The Outlier Lab

Glossary

300+ transaction fraud terms (rails, return and dispute codes, rewards, brokerage, detection, ML, operations, QA and regulation) with short definitions and links into the vault.

Jump to: 0–9 · A · B · C · D · E · F · G · H · I · K · L · M · N · O · P · Q · R · S · T · U · V · W · Z

0–9

  • 3-D Secure (3DS): An issuer authentication protocol for card-not-present payments (EMV 3DS). The merchant sends transaction and device data, and the issuer approves frictionlessly or challenges the cardholder. Successful authentication typically shifts fraud liability to the issuer. See 3-D Secure and Card Verification.
  • 314(a) / 314(b): USA PATRIOT Act information-sharing provisions. 314(a) is government-to-institution requests. 314(b) is voluntary, safe-harbored sharing between registered BSA-covered financial institutions (and associations of them) about suspected money laundering or specified unlawful activity, including fraud; registration is renewed annually and SARs remain confidential. See BSA-AML and SAR Filing, Consortium and Data Sharing.

A

  • AAL (Authenticator Assurance Level): NIST SP 800-63B's three levels of authentication strength. AAL2 requires offering a phishing-resistant option; AAL3 requires phishing-resistant, non-exportable keys. See Passkeys and Phishing-Resistant Authentication.
  • ACATS: Automated Customer Account Transfer Service, the U.S. clearing system for moving brokerage accounts between firms. A path for both outbound asset theft and inbound transfers under stolen identities. See ACATS Transfer Fraud.
  • Account aggregation: Third-party services that access a user's account (with credentials or tokens) to pull data. Legitimate traffic that complicates bot and login anomaly detection (OWASP OAT-020). See Session Behavior Anomalies.
  • Account farming: Creating and "aging" accounts to build history before selling, renting or using them for fraud. See Account Farming and Resale.
  • Account opening fraud: Opening an account with stolen or synthetic identity data, usually to stage mule activity, bonus abuse or bust-out. See Synthetic Identity Fraud, KYC and Customer Identification Program (CIP).
  • Account takeover (ATO): An unauthorized party gaining control of a legitimate customer's account, then monetizing it through withdrawals, trades, redemptions, P2P sends or purchases. See Account Takeover (ATO).
  • Account validation (ACH): Confirming that a bank account is open and able to accept ACH entries before first use. Nacha requires it for WEB debits as part of a commercially reasonable fraud detection system. See Bank Account Ownership Verification.
  • ACH: The Automated Clearing House network for batch debits and credits in the U.S., governed by the Nacha Operating Rules. See ACH Funding Fraud, Nacha Rules and ACH Risk.
  • ACH return: An entry sent back by the receiving bank with a reason code (R01, R10, etc.). Return timing makes ACH funding risky when value is released before returns mature. See Nacha Rules and ACH Risk.
  • Acquirer: The bank or processor that contracts with merchants to accept card payments. It carries merchant risk and is measured by network monitoring programs. See Card Network Dispute Rules.
  • Actor: The party committing the fraud, whether third-party, first-party, insider, organized ring, or a deceived customer (victim-authorized). It is a core property in this vault's schema. See Loss Taxonomy and Attribution.
  • Address risk: Signals from address type, history and consistency (e.g., commercial mail receiving agencies, reshippers, high-velocity addresses). See Address Risk Signals.
  • Adversary-in-the-middle (AiTM): Phishing that relays a victim's login to the real site in real time, capturing credentials and session tokens and defeating OTP-based MFA. See Phishing and Credential Harvesting, MFA Bypass and OTP Interception.
  • Agentic commerce: AI agents initiating purchases or payments on a user's behalf. It raises new questions about agent identity, user intent and liability. See Agentic Commerce Fraud.
  • Aged account: An account with enough tenure and history to pass tenure-based controls, sometimes deliberately aged by fraudsters. See Customer Tenure and History, Account Farming and Resale.
  • Alert: A system-generated item (rule hit, model score, monitoring scenario) that requires review or action. See Alert Review Operations.
  • Allow list: A list of trusted entities exempted from certain controls. Convenient, and a common attack target if not reviewed. See Negative Lists and Deny Lists.
  • AML: Anti-money laundering, meaning programs to detect and report the movement of illicit funds. Overlaps with fraud at the mule and cash-out layer. See BSA-AML and SAR Filing, Three Lines of Defense.
  • Anomaly detection: Finding behavior that deviates from a baseline without labeled examples. Useful for novel attacks and logic exploits. See Playbook - Novel Attack Detection Members.
  • APP scam (authorized push payment): A scam in which the victim is deceived into sending a payment themselves. Liability differs from unauthorized fraud. See Authorized Push Payment (APP) Scams.
  • Approval rate: The share of attempts (orders, sign-ups, withdrawals) approved. Always read it alongside loss and good-customer friction. See Fraud Metrics and KPIs.
  • AUC (ROC AUC): A threshold-free ranking metric for classifiers. It is often misleading for rare-event fraud; precision-recall at your operating point matters more. See Machine Learning Models.
  • Authorization (card): The real-time request to an issuer to approve a card transaction. Distinct from clearing and settlement. See Card-Not-Present Fraud.
  • Authorized vs unauthorized: Whether the account holder (or someone they authorized) initiated the payment. This is the first question in the Federal Reserve's FraudClassifier and the main driver of liability. See Frameworks and Taxonomies, Regulation E and Unauthorized Transfers.
  • Automation signals: Indicators of scripted or headless clients (timing regularity, environment inconsistencies, missing human interaction). See Automation and Headless Browser Signals.
  • AVS (Address Verification Service): A card check comparing the billing address supplied with the issuer's records. A weak signal on its own. See 3-D Secure and Card Verification.

