeover (ATO), Credential Stuffing, Phishing and Credential Harvesting, MFA Bypass and OTP Interception, SIM Swap and Port-Out Fraud, Session Hijacking and Infostealers, Payout Redirection, Account Recovery Abuse |
| Passkeys and Phishing-Resistant Authentication | FIDO/WebAuthn credentials bound to your domain that can't be relayed or read aloud; strongest login defense, but recovery, enrollment and authorized scams remain open. | Prevent | Low | Medium | Phishing and Credential Harvesting, MFA Bypass and OTP Interception, Credential Stuffing, SIM Swap and Port-Out Fraud, Account Takeover (ATO), Payout Redirection, Ramp-and-Dump via Account Takeover |
| Rate Limiting and Throttling | Capping how fast any entity can hit an endpoint (logins, OTP sends, card adds, promo claims, balance checks) so enumeration and volume attacks become slow and expensive. | Prevent | Low | Low | Credential Stuffing, Card Testing, Promo Code Abuse, Gift Card Fraud, Fake Account Creation (Bots), MFA Bypass and OTP Interception, Business Logic Exploitation, Receipt Fraud (Cashback) |
| Risk-Based Authentication and Step-Up | Adjusting how much authentication to demand based on risk and on what the customer is about to do, so assurance is highest at payouts, payee changes and other money-moving actions. | Prevent, detect | Medium | Medium | Account Takeover (ATO), Session Hijacking and Infostealers, Payout Redirection, MFA Bypass and OTP Interception, Credential Stuffing, Real-Time Payment Rail Fraud, ACATS Transfer Fraud, Ramp-and-Dump via Account Takeover, Loyalty and Rewards Redemption Fraud, Digital Wallet Provisioning Fraud |
| Secure Account Recovery Design | Designing password reset, lost-device and support-assisted recovery so they are no weaker than login, and so recovery can't lead straight to a payout. | Prevent, respond | Medium | Medium | Account Recovery Abuse, SIM Swap and Port-Out Fraud, Account Takeover (ATO), Payout Redirection, Impersonation Scams, Insider Fraud, Generative AI and Deepfake Fraud |
Identity
| Control | Summary | Layer | Friction | Cost | Mechanisms |
|---|---|---|---|---|---|
| Bank Account Ownership Verification | Confirming a linked bank account is open and belongs to your customer before funding or payout. Nacha requires validation for WEB debits; most fraud protection comes from ownership matching. | Prevent | Low | Medium | ACH Funding Fraud, Payout Redirection, Money Mules, Instant Funding Abuse (Kiting), Account Takeover (ATO), Multi-Accounting, Synthetic Identity Fraud, Sign-Up Bonus Abuse, Seller Non-Delivery and Fake Listings |
| Document Verification and Liveness | Checking that an ID document is genuine and that a live person who matches it is present, at onboarding, recovery and high-risk payouts; deepfakes and injection now set the bar. | Prevent | High | Medium | Synthetic Identity Fraud, Generative AI and Deepfake Fraud, Account Recovery Abuse, Account Farming and Resale, Multi-Accounting, Money Mules, Account Takeover (ATO), Sign-Up Bonus Abuse |
| KYC and Customer Identification Program (CIP) | Collecting and verifying identity at account opening. It's a legal floor under 31 CFR 1020.220 and 1023.220; a fraud control only once it is tied to funding and payout limits. | Prevent, detect | Medium | Medium | Synthetic Identity Fraud, Money Mules, Account Farming and Resale, Multi-Accounting, Sign-Up Bonus Abuse, ACH Funding Fraud, Bust-Out Fraud, ACATS Transfer Fraud, Fake Account Creation (Bots) |
Transaction and funding
Promotions and rewards
| Control | Summary | Layer | Friction | Cost | Mechanisms |
|---|---|---|---|---|---|
| Promotion Design Guardrails | Designing incentives that are hard to abuse: eligibility, caps, vesting, funding and activity requirements, budget kill-switches and pre-launch abuse modeling, built in before launch. | Prevent, respond | Low | Low | Sign-Up Bonus Abuse, Promo Code Abuse, Referral Abuse, Multi-Accounting, Fake Account Creation (Bots), Business Logic Exploitation, Card-Linked Offer Abuse, Receipt Fraud (Cashback), Instant Funding Abuse (Kiting), Account Farming and Resale, Refund and Return Fraud |
| Receipt and Purchase Verification | Layered validation proving a claimed purchase happened, was made by this user and wasn't reversed, from receipt checks to retailer data, e-receipt and loyalty linking, plus sampled manual review. | Prevent, detect | Low | Medium | Receipt Fraud (Cashback), Card-Linked Offer Abuse, Coupon Counterfeiting and Misredemption, Refund and Return Fraud, Multi-Accounting, Generative AI and Deepfake Fraud, Fraud Rings and Collusion, Promo Code Abuse |
| Referral Program Controls | Program design, graph-aware detection and staged payouts that keep referral incentives rewarding real customer acquisition rather than self-referral, farms and rings. | Prevent, detect, recover | Low | Medium | Referral Abuse, Multi-Accounting, Fake Account Creation (Bots), Device Farms and Emulators, Account Farming and Resale, Sign-Up Bonus Abuse, Fraud Rings and Collusion, Synthetic Identity Fraud |
Marketplace
| Control | Summary | Layer | Friction | Cost | Mechanisms |
|---|---|---|---|---|---|
