Frameworks and Taxonomies

How to use this page

Classification models for incidents

Federal Reserve FraudClassifier and ScamClassifier

What they are. These are two voluntary, question-based classification models published on the Federal Reserve's FedPayments Improvement site. The FraudClassifier model was developed by a Fed-convened Fraud Definitions Industry Work Group. It classifies payments fraud regardless of payment type or channel, and its first question is who initiated the payment: an authorized party or an unauthorized party. The ScamClassifier model was developed in 2024 by a Fed-convened scams work group. It rests on an agreed definition of a scam: deception or manipulation used to achieve financial gain. The two models are meant to work together. ScamClassifier can stand alone or be applied before or after FraudClassifier.

ScamClassifier works in four steps:

1. Scam check. Was deception or manipulation used for financial gain? If not, use FraudClassifier instead.
2. Result. Was the authorized party tricked into making a payment, or into giving a fraudster access to an account?
3. Deception method. This sorts the scam into one of two categories.
4. Scam type. Nine types sit across the two categories:

Why it's useful for a transaction fraud team

• The authorized/unauthorized split is the same line that drives liability under Regulation E and Unauthorized Transfers, the UK reimbursement regime (Case Study - UK APP Scam Reimbursement Rules (2024)), and most card and ACH dispute rights. If your loss codes don't capture it, you can't report scam losses separately from third-party fraud.
• Peer comparability. Issuers, processors and networks are adopting these models, so tagging incidents with them makes consortium data and peer benchmarking usable.
• QA-able labels. The question-based flow suits a Fraud QA Program rubric. Two reviewers who follow the same questions should reach the same label, and when they don't, you have found a calibration gap.

Limits. The models classify the incident, not the mechanism. A bank-impostor scam that ends in a real-time payment and a mule cash-out needs your own mechanism and rail tags as well. The models also don't cover retail and rewards abuse well: receipt fraud, promo abuse and refund abuse mostly fall into "authorized party, no scam," which is too coarse. Extend them with internal sub-codes.

The same Fed site hosts a recommended synthetic identity fraud definition (a combination of PII used to fabricate a person or entity), plus Fraud Mitigation Toolkits for scams, account takeover, check fraud and synthetic identity. See Synthetic Identity Fraud.

FinCEN identity-related typology (impersonation, compromise, circumvention)

FinCEN's 2021 Financial Trend Analysis of identity-related suspicious activity grouped identity exploitation into three buckets. Impersonation means posing as someone else. Compromise means taking over a legitimate credential or account. Circumvention means getting around identity controls. Identity-related reports made up about 42% of BSA reports that year. The three buckets map cleanly onto the vault's account-level enablers: compromise ≈ Account Takeover (ATO), impersonation ≈ Synthetic Identity Fraud and stolen-identity onboarding, circumvention ≈ control evasion at KYC and Customer Identification Program (CIP). That makes them a useful bridge between fraud labels and SAR narratives (BSA-AML and SAR Filing).

Regulation S-ID red flag categories

The SEC/CFTC Identity Theft Red Flags rule (Reg S-ID, 17 CFR Part 248 Subpart C) requires covered broker-dealers, investment companies and advisers to run a written identity theft prevention program. Its guidance groups red flags into these categories:

• alerts from consumer reporting agencies
• suspicious documents
• suspicious personal identifying information
• unusual account activity
• notices from customers, victims or law enforcement

For a brokerage fraud team this is the regulatory frame around Account Change Events, Login Anomalies and ACATS Transfer Fraud reviews. See Broker-Dealer Obligations (FINRA and SEC).

Frameworks for automated and account-level threats

OWASP Automated Threats to Web Applications (OAT)

What it is. An OWASP project, led by Tin Zaw and Colin Watson, that catalogs 21 automated threats as an ontology (OAT-001 to OAT-021). The project's central point is that most of these threats misuse valid functionality rather than exploit a vulnerability. That is why WAFs and pen tests miss them, and why fraud teams end up owning them.

The OATs most relevant to transaction fraud:

How to use it. Tag bot incidents and rules with OAT IDs so engineering, security and fraud share one name for "the thing hitting the login endpoint." The project's ontology decision chart is a quick triage aid during a live event (Fraud Incident Response). It is not a transaction taxonomy, though. It stops at the web or app request and says nothing about the money movement downstream.