B

  • Backtest: Replaying a proposed rule or model against historical data to estimate catches, false positives and dollar impact before launch. See Fraud Strategy Lifecycle.
  • Bad rate: The share of a population (accounts, transactions) that turns out to be fraudulent after labels mature. See Fraud Labeling and Feedback Loops.
  • Bank account ownership verification: Confirming the person linking a bank account actually owns it, via open banking data, network databases or micro-deposits. See Bank Account Ownership Verification.
  • Basis points (bps) of loss: Fraud loss as a fraction of volume (1 bp = 0.01%). The standard way to compare loss across products and time. See Fraud Metrics and KPIs.
  • Basket anomaly: Unusual product mix, quantities or price points in an order or receipt, often tied to resale or offer abuse. See Basket and SKU Anomalies.
  • BEC (business email compromise): Email-based fraud that redirects business payments. Out of scope for this vault except as a rail pattern. See Reports and Data Sources.
  • Behavioral biometrics: Analysis of how a user interacts (typing, touch, navigation) to tell a genuine user from an impostor or a coached victim. See Behavioral Biometrics.
  • BIN (IIN): The leading digits of a card number identifying the issuer and card product. Used for risk segmentation and card-testing detection. See Payment Instrument Signals.
  • Bonus abuse: Gaming sign-up, funding or referral incentives with fake, duplicate or farmed accounts. See Sign-Up Bonus Abuse, Referral Abuse.
  • BORIS: Buy online, return in store. A returns channel that industry research flags as a fast-growing fraud and abuse vector. See Refund and Return Fraud.
  • Bot: Automated software interacting with your product. Ranges from benign (search crawlers) to malicious (stuffing, fake sign-ups, card testing). See Fake Account Creation (Bots), Bot Management and CAPTCHA.
  • Breached password detection: Checking passwords against corpora of known-compromised credentials at sign-up, login or change. See Breached Password Detection.
  • BSA (Bank Secrecy Act): The U.S. law underpinning AML obligations (SARs, CTRs, recordkeeping, CIP). See BSA-AML and SAR Filing.
  • Bust-out: Building good standing, then rapidly maxing credit, overdraft or instant limits and disappearing. See Bust-Out Fraud.
  • Buy-claim-return: Buying an item, claiming the cashback or offer reward, then returning the item while keeping the reward. See Card-Linked Offer Abuse, Receipt Fraud (Cashback).
  • Buying power: In brokerage, the amount available to trade, which can include unsettled deposits or margin. Instant buying power creates exposure if funding reverses. See Instant Funding Abuse (Kiting), Brokerage and Investing.