| Claims and Returns Policy Controls | Policy, evidence and refund-timing levers that keep returns, refunds and buyer-protection claims generous to honest customers but unprofitable for serial abusers and refund operators. | Prevent, detect, respond | Medium | Medium | Refund and Return Fraud, Buyer Protection Claim Abuse (INR and SNAD), Chargeback and Friendly Fraud, First-Party Fraud, Card-Linked Offer Abuse, Receipt Fraud (Cashback), Account Takeover (ATO), Fraud Rings and Collusion, Multi-Accounting, Insider Fraud |
Detection infrastructure
| Control | Summary | Layer | Friction | Cost | Mechanisms |
|---|---|---|---|---|---|
| Case Management Systems | The system of record for fraud alerts, investigations, decisions and outcomes, linking evidence, entities and actions so cases are consistent, auditable, reportable and usable as labels. | Detect, respond, recover | Low | Medium | Fraud Rings and Collusion, Money Mules, Account Takeover (ATO), Elder Financial Exploitation, Authorized Push Payment (APP) Scams, Insider Fraud, ACATS Transfer Fraud, Synthetic Identity Fraud, Seller Non-Delivery and Fake Listings |
| Consortium and Data Sharing | Sharing fraud intelligence across organizations, via FinCEN 314(b), bank-owned networks, industry consortia, ISACs and peer contacts, so repeat actors and mule destinations are recognized everywhere. | Prevent, detect, respond | Low | Medium | Money Mules, Authorized Push Payment (APP) Scams, Investment Scams (Pig Butchering), Impersonation Scams, Synthetic Identity Fraud, Fraud Rings and Collusion, ACH Funding Fraud, Check and Mobile Deposit Fraud, Account Takeover (ATO), ACATS Transfer Fraud, Fraud-as-a-Service Ecosystem, Coupon Counterfeiting and Misredemption |
| Graph Analytics | Modeling accounts, devices, instruments, payout destinations and transactions as a connected graph to expose rings, mule networks, farms and collusion invisible at the single-account level. | Detect, respond | Low | High | Fraud Rings and Collusion, Money Mules, Multi-Accounting, Referral Abuse, Account Farming and Resale, Synthetic Identity Fraud, Device Farms and Emulators, Triangulation Fraud, Ramp-and-Dump via Account Takeover, Receipt Fraud (Cashback), Sign-Up Bonus Abuse |
| Machine Learning Models | Supervised and unsupervised models that score transaction fraud risk, and the problems that decide whether they work: labels, imbalance, delayed feedback, drift, adversarial adaptation and reviewer explainability. | Prevent, detect | Low | High | Account Takeover (ATO), Card-Not-Present Fraud, ACH Funding Fraud, Check and Mobile Deposit Fraud, Receipt Fraud (Cashback), Money Mules, Authorized Push Payment (APP) Scams, Synthetic Identity Fraud, Multi-Accounting, Bust-Out Fraud, Refund and Return Fraud, Payout Redirection |
| Manual Review Queues | Routing uncertain decisions to trained humans: queue design, expected-loss prioritization, reviewer tooling, SLAs, QA hooks, and how review decisions become labels. | Detect, respond | Medium | High | Account Takeover (ATO), Payout Redirection, Receipt Fraud (Cashback), Check and Mobile Deposit Fraud, ACH Funding Fraud, Seller Non-Delivery and Fake Listings, Authorized Push Payment (APP) Scams, Elder Financial Exploitation, ACATS Transfer Fraud, Refund and Return Fraud, Synthetic Identity Fraud |
| Rules Engine | The decisioning layer where explicit, human-authored logic turns signals and scores into actions (allow, step-up, hold, review, block), and why governance matters as much as the rules themselves. | Prevent, detect | Low | Medium | Account Takeover (ATO), Card Testing, Business Logic Exploitation, Promo Code Abuse, Sign-Up Bonus Abuse, Instant Funding Abuse (Kiting), Payout Redirection, Credential Stuffing, Receipt Fraud (Cashback), Real-Time Payment Rail Fraud |
Customer protection
Internal
| Control | Summary | Layer | Friction | Cost | Mechanisms |
|---|---|---|---|---|---|
| Customer Support Verification Protocols | How support channels verify callers and chatters before account changes, recovery, refunds or money movement, closing the social-engineering path that bypasses digital controls. | Prevent | Medium | Medium | Account Recovery Abuse, Account Takeover (ATO), SIM Swap and Port-Out Fraud, Payout Redirection, Generative AI and Deepfake Fraud, MFA Bypass and OTP Interception, Refund and Return Fraud, Impersonation Scams, Elder Financial Exploitation, Insider Fraud |
| Insider Access Controls | Least privilege, separation of duties, dual control and activity monitoring that stop employees, contractors and outsourced agents from enabling or executing transaction fraud. | Prevent, detect | Low | Medium | Insider Fraud, Account Takeover (ATO), Account Recovery Abuse, SIM Swap and Port-Out Fraud, Payout Redirection, Money Mules, Refund and Return Fraud, Elder Financial Exploitation, Business Logic Exploitation, Fraud Rings and Collusion |
Highest-leverage controls
Referenced by the most mechanisms:
The 12 controls listed by the most of 44 mechanisms.
- Velocity and Exposure Limits (19)
- Graph Analytics (18)
- Consortium and Data Sharing (15)
- Real-Time Transaction Risk Scoring (15)
- Customer Education and Scam Warnings (12)
- Passkeys and Phishing-Resistant Authentication (12)
- Risk-Based Authentication and Step-Up (12)
- Negative Lists and Deny Lists (11)
- Promotion Design Guardrails (11)
- Contact Change Cooling-Off Periods (10)
- Customer Support Verification Protocols (10)
- Funds Availability Holds (10)
See also Mechanism to Control Matrix.