Fraud Operating Model
How to organize a transaction fraud function: strategy, operations, analytics, data science, engineering and policy; centralized vs embedded topologies; decision rights, cadences and reporting lines.
Core components
The six capabilities
Every transaction fraud function, whatever its size, needs these six capabilities. Early on one person may hold three of them. At scale each is a team.
| Capability | Owns | Key outputs | Typical roles |
|---|---|---|---|
| Fraud strategy | The decisioning logic and loss/friction trade-off for each money path | Rule sets, thresholds, step-up and hold policies, launch conditions, loss forecasts | Fraud strategy lead, strategy analysts, risk managers |
| Fraud operations | Human decisions: alert review, investigations, claims, account actions | Decisions within SLA, case records, labels | Ops manager, team leads, analysts, investigators |
| Fraud analytics | Measurement and insight | Loss reporting, KPI dashboards, root-cause analyses, attack sizing, rule performance | Fraud analysts, analytics engineers |
| Data science | Models and advanced detection | Scoring models, graph features, anomaly detection, experiment design | Data scientists, ML engineers |
| Fraud engineering / platform | Systems that make decisions possible | Rules engine, feature pipelines, case tooling, decision APIs, logging | Risk engineers, platform engineers, product manager |
| Fraud policy and governance | Standards and accountability | Fraud policy, SOPs, rule and model governance, QA, risk assessments, regulatory mapping | Policy lead, QA lead, risk and controls manager |
Two functions sit alongside these: investigations / special investigations (complex cases, rings, insiders, law enforcement liaison) and threat intelligence (external horizon scanning). Smaller organizations usually fold them into ops and strategy respectively. See Investigation Standards and Threat Intelligence and Horizon Scanning.
Topologies
| Model | Shape | Strengths | Weaknesses | Fits |
|---|---|---|---|---|
| Centralized | One fraud org owns all capabilities across all products | Consistent standards; shared data and tooling; no duplication; one loss view | Can be far from product context; can become a bottleneck; product teams see it as a gate | Early-stage, single-product, or highly regulated firms |
| Embedded | Fraud strategists and analysts sit within product or business-line teams | Close to product; fast iteration; fraud in the design from day one | Inconsistent standards; duplicated tooling; local loss optimization; fraud talent isolated | Large multi-product firms with mature platform tooling |
| Hub-and-spoke (federated) | Central hub owns platform, data, policy, QA, DS methods and the loss view; spokes embedded in product lines own strategy for their money paths | Product proximity plus consistent standards | Needs clear decision rights; dual reporting tension | Most organizations past about 30 fraud FTEs, or with 3+ distinct money paths |
| Center of excellence | A small central team sets standards; business lines own everything else | Light central cost | Weak accountability; standards become advisory | Conglomerates where business lines run independently |
Where fraud reports
Reporting line shapes incentives. There is no universally right answer, but each option leans a certain way:
| Reports to | Leans toward | Watch for |
|---|---|---|
| CFO / Finance | Loss minimization, budget discipline | Over-blocking good customers; underinvestment in CX |
| COO / Operations | Efficiency, SLAs, cost per case | Ops-heavy solutions; strategy underpowered |
| CRO / Risk | Control rigor, regulatory defensibility | Distance from product; slow change cycles; confusing first and second line roles |
| Product / CPO or GM | Conversion and growth alignment | Fraud subordinated to growth targets; promo abuse tolerated |
| CTO / Engineering | Platform investment, automation | Ops and policy underweighted |
| Compliance / BSA Officer | Regulatory alignment, SAR integration | Fraud treated as a compliance checkbox; slow to respond to fast-moving attacks |
In practice, the setup that holds up best has the head of fraud as a first-line leader reporting into a business or operations executive who owns the P&L impact of both losses and friction. A separate second-line fraud risk oversight role sits in risk or compliance. See Three Lines of Defense.
