Fraud Tabletop Exercises
Designing and running tabletop exercises for fraud attacks, logic exploits and payout incidents: objectives, roles, scenario libraries for retail and financial firms, injects, scoring with an exposure clock, and after-action.
Core components
Exercise types
The U.S. Homeland Security Exercise and Evaluation Program (HSEEP) splits exercises into discussion-based and operations-based types. The vocabulary transfers well to fraud.
| Type | HSEEP meaning | Fraud translation | Use it for |
|---|---|---|---|
| Seminar | Orientation to a plan | Walk through the incident runbook with new on-call staff | Onboarding the IC rotation |
| Workshop | Build a product | Draft the containment lever menu or the clawback policy | Filling a known gap |
| Tabletop (TTX) | Key people discuss a simulated scenario | The core format of this note | Testing decisions, authority, communications |
| Game | Competitive simulation with rules | Red team vs blue team on a new product's abuse paths | Pre-launch review (New Product and Promo Launch Review) |
| Drill | Test one specific function | Actually flip a kill switch on a low-risk offer; pull an exposure report at 2 a.m. | Proving a lever works |
| Functional exercise | Coordination under simulated conditions, no field deployment | Synthetic alerts injected into real tools; real queues and dashboards | Testing tooling and handoffs |
| Full-scale | Multi-agency, real deployment | Joint exercise with a partner bank or processor | Rare; for high-dependency partnerships |
The FFIEC's business continuity booklet makes a related distinction for banks: exercises test people and processes, while tests verify system resilience. Fraud programs need both: a tabletop shows that the team would decide to freeze payouts; a drill shows that the freeze actually works.
Objectives
Write three to five objectives tied to the capabilities in Fraud Incident Response: detect, declare, contain, communicate, recover, report. Make them observable.
- "Within 15 minutes of the first data inject, the on-call analyst declares an incident or documents why not."
- "The incident commander identifies the money-out path and chooses a reversible containment lever."
- "The team produces an exposure estimate (credited, pending, extracted) within 45 minutes."
- "Support has a holding message before the first customer-facing inject."
- "Compliance identifies every regulatory clock the scenario triggers."
Source objectives from your Fraud Risk Assessment, open findings from past post-mortems, new products and money paths, and what's changing in the attacks you face (Threat Intelligence and Horizon Scanning).
Roles
| Role | Responsibility |
|---|---|
| Exercise sponsor | Executive who sets the scope and makes sure corrective actions get resourced |
| Planners (trusted agents) | Design the scenario. They know the script, so they don't play. |
| Facilitator | Runs the room, keeps time, asks probing questions, stops anyone fighting the scenario |
| Controller | Delivers injects on schedule; adapts to what players do |
| Evaluators | Observe against objectives using an evaluation guide. HSEEP stresses these aren't report cards. |
| Scribe | Records decisions, times, open questions, assumptions |
| Players | The people who would really respond (see roster) |
| Observers | Watch, don't play |
Player roster. Fraud strategy, fraud ops lead, the person who would be incident commander, engineering on-call for the affected product, product owner, payments operations or treasury, customer support lead, communications, legal, compliance or the BSA officer, finance, and partner management (bank partner, processor, card network, retail partners). Add the vendor manager if an outsourced team is involved. Send the people who'd actually be paged instead of their managers' delegates.
Scenario design principles
- Ground it in your money paths. Use your products, rails, limits and tooling. A generic "fraud attack" teaches nothing.
- Use plausible, documented patterns. Public cases (Case Study - Pinduoduo Coupon Exploit (2019), Case Study - Chase Infinite Money Glitch (2024), Case Study - DraftKings Credential Stuffing (2022), Case Study - Robinhood Infinite Leverage Glitch (2019), Case Study - Arup Deepfake Video Call (2024)) are good starting points, adapted to your stack.
- Describe effects. Injects show what the defender would see: dashboards, tickets, partner emails, posts. They don't need, and shouldn't contain, how the attack was executed. Treat exercise materials as internal and sensitive anyway, because they map your weaknesses.
- Build in ambiguity. Real incidents start as "is this real?" Make the first injects inconclusive.
- Add a second problem. The lever that should work doesn't, the owner is unreachable, or the containment breaks something else.
- Include customers. Victims, good customers caught by the containment, and the support queue.
- Run it in compressed time. A two-hour exercise can cover the first day of an incident, with time jumps announced by the facilitator.
- Test after-hours. Many of the worst incidents start on Friday evenings and holiday weekends, when authority and access are thinnest.