C

  • Calibration (QA): Sessions where reviewers decide the same cases independently and reconcile differences, to keep decision quality consistent. See Fraud QA Program.
  • Calibration (model): How well predicted probabilities match observed fraud rates. Required before setting score thresholds by expected loss. See Machine Learning Models.
  • CAPTCHA: A challenge intended to separate humans from automated clients. It adds friction and is increasingly defeated, so it works best as one layer of bot defense. See Bot Management and CAPTCHA.
  • Card-linked offer (CLO): A reward tied to purchases made with an enrolled card at participating merchants, detected from transaction data rather than receipts. See Card-Linked Offer Abuse.
  • Card-not-present (CNP): Card transactions without the physical card (online, in-app, phone). The dominant card fraud channel. See Card-Not-Present Fraud.
  • Card testing: High-volume small authorizations to check whether stolen card data is valid. Also called enumeration when card details are generated. See Card Testing.
  • Case: The unit of investigation, grouping alerts, entities, evidence and decisions. See Case Management Systems, Investigation Standards.
  • Case narrative: The written account of what happened, why it's suspicious, and what was done. The basis of SAR narratives and QA review. See Case Documentation Standards.
  • Cash-out: The step that converts stolen or fraudulently obtained value into money the fraudster controls. Usually where losses become irreversible (OWASP OAT-012). See Money Mules, Payout Redirection.
  • Cashback: A reward returning a portion of a purchase to the buyer, funded by merchants, brands or issuers. See Cashback, Coupons and Rewards.
  • Catch rate (recall): The share of fraud (by count or dollars) that controls detect. Report dollar-weighted catch alongside count. See Fraud Metrics and KPIs.
  • CDD (customer due diligence): Understanding the nature and purpose of customer relationships and conducting ongoing monitoring. A BSA requirement. See KYC and Customer Identification Program (CIP).
  • Champion-challenger: Running a new strategy (challenger) against the current one (champion) on split traffic to measure real impact. See Experimentation and Champion-Challenger.
  • Chargeback: A card network process reversing a transaction at the cardholder's request, through the issuer. See Chargeback and Friendly Fraud, Card Network Dispute Rules.
  • Check kiting: Exploiting the float between check deposit and collection to create artificial balances. See Instant Funding Abuse (Kiting), Case Study - Chase Infinite Money Glitch (2024).
  • Check washing: Chemically or digitally altering a legitimate check's payee or amount. Common with mail-theft check fraud. See Check and Mobile Deposit Fraud.
  • CIP (Customer Identification Program): The BSA requirement to collect and verify identifying information when opening accounts. See KYC and Customer Identification Program (CIP).
  • Claims abuse: False or exaggerated buyer protection, delivery or damage claims used to get refunds. See Buyer Protection Claim Abuse (INR and SNAD), Claims and Returns Policy Controls.
  • Clawback: Reversing a reward, bonus or credit after the fact when eligibility conditions are violated. See Reward Vesting and Clawback.
  • Clearinghouse (coupon): An intermediary that processes manufacturer coupon redemptions between retailers and manufacturers. A point where misredemption can be detected. See Coupon Counterfeiting and Misredemption.
  • Collusion: Coordination between parties who appear independent, such as buyer and seller, merchant and customer, or insider and outsider. See Fraud Rings and Collusion.
  • Compelling evidence (Visa CE 3.0): Visa's framework, effective April 2023, letting merchants rebut card-absent fraud disputes by showing prior undisputed transactions that share identity elements. See Card Network Dispute Rules.
  • Confirmation of Payee (CoP): A name-matching check on the recipient before a push payment is sent, pioneered in the UK. See Payee Confirmation and Payment Friction.
  • Confirmed fraud: A label assigned after investigation or authoritative evidence, as opposed to suspected fraud or customer claims. See Fraud Labeling and Feedback Loops.
  • Consortium data: Fraud signals pooled across many organizations (negative lists, device reputation, identity history). See Consortium and Data Sharing, Credit Bureau and Consortium Signals.
  • Contact change: Updating an account's phone, email or address. A frequent precursor to ATO cash-out. See Account Change Events, Contact Change Cooling-Off Periods.
  • Cooling-off period: A deliberate delay or restriction on high-risk actions (payouts, new payees) after sensitive account changes. See Contact Change Cooling-Off Periods.
  • Counterfactual: The fraud that would have occurred without a control. It can't be observed directly, so it is estimated with holdouts. See Experimentation and Champion-Challenger.
  • Coupon misredemption: Redeeming coupons without a qualifying purchase, or for the wrong product, at retailer or clearinghouse level. See Coupon Counterfeiting and Misredemption, Case Study - Talens Counterfeit Coupon Scheme (2020).
  • Credential cracking: Guessing passwords for known usernames (OWASP OAT-007). Distinct from stuffing, which replays known pairs. See Credential Stuffing.
  • Credential stuffing: Automated replay of username/password pairs breached elsewhere, exploiting password reuse (OWASP OAT-008). See Credential Stuffing, Case Study - DraftKings Credential Stuffing (2022).
  • Credit-push fraud: Nacha's term for fraudulently induced ACH credits, such as from BEC, impersonation or ATO. Targeted by Nacha's 2026 fraud monitoring rules. See Nacha Rules and ACH Risk.
  • CTR (Currency Transaction Report): A BSA report filed for cash transactions over $10,000. Relevant to fraud teams mainly where cash is a cash-out path. See BSA-AML and SAR Filing.
  • Customer tenure: How long a customer has existed and transacted. A strong but gameable risk signal. See Customer Tenure and History.
  • CVV2 / CVC2: The card security code used to verify card possession in CNP transactions. Widely compromised along with card numbers. See 3-D Secure and Card Verification.

