Fraud Analyst Onboarding Curriculum
A 30/60/90-day onboarding curriculum for new transaction fraud analysts, sequenced through this vault: money paths, mechanisms, signals, controls, regulation, QA and graduation criteria.
Core components
Design principles
- Money path first. Every lesson connects back to where value enters, moves and leaves. See Payment Rails Map and Customer Lifecycle Map.
- Mechanism → signal → control → playbook. The vault's structure is the curriculum's structure (see Start Here).
- Graded practice before live decisions. Synthetic and historical cases with known outcomes come before production queues.
- Gradual authority. Read-only, then recommend, then decide with second review, then decide independently, with value limits by stage.
- QA as teaching. Early QA sampling is heavier and feedback is faster. See Fraud QA Program.
- Defender perspective. Training explains how fraud works conceptually and how to detect it. It never trains people to commit it.
The 30/60/90 plan
Days 1–30: foundations
| Week | Topics | Vault reading | Practice |
|---|---|---|---|
| 1 | Company products, money map, rails and reversibility; policies, privacy and access rules; insider-risk expectations | Start Here · Payment Rails Map · Customer Lifecycle Map · Glossary · Privacy and Data Use in Fraud Prevention · Insider Access Controls | Draw your company's money map from memory; tool access and navigation exercises |
| 2 | Account-level enablers: ATO and fake/farmed accounts, and how they turn into transaction loss | Account Takeover (ATO) · Account Recovery Abuse · Payout Redirection · Fake Account Creation (Bots) · Multi-Accounting | 20 graded historical cases (ATO vs legit account changes) |
| 3 | Signals: device, network, identity, behavior; what each can and can't tell you | Device Fingerprinting · IP Reputation and Proxy Detection · Account Change Events · Velocity Signals · Customer Tenure and History | Signal interpretation drills: given a timeline, list supporting and contradicting evidence |
| 4 | Your primary queue's mechanisms and SOP; case notes; decision rights | Queue-specific mechanism notes (e.g., ACH Funding Fraud, Receipt Fraud (Cashback), Refund and Return Fraud) · Case Documentation Standards · Alert Review Operations | Live decisions with 100% second review; daily feedback |
Day-30 checkpoint: ≥ 50 supervised live decisions; QA accuracy trending to target; can explain the money path for their queue and its reversal windows.
Days 31–60: independence on the core queue
| Week | Topics | Vault reading | Practice |
|---|---|---|---|
| 5 | Controls and friction: holds, limits, step-up, payee confirmation; the cost of false positives | Withdrawal and Payout Controls · Funds Availability Holds · Risk-Based Authentication and Step-Up · Friction and Customer Experience Tradeoffs | Decide with sampled second review (e.g., 25–50%); value cap on independent decisions |
| 6 | Scams vs unauthorized; victim handling; vulnerable customers | Authorized Push Payment (APP) Scams · Impersonation Scams · Elder Financial Exploitation · Scam Victim Indicators · Customer Education and Scam Warnings | Role-play customer calls; classify 20 cases as scam vs unauthorized with facts recorded |
| 7 | Regulation in practice: Reg E clocks, SAR referrals and confidentiality, network/Nacha basics, broker-dealer holds where relevant | US Regulatory Overview · Regulation E and Unauthorized Transfers · BSA-AML and SAR Filing · Nacha Rules and ACH Risk · Card Network Dispute Rules · Broker-Dealer Obligations (FINRA and SEC) | Clock quiz; draft a referral from a case; tipping-off scenarios |
| 8 | Second mechanism family (pick by business: payments, rewards, marketplace or brokerage) | E.g., Card-Not-Present Fraud · Chargeback and Friendly Fraud · Card-Linked Offer Abuse · Buyer Protection Claim Abuse (INR and SNAD) · ACATS Transfer Fraud | Graded cases in the second family |
Day-60 checkpoint: independent on the core queue within value limits; QA accuracy at target for two consecutive weeks; zero critical errors (e.g., missed regulatory clock, tipping off).