Scenario library
| Scenario | Industry | Mechanisms | Key decisions tested |
|---|---|---|---|
| A card-linked offer stacks with a sign-up promo and goes viral on a Friday evening | Cashback and rewards | Business Logic Exploitation, Promo Code Abuse, Sign-Up Bonus Abuse | Who can pause the offer; freezing redemptions on affected credits; clawback policy and customer messaging |
| Receipt rejections spike after a retailer changes its receipt layout, while a real ring exploits the confusion | Cashback and rewards | Receipt Fraud (Cashback) | Separating a false-positive storm from an attack; SOP emergency directive |
| Credential-stuffing success leads to contact changes, then withdrawals to new bank accounts | Brokerage | Credential Stuffing, Account Takeover (ATO), Payout Redirection | Forced resets, holds on new destinations, regulatory notification analysis (Broker-Dealer Obligations (FINRA and SEC)) |
| Compromised accounts buy the same thinly traded stock | Brokerage | Ramp-and-Dump via Account Takeover | Trading restrictions, coordination with surveillance, customer remediation |
| A social media "glitch" trend drives mobile deposits of bad checks and same-day ATM withdrawals | Neobank | Instant Funding Abuse (Kiting), Check and Mobile Deposit Fraud | Changing availability policy mid-incident within Reg CC (Regulation CC and Funds Availability); partner-bank coordination |
| Partner bank reports an unusual ACH return spike on accounts you funded | Neobank, brokerage | ACH Funding Fraud | Exposure quantification; return-rate thresholds (Nacha Rules and ACH Risk) |
| Impersonation scam wave pushes customers to send instant payments | Payments and P2P | Impersonation Scams, Real-Time Payment Rail Fraud | In-app warnings, payment friction, victim handling, Reg E analysis |
| Hijacked seller accounts change payout destinations before a holiday weekend | Marketplace | Seller Non-Delivery and Fake Listings, Payout Redirection | Payout holds, buyer protection exposure, seller comms |
| A payout file is processed twice, or a rounding change overpays thousands of users | Any | Operational payout incident (not fraud, same response muscles) | Recall options by rail; customer comms; recovery |
| The scoring service times out and the fallback approves everything | Any | Control failure | Fallback design; detection of the failure itself (Real-Time Decisioning Architecture) |
| An outsourced support agent is found processing fraudulent contact changes | Any | Insider Fraud | Access revocation, scoping affected accounts, vendor management |
| A cloned voice call to support leads to account recovery and a large transfer | Any | Generative AI and Deepfake Fraud, Account Recovery Abuse | Recovery-flow hardening, support verification (Customer Support Verification Protocols) |
Injects and the master scenario events list
The master scenario events list (MSEL) is the chronological script of injects, each with a time, a source, its content, the expected player action and the objective it tests. Inject types that work well for fraud:
- Data: a dashboard spike, an alert, a loss report
- Internal message: an engineer, finance or an executive asking for numbers
- Customer: a support escalation, a complaint, a victim calling
- External: partner bank, processor, card network, retail partner, regulator, press
- Social: a viral post or video
- Technical: a lever fails, a dashboard is stale, a vendor signal goes down
Scoring the plan
Score each objective as met, partially met, not met or not observed, with evidence from the scribe's log. Then add measures that matter specifically for fraud:
| Measure | What it shows |
|---|---|
| Time to declare | Whether thresholds for calling an incident are clear |
| Time to identify the money-out path | Whether people know the product's flows |
| Time to a containment decision | Authority and lever readiness |
| Lever quality | Reversible? Narrow enough? Did it protect money-out first? |
| Exposure answer | Could the team say what was credited, pending and extracted? |
| Communications | Support macro, customer message, partner notice, executive update: on time and accurate |
| Regulatory clocks | Identified and owned? |
| Assumptions exposed | "We'd just pause it": can you, and who? |
Hotwash and after-action
- Hold the hotwash immediately after: what worked, what didn't, what surprised people. Players speak first, then evaluators.
- Write the after-action report and improvement plan (AAR/IP). HSEEP guidance has the draft AAR circulated within about 30 days and the final AAR/IP, with corrective actions, owners and target dates, within about 60.
- Track corrective actions to closure in the same tracker as post-mortem actions from real incidents.
- Retest. The next exercise should include an inject that checks whether last time's top finding is fixed.
How to build it
Planning timeline (illustrative)
| When | Step |
|---|---|
| Six weeks before | Sponsor and objectives agreed; participants invited |
| Four weeks | Scenario drafted; MSEL built; evaluation guide written |
| Two weeks | Materials finalized: situation manual, player handout, inject cards, exposure clock |
| One week | Dry run with planners; check timing |
| Exercise day | Two to three hours: briefing, play in two or three modules, hotwash |
| Within 30 days | Draft AAR |
| Within 60 days | Final AAR/IP with owners and dates |
Maturity
| Stage | What it looks like | Next step |
|---|---|---|
| 1. None | Incident response is learned live | Run a seminar on the runbook |
| 2. Occasional | One tabletop a year, generic scenario | Use your own money paths; add an evaluator |
| 3. Regular | Quarterly rotating scenarios; AAR/IP tracked | Add drills that prove levers work |
| 4. Integrated | Exercises tied to risk assessment and launches; partners participate; after-hours scenarios | Functional exercises with synthetic alerts in real tools |
| 5. Adversarial | Red-team findings feed scenarios; exercise results feed control design | Measure improvement across exercises |
The readiness checklist in Fraud Incident Response calls for a tabletop at least every six months. Quarterly is better for teams running live promotions or instant money-out products.