D

  • Decision point: A moment in the customer lifecycle where a control can approve, decline, step up, hold or route to review. See Real-Time Decisioning Architecture, Customer Lifecycle Map.
  • Decline rate: The share of attempts declined by fraud controls. High decline rates hide good-customer cost. See Friction and Customer Experience Tradeoffs.
  • Deepfake: AI-generated or manipulated audio, video or images used to impersonate people or forge documents. See Generative AI and Deepfake Fraud, Case Study - Arup Deepfake Video Call (2024).
  • Deny list (negative list): Known-bad identifiers (devices, accounts, cards, addresses) blocked or escalated on match. See Negative Lists and Deny Lists.
  • Device binding: Cryptographically associating an account with a specific device so that new devices trigger verification. See Device Binding and Trusted Devices.
  • Device farm: Many physical or virtual devices operated together to fake user diversity at scale. See Device Farms and Emulators.
  • Device fingerprint: An identifier derived from device and browser attributes to recognize returning devices. It can be degraded, so it works best combined with other linkage signals. See Device Fingerprinting.
  • Device reputation: The history associated with a device across your platform or a vendor's network. See Device Reputation and Linkage.
  • Digital footprint: The online presence tied to an email, phone or identity (age, linked accounts, breaches), used to judge whether an identity is real and established. See Email Risk Signals, Identity Element Consistency.
  • Digital wallet provisioning: Adding a card to a mobile wallet as a token. Fraud occurs when stolen card details are provisioned after weak issuer verification. See Digital Wallet Provisioning Fraud.
  • Direct deposit requirement: Bank and fintech bonus terms requiring qualifying payroll deposits. A frequent target of bonus abuse. See Sign-Up Bonus Abuse.
  • Disposable email: Short-lived or throwaway email domains. A weak signal on its own. See Email Risk Signals.
  • Dispute: A customer's challenge to a transaction (card chargeback, Reg E error claim, marketplace claim). See Card Network Dispute Rules, Dispute and Return History.
  • Document verification: Checking an identity document's authenticity and matching it to the person presenting it. See Document Verification and Liveness.
  • Dollar-weighted metric: A metric weighted by dollar amount, so large losses count for more than small ones. Essential when a few large losses dominate. See Fraud Metrics and KPIs.
  • Dormant account: An inactive account. Sudden reactivation, especially with contact changes, is a classic ATO or mule signal. See Account Change Events, Money Mules.
  • Drift: Change over time in data distributions or fraud patterns that degrades model performance. See Model Risk Management.
  • Duplicate presentment: Depositing the same check more than once, for example by mobile deposit and then at another institution. See Check and Mobile Deposit Fraud.