MITRE frameworks

MITRE's Center for Threat-Informed Defense launched the Fight Fraud Framework (F3) on April 9, 2026. F3 is a behavior-based, ATT&CK-style model of cyber-enabled financial fraud, built from real incident data. Contributors include several large banks, FS-ISAC, RH-ISAC, the National Retail Federation and security firms. It has seven tactics covering the fraud lifecycle:

Fraud-specific techniques not in ATT&CK get F1xxx-series IDs. CTID says data sources and mitigations will follow.

Why it matters. F3 is the first shared vocabulary that spans the fraud and cyber teams. Its two new tactics, Positioning and Monetization, map directly onto this vault's money-path framing: the account-maintenance stage and the payout stage are where transaction defenses do most of their work. Tag incidents with F3 tactics alongside FraudClassifier labels. One tag says how the attack worked; the other says who initiated the payment.

Other MITRE frameworks. ATT&CK (enterprise adversary behavior) remains the reference for the enabler layer: infostealers, session theft, remote access (Session Hijacking and Infostealers, Remote Access Tool Detection). ATLAS covers attacks on AI systems, which matters as fraud teams deploy LLM triage and as attackers target AI agents (Agentic Commerce Fraud).

NIST SP 800-63-4 Digital Identity Guidelines

What it is. The fourth revision of NIST's digital identity guidelines. It was finalized in summer 2025 (CSRC lists July 2025) and supersedes 800-63-3. It has four volumes: the base document, 63A (identity proofing), 63B (authentication) and 63C (federation).

What changed that matters to fraud teams

• Fraud management becomes a requirement. In 63A-4, credential service providers shall run a fraud management program covering detection, investigation, reporting and resolution. The recommended fraud checks read like a fraud team's signal list: SIM swap detection, device and account tenure, device fingerprinting, transaction analytics and velocity checks. Knowledge-based verification is allowed only as a fraud-management input, not as identity verification. Independent testing such as red-teaming is encouraged.
• Forged media and injection attacks against remote proofing are now explicitly addressed. See Generative AI and Deepfake Fraud and Document Verification and Liveness.
• Syncable authenticators (synced passkeys) are accepted at AAL2 but not AAL3. Verifiers at AAL2 must offer at least one phishing-resistant option.
• SMS and voice OTP remain a "restricted" authenticator. Verifiers should check risk indicators such as SIM change, device swap and number porting before sending a code. Email is not allowed as an out-of-band authenticator.
• Passwords: length over complexity, no forced rotation, and blocklist checks against breached values (Breached Password Detection).

How to use it. Few private-sector fraud teams are bound by 800-63, yet it remains the most defensible public baseline for Multi-Factor Authentication (MFA), Secure Account Recovery Design and step-up policy, and the 63A fraud controls are a ready-made checklist for onboarding reviews.

Supervisory and governance frameworks

FFIEC guidance

• Authentication and Access to Financial Institution Services and Systems (August 11, 2021). Replaced the 2005 and 2011 FFIEC authentication guidance. It expects risk-assessment-driven authentication, calls single-factor authentication a weakness, supports layered security, recommends MFA or controls of equivalent strength, and specifically flags push-payment risk. Use it to justify Risk-Based Authentication and Step-Up and Payee Confirmation and Payment Friction investments.
• BSA/AML Examination Manual. How examiners assess BSA/AML programs, including appendices with red flags. This is where fraud-to-AML handoffs get tested (BSA-AML and SAR Filing).
• IT Examination Handbook. The Retail Payment Systems and Information Security booklets frame examiner expectations for payment-channel controls.

COSO/ACFE Fraud Risk Management Guide (2nd edition, 2023)

Published May 2023 by COSO with the Association of Certified Fraud Examiners. It operationalizes Principle 8 of COSO's 2013 Internal Control framework (consider the potential for fraud when assessing risk). It is organized around five areas:

1. fraud risk governance
2. fraud risk assessment
3. preventive and detective control design
4. investigation and corrective action
5. monitoring and evaluation

The second edition expanded its treatment of data analytics. It is written mostly for occupational and financial-statement fraud, so translate "controls" into transaction-level Rules Engine, Machine Learning Models and Manual Review Queues. It remains the best one-document justification for a Fraud Risk Assessment cadence and a Fraud Maturity Model.

