Fraud Program Overview

Hub for building a transaction fraud program: the components, how they connect along the money path, where to start, and links to every Program note in the vault.

Core components

A transaction fraud program has six layers. They're all organized around the money path: where value enters, moves and leaves, and the decision points in between (see Payment Rails Map and Customer Lifecycle Map).

Diagram: Governance & accountability, Strategy & detection, Operations & response, Measurement & labels, Learning & adaptation, People & partnerships, Data & technology

Layer	What it answers	Program notes
Organization and accountability	Who owns fraud loss, friction and decisions?	Fraud Operating Model · Three Lines of Defense · Cross-Functional Partnerships · Fraud Maturity Model · Building a Fraud Program from Zero
Governance	How are risks assessed, launches reviewed and rules and models controlled?	Fraud Risk Assessment · New Product and Promo Launch Review · Fraud Strategy Lifecycle · Rule Governance and Change Management · Model Risk Management · Friction and Customer Experience Tradeoffs · Experimentation and Champion-Challenger
Operations	How are alerts reviewed, cases investigated, decisions QA'd and attacks handled?	Alert Review Operations · Fraud QA Program · Investigation Standards · Case Documentation Standards · Fraud Incident Response · Support Team Fraud Training · Threat Intelligence and Horizon Scanning
Measurement	Are we winning, and what does it cost?	Fraud Metrics and KPIs · Loss Taxonomy and Attribution · Fraud Labeling and Feedback Loops
Data and technology	Can we see, decide and act in time?	Fraud Data Architecture · Real-Time Decisioning Architecture · Vendor Selection and Evaluation
Regulatory	What are we obliged to do?	US Regulatory Overview · BSA-AML and SAR Filing · Regulation E and Unauthorized Transfers · Nacha Rules and ACH Risk · Card Network Dispute Rules · Broker-Dealer Obligations (FINRA and SEC) · Privacy and Data Use in Fraud Prevention
People	Who do we hire and how do they grow?	Fraud Team Hiring and Career Paths · Fraud Analyst Onboarding Curriculum

How the pieces connect

Risk assessment identifies where the money path is exposed. Launch review stops new exposure being created unreviewed.
The strategy lifecycle turns hypotheses (from losses, ops, QA and intel) into rules and models, governed by rule governance and model risk management and measured by experimentation.
Alert review, investigations and support carry out human decisions. QA checks them and feeds findings back into SOPs, rules, models and training.
Incident response handles attacks that outrun normal controls. Threat intelligence shortens the time before you notice them.
Metrics, labels and loss taxonomy make it measurable, and friction economics keep it honest about cost to good customers.
The operating model and three lines decide who does each of these, and who checks.

Frameworks behind this section

Framework	Use it for
COSO/ACFE Fraud Risk Management Guide (2nd ed., 2023)	Five principles: control environment, risk assessment, control activities, information and communication (including investigation and corrective action), monitoring. A good checklist for program completeness.
GAO Fraud Risk Framework (GAO-15-593SP, 2015)	Commit / Assess / Design and implement / Evaluate and adapt; a dedicated antifraud entity; risk tolerance. Written for the public sector, but the structure transfers well.
IIA Three Lines Model (2020; refreshed July 2026)	Roles and assurance: who owns, oversees and audits fraud risk
Interagency MRM guidance (SR 26-2 / OCC 2026-13, April 2026)	Governing fraud models; replaced SR 11-7
FraudClassifier and ScamClassifier models (Federal Reserve-hosted industry work)	Consistent classification of fraud and scams for labels and reporting

See Frameworks and Taxonomies for more.

How to build it

Where to start, by situation

Situation	Start with	Then
No fraud function yet	Building a Fraud Program from Zero	Fraud Operating Model, Fraud Risk Assessment
Losses spiking now	Fraud Incident Response	Threat Intelligence and Horizon Scanning, Fraud Strategy Lifecycle
Promo or launch losses	New Product and Promo Launch Review	Promotion Design Guardrails, Cross-Functional Partnerships
Rules sprawl, falling approval rates	Rule Governance and Change Management	Friction and Customer Experience Tradeoffs, Experimentation and Champion-Challenger
Review queues overwhelmed	Alert Review Operations	Fraud QA Program, Fraud Strategy Lifecycle
Inconsistent analyst decisions	Fraud QA Program	Case Documentation Standards, Fraud Analyst Onboarding Curriculum
Sponsor bank or regulator scrutiny	Three Lines of Defense	Model Risk Management, Rule Governance and Change Management, US Regulatory Overview
Support-driven ATO	Support Team Fraud Training	Customer Support Verification Protocols, Secure Account Recovery Design
Board asks "how good are we?"	Fraud Maturity Model	Fraud Metrics and KPIs