E

  • EFT (electronic fund transfer): An electronic transfer to or from a consumer account, covered by Regulation E. See Regulation E and Unauthorized Transfers.
  • Elder financial exploitation: Illegal or improper use of an older adult's funds by strangers or trusted persons. See Elder Financial Exploitation, Trusted Contact and Senior Investor Holds.
  • Emulator: Software imitating a mobile device, used legitimately in development and abusively to fake device diversity. See Emulator and Rooted Device Detection.
  • Empty-box fraud: Claiming a delivered package was empty, or returning an empty or substituted box, to get a refund. See Refund and Return Fraud.
  • Entity resolution: Determining which records refer to the same real-world person, household or business. See Entity Link Analysis, Fraud Data Architecture.
  • Enumeration: Systematically trying values (card numbers, promo codes, account numbers) to find valid ones. See Card Testing, Promo Code Abuse.
  • Error resolution (Reg E): The required process when a consumer reports an EFT error, with notice within 60 days of the statement and investigation within 10 business days (extendable with provisional credit). See Regulation E and Unauthorized Transfers.
  • Escalation: Routing a case to a higher tier (senior investigator, AML, legal, law enforcement) by defined criteria. See Investigation Standards.
  • Exception hold (Reg CC): A longer-than-standard hold on check deposits permitted for new accounts, large deposits, redeposits, repeated overdrafts, reasonable doubt of collectibility, or emergencies. See Funds Availability Holds.
  • Explainability: The ability to state why a model or rule made a decision, for analysts, customers and regulators. See Model Risk Management.
  • Exposure: The maximum value at risk before funds settle or a control can act, such as unsettled instant credit or pending payouts. See Velocity and Exposure Limits.

F

  • Fail-open / fail-closed: Whether a transaction proceeds (open) or stops (closed) when a fraud service times out or errors. See Real-Time Decisioning Architecture.
  • Fake account: An account not tied to a genuine intended user, often created in bulk. See Fake Account Creation (Bots).
  • False positive: A legitimate event flagged or declined as fraud. The false positive rate and the good-customer cost should be tracked explicitly. See Fraud Metrics and KPIs, Friction and Customer Experience Tradeoffs.
  • Fast in, fast out (FIFO): Funds arriving and leaving an account within a short window. A hallmark of mule and cash-out activity. See Fast In Fast Out Patterns.
  • Feature store: Infrastructure that computes and serves model features consistently for training and real-time scoring. See Fraud Data Architecture.
  • FedNow: The Federal Reserve's instant payment service, live since July 2023. See Real-Time Payment Rail Fraud.
  • FinCEN: The Financial Crimes Enforcement Network (Treasury). It administers the BSA and publishes advisories and alerts with SAR key terms. See Regulatory and Government Sources.
  • First-party fraud: Fraud committed by the genuine account holder (false disputes, kiting, bust-out, refund abuse). Often hard to separate from credit loss. See First-Party Fraud.
  • First-party misuse: Card-industry term for cardholders disputing legitimate transactions. Overlaps with friendly fraud. See Chargeback and Friendly Fraud.
  • Fraud-as-a-service: The specialized underground economy selling fraud capabilities (data, tools, accounts, cash-out) as services. See Fraud-as-a-Service Ecosystem.
  • Fraud QA: Systematic review of analyst decisions against a rubric to measure and improve decision quality. See Fraud QA Program.
  • Fraud ring: A coordinated group operating many accounts or identities. See Fraud Rings and Collusion, Playbook - Fraud Ring Investigation Members.
  • Fraud risk assessment: A structured evaluation of inherent fraud risk, control effectiveness and residual risk for a product or flow. See Fraud Risk Assessment.
  • FraudClassifier: The Federal Reserve-convened model for classifying payments fraud, starting with whether an authorized or unauthorized party initiated the payment. See Frameworks and Taxonomies.
  • Friendly fraud: A cardholder disputing a transaction they made or authorized, intentionally or by mistake. See Chargeback and Friendly Fraud.
  • Friction: Any added step or delay for the customer (step-up, hold, review). Measure its cost directly. See Friction and Customer Experience Tradeoffs.
  • Funding source: The instrument used to put money into an account (card, bank link, check, transfer). Its risk depends on reversibility and ownership. See Funding Source Signals.
  • Funds availability: When deposited funds become usable. Releasing value before funds are final creates exposure. See Funds Availability Holds.

G

  • Geolocation: Location derived from IP, GPS or other signals, compared with expected locations. See Geolocation and Impossible Travel.
  • Gift card fraud: Using gift cards as a scam payment method or cash-out vehicle, draining balances, or buying them with stolen payment credentials. See Gift Card Fraud.
  • Good-customer cost: Revenue and goodwill lost to false declines, holds and friction on legitimate customers. See Friction and Customer Experience Tradeoffs.
  • Graph analytics: Analyzing relationships between entities (accounts, devices, payment instruments) to find rings and mule networks. See Graph Analytics.