GAO Fraud Risk Framework (2015)

The U.S. GAO's framework for federal programs has four components: commit, assess, design and implement, evaluate and adapt. Its practical advice transfers directly to any program that hands out money, such as promotions, rebates and instant credit. Set a risk tolerance, build a fraud risk profile of residual risks, prefer preventive controls, and use detected cases to adapt. It pairs well with New Product and Promo Launch Review.

IIA Three Lines Model

The Institute of Internal Auditors' model defines three roles:

• First line: management owns and manages risk.
• Second line: specialist risk and compliance functions provide expertise, challenge and monitoring.
• Third line: internal audit provides independent assurance and reports to the governing body.

The IIA re-issued the model as a revised Statement of Position on July 8, 2026, replacing its earlier (2020) position paper while keeping the model's core structure. It emphasizes coordination and reliance between the lines rather than rigid "defense" walls, and safeguards where roles overlap. For fraud this answers the recurring questions: who owns rule changes, who challenges model performance, and who audits the QA program. See Three Lines of Defense and Rule Governance and Change Management.

Federal Reserve SR 26-2 (model risk management)

On April 17, 2026, the Federal Reserve, OCC and FDIC issued SR 26-2, revised model risk management guidance that supersedes SR 11-7 (2011) and SR 21-8 (BSA/AML models). It is described as most relevant to banking organizations with more than $30 billion in total assets. Fraud scores and scam classifiers built on complex quantitative methods fall inside its scope; deterministic rules are outside the model definition, and generative or agentic AI tools such as LLM-based triage are explicitly excluded and belong under broader AI governance. See Model Risk Management.

CISA Insider Threat Mitigation Guide

CISA's guide is a scalable program framework in four stages: define, detect and identify, assess, and manage. It is useful as the backbone for Insider Fraud programs, especially where outsourced support agents can change contact details or payout destinations (Insider Access Controls).

Rail and network taxonomies

These are the taxonomies your counterparties use. Your internal loss codes must translate into them without losing information.

Card network dispute reason codes

Card network programs that act as de facto taxonomies:

• Visa Compelling Evidence 3.0 (effective April 15, 2023). Lets merchants defend 10.4 disputes by showing prior undisputed transactions that share device/IP and other identity elements with the disputed one. It operationalizes the First-Party Fraud vs third-party distinction.
• Visa Acquirer Monitoring Program (VAMP). Replaced the separate dispute and fraud monitoring programs on April 1, 2025, with enforcement from October 2025. It counts fraud reports plus disputes against settled card-not-present volume, and it measures enumeration separately (Card Testing).
• Mastercard First-Party Trust (announced October 2023, built with the Merchant Advisory Group and Merchant Risk Council). Merchants share richer transaction data to separate genuine third-party fraud from friendly fraud.

See Card Network Dispute Rules, Chargeback and Friendly Fraud and Playbook - Chargeback Management Members.

Nacha ACH return reason codes

ACH return codes are an outcome taxonomy, and fraud teams use them as labels:

Since 2020–2021, R10 means "no authorization / originator unknown" and R11 means "authorized, but the entry doesn't match the terms." Both count as unauthorized. Treating R11 as an error rather than fraud understates ACH Funding Fraud. Nacha's 2026 risk management rules add credit-push fraud monitoring duties for originators, third-party senders and ODFIs, with risk-based processes for RDFIs. They phase in March 20 and June 19/22, 2026. See Nacha Rules and ACH Risk.

Other standards worth knowing

• EMV 3-D Secure (EMVCo). The issuer authentication protocol behind 3-D Secure and Card Verification. EMVCo recommends v2.2 or higher, and v2.4 was in draft as of mid-2026.
• FIDO passkeys. The FIDO Alliance reported roughly 5 billion passkeys in use (May 2026). See Passkeys and Phishing-Resistant Authentication.
• C2PA Content Credentials. An open provenance standard that cryptographically records an image's origin and edits. It will matter for Receipt and Document Image Forensics as more cameras and apps sign captures. Absence of credentials is not evidence of forgery.
• UK PSR APP reimbursement requirement. Mandatory reimbursement for Faster Payments APP scams from October 7, 2024, capped at £85,000 per claim. It is the first large-scale liability framework built on the authorized/unauthorized split. See Authorized Push Payment (APP) Scams.