How to build it
Sequencing by stage
| Stage | Team size (illustrative) | Structure | Priority hires |
|---|---|---|---|
| Founding | 1–3 | One fraud lead plus part-time eng and support | A strategy-minded generalist who can write SQL, rules and SOPs (see Building a Fraud Program from Zero) |
| Early | 4–12 | Centralized; strategy and ops split | Ops lead; first analytics hire; a dedicated risk engineer |
| Scaling | 12–40 | Centralized with specialist pods per money path | Data science; QA lead; investigations; policy and governance |
| Mature | 40+ | Hub-and-spoke | Spoke strategy leads; platform PM; threat intel; second-line oversight |
Staffing is driven by alert volume, number of money paths, regulatory profile, and how much is automated. See Alert Review Operations for ops capacity math and Fraud Team Hiring and Career Paths for roles and ladders.
Decision rights
A written decision-rights table prevents most organizational fights. Agree on it explicitly and publish it.
| Decision | Decides | Must consult | Escalation if disputed |
|---|---|---|---|
| Fraud loss appetite and friction budget | Executive risk owner (business) | Head of fraud, finance, CX | Executive committee / board risk committee |
| Launch or kill a rule (within appetite) | Fraud strategy | Ops (capacity), analytics (impact) | Head of fraud |
| Emergency rule or block during an attack | Fraud on-call / incident commander | Notify strategy lead and product | Head of fraud, after the fact |
| Deploy or retire a model | Data science lead, with strategy sign-off | Model risk (where applicable), ops | Head of fraud; MRM committee |
| Thresholds that change approval rate beyond tolerance | Fraud strategy and product owner jointly | Analytics, CX | Executive risk owner |
| Product launch with residual fraud risk | Product owner accepts risk | Fraud strategy (documents risk), legal | Executive risk owner |
| SOP changes | Policy / ops lead | QA, strategy | Head of fraud |
| Account closure or offboarding policy | Fraud policy | Legal, compliance, CX | Head of fraud with legal |
| SAR referral standards | BSA/AML officer | Fraud ops, investigations | BSA officer (non-delegable) |
| Customer reimbursement policy for scams | Business owner | Fraud, legal, compliance, CX | Executive committee |
Operating cadences
| Cadence | Forum | Attendees | Inputs | Outputs |
|---|---|---|---|---|
| Daily | Ops stand-up | Ops leads, on-call strategist | Queue health, SLA, overnight attacks | Staffing moves, escalations |
| Daily | Loss and attack watch (async dashboard + alerting) | On-call strategist | Real-time loss, decline and alert anomalies | Incident declarations (see Fraud Incident Response) |
| Weekly | Strategy review | Strategy, analytics, DS, ops lead | Rule performance, new patterns, QA themes | Rule changes, investigations opened |
| Weekly | Rule change board (lightweight) | Strategy, eng, ops | Proposed changes | Approved changes (see Rule Governance and Change Management) |
| Bi-weekly | Launch review | Fraud strategy, product partners | Upcoming launches | Launch conditions (see New Product and Promo Launch Review) |
| Monthly | Fraud performance review | Head of fraud, business owners, finance, CX | KPIs, loss by mechanism, friction metrics, QA | Priorities, budget, appetite breaches |
| Monthly | QA findings review | QA, ops, strategy, policy | Findings register | SOP, rule, tooling and training actions (see Fraud QA Program) |
| Quarterly | Fraud risk committee | Executive risk owner, head of fraud, compliance, second line | Risk assessment updates, emerging threats, model risk | Risk acceptance, roadmap, appetite changes |
| Annually | Fraud risk assessment refresh | All of the above | Product and threat changes | Updated risk profile (see Fraud Risk Assessment) |
Artifacts and templates
Fraud charter outline
- Mission and scope: which money paths and mechanisms fraud owns, and which it doesn't (credit losses, AML, disputes ops)
- Accountabilities by capability
- Decision rights table
- Loss appetite and friction budget, and who sets them
- Interfaces with product, payments, support, compliance, legal, finance, security (see Cross-Functional Partnerships)
- Governance forums and cadences