Program completeness checklist

A named owner for fraud loss and friction on every money path (Fraud Operating Model)
Written decision rights and loss appetite (Three Lines of Defense)
A current fraud risk assessment per money path (Fraud Risk Assessment)
Mandatory launch review for new value paths and incentives (New Product and Promo Launch Review)
Rule inventory with owners, tiers and review dates (Rule Governance and Change Management)
Model inventory, validation and monitoring (Model Risk Management)
Some measured counterfactual: holdouts or champion-challenger (Experimentation and Champion-Challenger)
Friction budget and good-customer cost measured (Friction and Customer Experience Tradeoffs)
Queues with SLAs tied to money movement (Alert Review Operations)
QA with calibration, covering manual and automated decisions (Fraud QA Program)
Investigation and documentation standards (Investigation Standards, Case Documentation Standards)
Incident severity, roles, levers and post-mortems (Fraud Incident Response)
Intel with owners and a feedback loop (Threat Intelligence and Horizon Scanning)
Support trained, with protocols and QA (Support Team Fraud Training)
One loss ledger with taxonomy (Loss Taxonomy and Attribution)
Labels with defined sources and maturity (Fraud Labeling and Feedback Loops)

Artifacts and templates

Copyable artifacts across the Program section:

Artifact	Where
Decision rights table, fraud charter outline, core RACI	Fraud Operating Model
Fraud policy outline, governance RACI, second-line KRIs	Three Lines of Defense
Maturity rubric and self-assessment worksheet	Fraud Maturity Model
30/60/90 plan, first controls by money path	Building a Fraud Program from Zero
Partner working agreements, abuse-adjusted promo ROI	Cross-Functional Partnerships
Risk register columns, rating scales	Fraud Risk Assessment
Launch checklists, hypercare tripwires, launch RACI	New Product and Promo Launch Review
Strategy proposal template, acceptance criteria	Fraud Strategy Lifecycle
Rule inventory fields, change request, portfolio review	Rule Governance and Change Management
Model documentation outline, change classification	Model Risk Management
Friction impact statement	Friction and Customer Experience Tradeoffs
Experiment brief and readout	Experimentation and Champion-Challenger
Intel item and horizon-scan templates	Threat Intelligence and Horizon Scanning
Queue definition, capacity math	Alert Review Operations
QA rubric, QA form, sampling math, kappa	Fraud QA Program
Investigation plan and checklist	Investigation Standards
Case note and SAR referral templates	Case Documentation Standards
Incident roles, first-hour checklist, post-mortem	Fraud Incident Response
Support curriculum and quick-reference card	Support Team Fraud Training

Metrics

Program-level metrics, detailed in Fraud Metrics and KPIs:

Outcome: net fraud loss (bps of volume) by money path; total cost of fraud including friction
Efficiency: review rate, cost per decision, automation share
Quality: QA accuracy and critical error rate; label accuracy
Speed: time to detect, time to mitigate new attacks
Coverage: money paths with current risk assessments; launches reviewed; rules and models with owners
Customer: insult rate, complaint rate, scam-victim funds protected

Pitfalls

Building controls without a program. Point solutions decay without ownership, governance and measurement.
Building a program without controls. You end up with policy binders that don't change decisions.
Optimizing losses alone. The total cost includes good customers.
Program by incident. Every investment follows the last attack, and the largest exposure may never get funded.
Copying a bank's program into a rewards app, or the reverse. Match program weight to your rails, regulators and risk profile (see the industry notes: Brokerage and Investing, Cashback, Coupons and Rewards, Online Marketplaces, Neobanks and Consumer Fintech, Payments and P2P, Retail and Ecommerce).

Maps: Program Index · Start Here · Mechanism to Control Matrix · Playbooks Index Members
Mechanisms Index · Signals Index · Controls Index
Glossary · Frameworks and Taxonomies · Reports and Data Sources

Sources and further reading

COSO/ACFE Fraud Risk Management Guide, 2nd ed., Executive Summary (March 2023): the five fraud risk management principles and their alignment with COSO 2013
ACFE, Fraud Risk Tools (COSO): Anti-Fraud Blueprint, scorecards and analytics tests that support the Guide
GAO-15-593SP, A Framework for Managing Fraud Risks in Federal Programs: leading-practice framework (July 2015)
GAO-15-593SP Highlights: the four components and the dedicated antifraud entity
IIA Statements of Position: Three Lines Model (July 2026): the current Three Lines Model statement
Federal Reserve SR 26-2, Revised Guidance on Model Risk Management (April 2026): interagency MRM guidance superseding SR 11-7
Federal Reserve FedPayments Improvement, FraudClassifier model: industry classification model for payment fraud