How The Outlier Lab maps to these frameworks

Related

• Glossary · Reports and Data Sources · Regulatory and Government Sources · Vendor Landscape
• US Regulatory Overview · Fraud Metrics and KPIs · Threat Intelligence and Horizon Scanning

Sources and further reading

• FraudClassifier Model: FedPayments Improvement: model purpose, work group, authorized vs unauthorized starting question, use with ScamClassifier
• ScamClassifier Model: FedPayments Improvement: four steps, two categories, nine scam types
• Scams: FedPayments Improvement: 2024 development by Fed-convened work group; scam definition
• Synthetic Identity Payments Fraud: FedPayments Improvement: industry SIF definition and toolkit
• FedPayments Improvement home: Payments Security initiative and Fraud Mitigation Toolkits
• FinCEN Financial Trend Analysis: Identity-Related Suspicious Activity (2021): impersonation/compromise/circumvention typology; 42% of BSA reports
• 17 CFR Part 248 Subpart C (Regulation S-ID): eCFR: identity theft program and red flag categories
• OWASP Automated Threats to Web Applications: project scope, leaders, ontology chart
• OWASP OAT-008 Credential Stuffing (wiki): example OAT definition
• OATv2 concise guide (community summary on GitHub): secondary list of OAT-001 to OAT-021 names
• MITRE CTID launches framework to combat financial fraud: F3 launch date, publisher, contributors, relationship to ATT&CK
• MITRE releases a shared fraud-cyber framework: Help Net Security: F3's seven tactics, new Positioning and Monetization tactics, F1xxx technique IDs
• NIST SP 800-63-4 (CSRC): final status, July 2025, supersedes 800-63-3
• NIST SP 800-63-4 overview: volumes and major changes
• NIST SP 800-63A-4: fraud management program requirements and recommended checks
• NIST SP 800-63B-4: syncable authenticators, phishing resistance, restricted PSTN OTP, password guidance
• FFIEC authentication guidance press release (via NCUA): August 2021 guidance replacing 2005/2011 documents
• FFIEC BSA/AML Examination Manual: exam structure and red-flag appendices
• FFIEC IT Examination Handbook: Retail Payment Systems and Information Security booklets
• COSO/ACFE Fraud Risk Management Guide: ACFE: second edition and its five areas
• COSO releases Fraud Risk Management Guide 2nd edition: IIA: May 2, 2023 release and what changed
• GAO-15-593SP Fraud Risk Framework highlights: commit/assess/design and implement/evaluate and adapt
• IIA Statements of Position: Three Lines Model statement published July 8, 2026
• IIA Three Lines Model statement (PDF): principles and roles
• CRI Advisors, IIA Three Lines Model update (Aug 2026): July 2026 revision retains the core structure
• Federal Reserve SR 26-2: revised model risk management guidance replacing SR 11-7
• CISA Insider Threat Mitigation Guide: four-stage insider threat framework
• Visa and Mastercard chargeback reason codes: Solidgate docs: secondary summary of network reason code structures
• Visa Compelling Evidence 3.0 FAQ: Adyen: CE 3.0 requirements and April 2023 effective date
• VAMP explainer: Chargeflow: VAMP dates, ratio definition (secondary; confirm with your acquirer)
• Mastercard First-Party Trust announcement: October 2023 program for friendly fraud
• ACH Return Reason Code Resource: EPCOR: return codes and timeframes
• Differentiating Unauthorized Return Reasons: Nacha: R10 vs R11 definitions and dates
• Nacha Fraud Monitoring Phase 1: who is covered from March 20, 2026
• EMV 3-D Secure: EMVCo: protocol purpose and versions
• The State of Passkeys 2026: FIDO Alliance: ~5 billion passkeys in use
• C2PA Explainer 2.3: Content Credentials provenance model and limits
• PSR policy statement confirming maximum reimbursement: £85,000 cap from October 7, 2024