H

I

  • IAL (Identity Assurance Level): NIST SP 800-63A's levels of identity proofing strength. See KYC and Customer Identification Program (CIP).
  • ID&V (identification and verification): The issuer's verification step when a card is provisioned to a wallet or token. See Digital Wallet Provisioning Fraud.
  • Identity element consistency: Whether name, DOB, SSN, address, phone and email fit together and share history. See Identity Element Consistency.
  • Identity verification (IDV): Confirming that a person is who they claim to be at onboarding, recovery or step-up. See Identity Verification Outcomes, Document Verification and Liveness.
  • Impersonation scam: A scammer posing as a bank, government agency, business or relative to persuade the victim to move money. See Impersonation Scams.
  • Impossible travel: Activity from locations too far apart for the time between them. See Geolocation and Impossible Travel.
  • INFORM Consumers Act: A U.S. law (effective June 2023) requiring marketplaces to collect, verify and disclose information on high-volume third-party sellers. See Seller Onboarding and Reserves, Online Marketplaces.
  • Infostealer: Malware that harvests saved credentials, cookies and session tokens from infected devices. See Session Hijacking and Infostealers.
  • Injection attack (IDV): Feeding pre-recorded or synthetic media into an identity verification flow instead of a live camera capture. NIST 800-63-4 addresses it explicitly. See Document Verification and Liveness.
  • INR (item not received): A buyer claim that an order never arrived. Legitimate or abusive. See Buyer Protection Claim Abuse (INR and SNAD).
  • Insider fraud: Employees, contractors or outsourced agents enabling or committing fraud. See Insider Fraud, Insider Access Controls.
  • Instant funding: Making deposits usable before they settle. It improves experience and creates exposure. See Instant Funding Abuse (Kiting).
  • Instant payments: Real-time, typically irrevocable payment rails (RTP, FedNow, push-to-card, many P2P apps). See Real-Time Payment Rail Fraud.
  • Insult rate: The share of legitimate customers declined or challenged. Another name for good-customer friction. See Friction and Customer Experience Tradeoffs.
  • Investment scam: Deceiving victims into "investing" in fake platforms or assets, often after building a relationship. See Investment Scams (Pig Butchering).
  • Issuer: The bank that issues a card or account to the customer and approves transactions. See Card Network Dispute Rules.

K

L

  • Label leakage: Training a model with information that wouldn't be available at decision time, which inflates offline performance. See Fraud Labeling and Feedback Loops.
  • Label maturity: The time needed for fraud outcomes (chargebacks, returns, claims) to arrive. Recent data is under-labeled. See Fraud Labeling and Feedback Loops.
  • Latency budget: The time allowed for a fraud decision within a customer flow. See Real-Time Decisioning Architecture.
  • Layering: The AML stage of moving funds through transactions to obscure their origin. See Money Mules.
  • Liability shift: A card network rule moving fraud liability between merchant and issuer, for example after successful 3DS authentication. See 3-D Secure and Card Verification.
  • Liveness: Checks that a biometric capture comes from a live person present at the time, not a photo, mask, replay or deepfake. See Document Verification and Liveness.
  • Login anomaly: An unusual login pattern (new device, location, time, failure burst). See Login Anomalies.
  • Loss rate: Fraud losses relative to volume, usually in basis points. See Fraud Metrics and KPIs.
  • Loss taxonomy: The classification scheme for losses (fraud vs credit vs operational; first- vs third-party; by mechanism and rail). See Loss Taxonomy and Attribution.
  • Loyalty fraud: Theft or abuse of points and rewards balances, via ATO, farmed accounts or redemption abuse. See Loyalty and Rewards Redemption Fraud.