Artifacts and templates
Sample MSEL for a Friday-evening cashback offer exploit (abridged)
| Time | Inject | Source | Expected action | Objective |
|---|---|---|---|---|
| 0:00 | Redemptions on one card-linked offer at many times normal volume; average reward far above design | Monitoring alert | On-call triages and pages strategy | Detect |
| 0:10 | Support sees a cluster of "where's my bonus" tickets, mostly from new accounts | Support lead | Recognize the new-account skew | Detect |
| 0:20 | A post explaining how the offer combines with a sign-up promo is spreading | Comms monitoring | Declare; assign IC | Declare |
| 0:35 | Engineering can pause the offer, but the sign-up promo belongs to marketing, and nobody there is answering | Engineering on-call | Find the authority to pause; use the kill switch | Contain |
| 0:50 | Finance: large amounts credited, more pending, gift card redemptions starting | Finance | Protect money-out: hold redemptions on affected credits | Contain |
| 1:10 | Legal: what do the terms allow on clawback, and what do we tell customers? | Legal | Clawback and messaging decision (Reward Vesting and Clawback) | Recover |
| 1:30 | The retail partner asks about the spike | Partner manager | Partner communication | Communicate |
| 2:00 | Twist: the pause also blocked other legitimate offers for every user | Support | Narrow the lever | Contain |
| Next morning | Press inquiry | Comms | Holding statement | Communicate |
Exercise plan outline
- Purpose, scope and sponsor
- Objectives and the capabilities they test
- Scenario summary and assumptions (what players can and can't do)
- Participants and roles
- Schedule and modules
- Materials: situation manual, player handout, inject cards, exposure clock
- Evaluation guide and data collection
- Ground rules: no-fault, stay in scenario, it's okay to say "we don't know"
- Confidentiality of materials
AAR/IP template
| Objective | Rating | Strengths | Areas for improvement | Corrective action | Owner | Due | Status |
|---|---|---|---|---|---|---|---|
| Contain within 45 minutes of declaration | Partially met | Kill switch existed and was found | Authority to pause a marketing promo unclear after hours | Add promo pause authority to the IC role; document in runbook | Head of fraud ops | +30 days | Open |
Metrics
| Metric | Why |
|---|---|
| Exercises per quarter, by scenario type | Coverage of mechanisms and money paths |
| Time to declare and time to containment decision, trended across exercises | Readiness improving or not |
| Simulated exposure at containment | Comparable across exercises with the same loss rate |
| Corrective actions closed on time | Whether exercises change anything |
| Repeat findings | The same gap found twice means the fix didn't happen |
| Levers verified by drill | Share of the containment menu proven to work |
| Participation of required roles | Whether the right people show up |
Pitfalls
- A scripted run with no ambiguity and no failure is theater. People leave reassured and learn nothing.
- Too many injects drown the players, and nobody discusses decisions. Fewer, richer injects work better.
- Sending delegates who wouldn't actually be paged.
- Assigning blame. Once an exercise feels like a performance review, people stop admitting what they don't know.
- Skipping follow-up. An AAR without owners and dates is a meeting summary.
- Rehearsing a spectacular attack you'll never face while the promo-pause authority gap stays open.
- Putting attack recipes in the materials. They don't help the exercise and create a document you don't want leaked.
- Ignoring support and customers. Support is usually the first to see an incident and the last to be briefed.
- Leaving assumptions untested. "We'd freeze payouts" isn't an answer until a drill proves the freeze works and someone on call has the access.
- Leaving partners out. For neobanks and brokerages, the partner bank or clearing firm is part of the response, so include them at least once a year.
Related
- Incident response: Fraud Incident Response · Kill Switches and Circuit Breakers · Playbook - Business Logic Exploit Response Members · Playbook - Credential Stuffing Response Members · Playbook - Novel Attack Detection Members
- Program: Fraud Risk Assessment · New Product and Promo Launch Review · Cross-Functional Partnerships · Threat Intelligence and Horizon Scanning · Workforce Management and Capacity Planning · SOP Writing Standards · Exposure Window Modeling
- Controls exercised most often: Withdrawal and Payout Controls · Funds Availability Holds · Promotion Design Guardrails · Reward Vesting and Clawback · Customer Education and Scam Warnings
- Hub: Fraud Program Overview
Sources and further reading
- FEMA, Homeland Security Exercise and Evaluation Program (HSEEP): exercise program principles; evaluation and the After-Action Report/Improvement Plan; 2020 doctrine revision
- NACCHO, HSEEP 101 overview: discussion-based vs operations-based types; MSEL and injects; controller and evaluator roles; AAR within 30 days, final AAR/IP within 60
- NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (2006): designing, developing, conducting and evaluating exercise events for a single organization
- CISA Tabletop Exercise Packages: free, customizable packages with scenarios, discussion questions and AAR templates
- FDIC FIL-71-2019, FFIEC Business Continuity Management booklet: November 2019 booklet replacing the 2015 BCP booklet
- Conetrix, Updated FFIEC guidance: BCP exercise vs test: summary of the booklet's exercise vs test distinction and tabletop definition
- FS-ISAC, CAPS Banking exercise overview (2023): an example of a financial-sector tabletop with cross-functional participants and peer benchmarking