The Outlier Lab

External Intelligence Feeds

Information from outside your platform (consortium fraud data, network alerts, breach and compromise data, regulator advisories, peer and law-enforcement sharing) that flags risky entities and new attack patterns.

What it measures

Two different products are both called "intelligence", and they need different handling:

TypeWhat it isUsed where
Entity intelligence (machine-readable)Consortium-reported fraud on bank accounts, cards, devices, emails, phones and identities; payment-network risk data; breached-credential and compromised-card data; scam-reported payees; IP and infrastructure reputationReal-time scoring and lookups at onboarding, login, funding, payout
Typology intelligence (human-readable)Regulator alerts and advisories, law-enforcement notices, industry working groups, peer information sharing, vendor researchRule and model design, launch reviews, analyst training, horizon scanning

The derived features that matter for entity intelligence are hit/no-hit, source, recency, confidence, and the reason the entity was reported (unauthorized vs. scam vs. first-party).

Why it matters

Fraud actors reuse resources across platforms: the same mule account receives scam proceeds from customers at many banks; the same breached credentials are replayed across many logins; the same device farm hits many reward programs. A single platform sees each resource once, often too late. Shared data lets you block a resource after it has hurt another institution and before it reaches you.

Typology intelligence matters just as much. FinCEN's alerts have consistently given defenders a head start with concrete red flags and SAR key terms: pig butchering (FIN-2023-Alert005, September 2023), mail-theft check fraud (FIN-2023-Alert003, February 2023), deepfake media (FIN-2024-Alert004, November 2024) and a 2025 notice on convertible virtual currency kiosks used in scams. FINRA's annual oversight reports flagged ATO-driven ramp-and-dump trading. The FTC's data spotlights document shifts such as task scams and crypto kiosk losses.

Information sharing also directly recovers money: FinCEN's Rapid Response Program, which works with law enforcement and foreign partners to recall fraudulent cross-border transfers, reported about $182 million frozen in FY2025 and $991 million returned to victims since 2015.

How to collect it

  • Buy or join consortia and networks: bank-account and identity consortia, card-network risk services, device and email reputation networks, scam-payee sharing schemes. Value depends on contributor quality, coverage of your customer base, and how quickly negative data is reported. See Consortium and Data Sharing and Credit Bureau and Consortium Signals.
  • Breach and compromise data includes breached-password corpora (Breached Password Detection), compromised card data from networks and issuers, and infostealer-exposed session indicators where offered by reputable providers.
  • For peer sharing in the US, Section 314(b) of the USA PATRIOT Act lets eligible financial institutions that register with FinCEN share information about suspected money laundering and related activity under a safe harbor; industry groups and ISACs provide additional channels.
  • Public sources include FinCEN, FINRA, FTC, FBI IC3, CFPB, Nacha and the card networks. See Regulatory and Government Sources and Reports and Data Sources.
  • Contribute your own data. Most consortia are reciprocal, and a disciplined process to report confirmed fraud quickly improves everyone's data.

How to use it

  • Treat a consortium hit as a feature. It should raise risk and drive review or friction; automated denial on a single external hit generates false positives from stale or mistaken reports.
  • Combine external hits with internal signals. An external hit on a payee plus Fast In Fast Out Patterns on your side is near-conclusive. An external hit on a customer's bank account with clean internal history is a reason to verify the account, and too weak on its own to justify closing it.
  • Run each new advisory through a typology-to-controls pipeline. It should produce a documented review (do we see this? which signals cover it? what rules or model features change?) owned by Threat Intelligence and Horizon Scanning and executed through Fraud Strategy Lifecycle and Rule Governance and Change Management.
  • Use SAR key terms from advisories in filings so regulators can aggregate trends (BSA-AML and SAR Filing).
  • Measure each feed's value. Track hit rates, precision, incremental catch over internal signals, and latency of negative data, and renegotiate or drop feeds that don't earn their cost (Vendor Selection and Evaluation).

Strengths and limitations

Strengths: sees attacks before they reach you; strong for mule accounts, scam payees and reused infrastructure; typology intelligence improves design quality and speed.

Limitations: coverage gaps (small institutions, fintechs, cross-border); reporting lag; inconsistent labeling across contributors (scam victims sometimes reported as fraudsters); vendor claims are hard to verify without a proof of concept on your data. Fresh resources have no history, and lists can be degraded by rotation, which is why entity intelligence must be one input among many. Public advisories describe patterns already in circulation, so horizon scanning has to look further ahead.

False positives and fairness

  • Victims reported as perpetrators: unwitting mules and scam victims often appear on negative lists after being used once.
  • Recycled phone numbers and reassigned emails carry someone else's history.
  • Shared IPs and carrier infrastructure.
  • Customers who were victims of identity theft with fraudulent activity in their name elsewhere.

Provide an adverse-action and correction process, and avoid permanent exclusion based on a single external report.

Privacy and compliance considerations

Consortium data used for eligibility decisions may be subject to FCRA, requiring permissible purpose, adverse action notices and dispute rights, so get legal review per use case. Section 314(b) sharing is open to BSA-covered financial institutions and associations of them. Each must file a notice with FinCEN, which lasts one year and must be renewed, and must take reasonable steps (FinCEN's participant list or direct confirmation) to verify that the counterparty's notice is current. Shared information may be used only to identify and report money laundering or terrorist activity, decide whether to open or maintain an account or conduct a transaction, or meet BSA obligations, and it must be protected under adequate security procedures. Missing any of these conditions forfeits the safe harbor (31 CFR 1010.540). FinCEN's June 2026 fact sheet confirmed that suspected fraud is within scope. SAR information itself still may not be shared outside allowed channels. Contracts should address data accuracy, retention and onward use. See Privacy and Data Use in Fraud Prevention and BSA-AML and SAR Filing.

Mechanisms it helps detect

Money Mules · Account Takeover (ATO) · Credential Stuffing · Authorized Push Payment (APP) Scams · Card Testing · Fraud Rings and Collusion · Fraud-as-a-Service Ecosystem · Generative AI and Deepfake Fraud · Synthetic Identity Fraud

Payee and Counterparty Risk · Credit Bureau and Consortium Signals · IP Reputation and Proxy Detection · Negative Lists and Deny Lists · Consortium and Data Sharing · Breached Password Detection · Threat Intelligence and Horizon Scanning · Playbook - Novel Attack Detection Members · Communities and Conferences

Sources and further reading