Days 61–90: breadth and investigation
| Week | Topics | Vault reading | Practice |
|---|---|---|---|
| 9 | Organized fraud: mules, rings, collusion; link analysis | Money Mules · Fraud Rings and Collusion · Entity Link Analysis · Graph Analytics | Investigate a synthetic ring case; produce a link chart and narrative |
| 10 | Emerging threats and how adversaries adapt | Generative AI and Deepfake Fraud · Agentic Commerce Fraud · Fraud-as-a-Service Ecosystem · Threat Intelligence and Horizon Scanning | Read three recent public alerts or advisories; present implications for your queue |
| 11 | Metrics and labels: how decisions become data | Fraud Metrics and KPIs · Fraud Labeling and Feedback Loops · Loss Taxonomy and Attribution | Code 30 closed cases with mechanism, actor, initiator; compare to QA |
| 12 | Industry lens and case studies | Relevant Industries Index note · Case Studies Index (e.g., Case Study - Chase Infinite Money Glitch (2024), Case Study - DraftKings Credential Stuffing (2022)) | Pattern memo: one page on a pattern seen in your queue, with evidence and a proposed control |
Graduation (day 90): QA accuracy at or above target over 4 weeks; calibration agreement with peers at target; zero critical errors in last 30 days; pattern memo reviewed by strategy; manager sign-off. Remove value caps per policy.
Members-tier extension
Vetted members can attach the matching playbooks for operational detail (detection logic, review checklists, QA criteria), e.g., Playbook - Account Takeover Members, Playbook - Payout and Withdrawal Risk Members, Playbook - Scam Intervention Members, Playbook - Receipt and Offer Fraud Members, Playbook - ACH Funding Fraud Members, Playbook - Chargeback Management Members.
Authority ladder
| Stage | Authority | Review |
|---|---|---|
| Observe | Read-only | None |
| Recommend | Proposes decision; mentor decides | 100% |
| Supervised decide | Decides; second reviewer confirms before action on high-value or irreversible | 100% → 50% |
| Independent (capped) | Decides within value and type limits | Sampled QA (elevated rate) |
| Independent | Full queue authority | Standard QA sampling |
How to build it
- Owner: ops training lead or a senior analyst with QA partnership. Strategy contributes mechanism content; compliance reviews regulatory modules.
- Assets: a case library of historical cases with known outcomes (anonymized for training use, access-controlled) and synthetic cases for edge conditions. Refresh quarterly with new patterns.
- Mentors: one per new analyst, with protected time.
- Cohorts: if hiring in groups, run cohort sessions for calibration and peer learning.
- Continuous learning after day 90: monthly pattern reviews, quarterly calibration, annual regulatory refresh.
Artifacts and templates
Onboarding tracker (per analyst)
- Access provisioned with least privilege; acceptable-use and confidentiality acknowledged
- Week 1–4 readings completed; quiz scores logged
- Graded case sets: ATO, primary queue, scams, second family, ring investigation
- Supervised decision count and QA scores by week
- Regulatory clock and tipping-off assessments passed
- Pattern memo submitted and reviewed
- Graduation sign-off and authority change logged
Graded case design checklist
- Known outcome with matured label
- Mix of fraud, legitimate and ambiguous (so analysts learn not to over-flag)
- Includes first-party and scam cases as well as third-party
- Timeline, device, transaction and contact data present
- Answer key with reasoning as well as the outcome
Metrics
- Time to independence (days to capped and full authority)
- QA accuracy curve by week vs cohort benchmarks
- Critical error rate in first 90 days
- Calibration agreement with experienced analysts
- 90-day retention
- Patterns raised by new analysts that led to rule or SOP changes
Pitfalls
- Using shadowing as the whole program. People copy habits, including bad ones.
- Teaching only the SOP. Analysts who don't understand the money path can't spot new attacks.
- Training only on fraud cases. Analysts then over-decline, so include legitimate look-alikes.
- Skipping regulation. Missed Reg E clocks or tipping off are expensive errors made by well-meaning new staff.
- Having no graduation criteria, so authority creeps without evidence of readiness.
Related
- Fraud Team Hiring and Career Paths · Fraud QA Program · Alert Review Operations · Manual Review Queues
- Investigation Standards · Case Documentation Standards · Support Team Fraud Training
- Start Here · Mechanisms Index · Signals Index · Controls Index · Playbooks Index Members
Sources and further reading
- Federal Reserve, FraudClassifier model: shared classification vocabulary to teach new analysts
- Federal Reserve, ScamClassifier model: scam categories and types for classification exercises
- FINRA Regulatory Notice 23-06 (Mar 2023): ACATS warning signs suitable for brokerage training modules
- Interagency statement on elder financial exploitation (Dec 2024): recurring training on red flags and escalation
- FinCEN Alert on deepfake media fraud (Nov 2024): example advisory for emerging-threats week
- CFPB, Regulation E §1005.11: clocks analysts must know for claims queues
- McHugh, Interrater reliability: the kappa statistic (2012): calibration agreement measurement