- Metrics the function is held to (see Fraud Metrics and KPIs)
- Escalation paths, including after-hours
RACI: core fraud activities
| Activity | Strategy | Ops | Analytics | Data science | Engineering | Policy / QA | Compliance |
|---|---|---|---|---|---|---|---|
| Detection rules | A/R | C | C | C | R (deploy) | I | I |
| Scoring models | A (business use) | C | C | R | R | I | C (MRM) |
| Manual review decisions | C | A/R | I | I | C | ||
| SOPs | C | R | A | C | |||
| QA of decisions | I | C | A/R | I | |||
| Loss reporting | C | C | A/R | I | |||
| Labels and feedback | C | R | A | R | R | C | |
| Fraud tooling roadmap | R | R | C | C | A/R | C | |
| Incident response | A (IC) | R | R | C | R | I | C |
| SAR referrals | I | R | C | A | |||
| Launch review | A/R | C | C | C | C | C |
Org health checklist
- Every money path has a named strategy owner
- Every rule and model in production has an owner (see Rule Governance and Change Management, Model Risk Management)
- One loss ledger, reconciled with finance, with a mechanism taxonomy (see Loss Taxonomy and Attribution)
- Decision rights are written down and the business has accepted them
- A 24/7 on-call rotation exists, with authority to act
- QA is independent of the queues it grades
- Data science and ops meet at least monthly about labels and model behavior
- Fraud review is a default step in the launch process
- A second-line oversight function exists or is planned, where regulation requires it
Metrics
Measure the operating model itself as well as fraud outcomes:
| Metric | Signals |
|---|---|
| Time to mitigate a new attack (detection to effective control) | Decision rights and engineering access |
| Rule and model change lead time | Governance friction vs agility |
| Share of launches reviewed before launch | Fraud's integration with product |
| Unowned rules or models | Governance hygiene |
| Analyst attrition and time-to-proficiency | Ops sustainability |
| Total cost of fraud (losses + ops + friction) | Whether the model optimizes the right objective |
| Escalations to executive tie-break | Too many means decision rights are unclear |
Pitfalls
- Fraud as a cost center measured only on losses. The team will over-block, and growth will route around it.
- Strategy without engineering access. If every rule change waits on an engineering sprint, attackers have weeks. Fraud needs dedicated engineering capacity or a self-serve rules platform (see Rules Engine).
- Data science in isolation. Models built without ops input on labels and features underperform, and ops overrides them.
- Embedded too early. Embedding before platform and standards exist gives you N inconsistent fraud programs.
- Merging fraud and AML without designing for it. The functions share data and investigators but have different objectives, clocks and regulators, so a combined function has to be designed for all of them. See BSA-AML and SAR Filing.
- Outsourced ops without QA and access controls. Outsourced review teams are a known Insider Fraud vector. See Insider Access Controls.
- One person holding all the context. Bus-factor risk is acute in small fraud teams. Document SOPs and rules from day one.
Related
- Fraud Program Overview · Three Lines of Defense · Fraud Maturity Model · Building a Fraud Program from Zero · Cross-Functional Partnerships
- Fraud Team Hiring and Career Paths · Fraud Analyst Onboarding Curriculum
- Fraud Data Architecture · Real-Time Decisioning Architecture · Vendor Selection and Evaluation
Sources and further reading
- COSO/ACFE Fraud Risk Management Guide, 2nd ed., Executive Summary (2023): the five fraud risk management principles, including governance and the control environment
- IIA press release: COSO releases Fraud Risk Management Guide 2nd edition (May 2023): what changed in the 2023 edition, including expanded data analytics guidance
- GAO-15-593SP Highlights: leading practice of a dedicated antifraud entity with defined responsibilities and authority
- IIA Statements of Position: Three Lines Model (2026): updated Three Lines Model guidance on roles and coordination
- Mayer Brown, The Blurred Lines of Organizational Risk Management (2020): first- and second-line roles and the flexibility in the 2020 model