M

  • Manual review: Human review of flagged events before or after a decision. See Manual Review Queues, Alert Review Operations.
  • Manufacturer coupon: A coupon funded by the product manufacturer and reimbursed to the retailer through a clearinghouse. See Coupon Counterfeiting and Misredemption.
  • Maturity model: Staged description of fraud program capability across people, process, data and technology. See Fraud Maturity Model.
  • MCC (merchant category code): A code classifying a merchant's business, used for risk rules and offer eligibility. See Transaction Pattern Anomalies.
  • mDL (mobile driver's license): A digital identity credential on a phone. U.S. agencies have addressed accepting such credentials for CIP. See KYC and Customer Identification Program (CIP).
  • MFA (multi-factor authentication): Requiring two or more independent factors to authenticate. See Multi-Factor Authentication (MFA).
  • MFA fatigue (push bombing): Repeated push approval prompts sent in hopes the user approves one. See MFA Bypass and OTP Interception.
  • Micro-deposits: Small test deposits used to confirm a user can see a bank account. Slower than open banking and imperfect proof of ownership. See Bank Account Ownership Verification.
  • Model risk management (MRM): Governance of model development, validation, monitoring and use. The Federal Reserve's SR 26-2 (2026) replaced SR 11-7. See Model Risk Management.
  • Modus operandi (MO): The characteristic method of a fraud pattern. See Threat Intelligence and Horizon Scanning.
  • Money mule: A person or account that receives and moves illicit funds, wittingly or not. See Money Mules.
  • Monitoring program (card networks): Network programs that flag merchants and acquirers with excessive fraud or disputes, such as Visa's VAMP. See Card Network Dispute Rules.
  • Multi-accounting: One controller operating many accounts to multiply incentives, limits or payouts, or to evade bans. See Multi-Accounting.

N

O

P

  • P2P (peer-to-peer payments): Consumer-to-consumer payments, often instant and hard to reverse. See Payments and P2P, Real-Time Payment Rail Fraud.
  • Passkey: A phishing-resistant FIDO credential using public-key cryptography, either device-bound or synced. See Passkeys and Phishing-Resistant Authentication.
  • Password spraying: Trying a few common passwords across many accounts to avoid lockouts. See Credential Stuffing.
  • Payee risk: Risk attached to the recipient of a payment (new payee, mule indicators, high-risk destination). See Payee and Counterparty Risk.
  • Payment friction: Deliberate steps such as warnings, delays and confirmations that interrupt high-risk payments. See Payee Confirmation and Payment Friction.
  • Payout: Money leaving the platform to a customer-controlled destination. Usually the last point a loss can be prevented. See Withdrawal and Payout Controls.
  • Payout redirection: Changing the payout destination on a compromised or farmed account before cashing out. See Payout Redirection.
  • Perceptual hash: An image fingerprint that stays similar under small changes. Used to find duplicate or shared receipts and documents. See Receipt and Document Image Forensics.
  • Phishing: Deceptive messages or sites that trick users into revealing credentials or approving actions. See Phishing and Credential Harvesting.
  • Pig butchering: Relationship-driven investment scams, often run from organized scam compounds, that steer victims to fake platforms. See Investment Scams (Pig Butchering), Case Study - Prince Group Pig Butchering Enforcement (2025).
  • PII: Personally identifiable information. Fraud teams process a lot of it and must minimize, protect and justify its use. See Privacy and Data Use in Fraud Prevention.
  • Placement: The AML stage in which illicit funds first enter the financial system. See Money Mules.
  • Policy abuse: Exploiting lenient customer policies (returns, refunds, guarantees) without technically breaking rules. See Claims and Returns Policy Controls, Refund and Return Fraud.
  • Port-out fraud: Transferring a victim's phone number to another carrier to intercept calls and SMS. See SIM Swap and Port-Out Fraud.
  • Precision: The share of flagged items that are actually fraud. See Fraud Metrics and KPIs.
  • Pre-dispute alert: A network or third-party notice of an impending dispute that lets the merchant refund before a chargeback is filed. See Playbook - Chargeback Management Members.
  • Pretext: The cover story a scammer or social engineer uses ("your account is compromised"). See Impersonation Scams, Customer Support Verification Protocols.
  • Promo code abuse: Leaking, stacking, enumerating or misapplying promotion codes. See Promo Code Abuse.
  • Provisional credit: Funds credited before final settlement or before a dispute is resolved (e.g., under Reg E investigations). Creates exposure if reversed. See Regulation E and Unauthorized Transfers, Instant Funding Abuse (Kiting).
  • Proxy / residential proxy: Intermediary IPs that mask a user's real network. Residential proxies make traffic look like home broadband. See IP Reputation and Proxy Detection.
  • Purchase-claim-return: Buying, submitting the receipt for cashback, then returning the item. See Receipt Fraud (Cashback).
  • Push vs pull payment: In a push payment the payer's institution sends funds (wires, RTP, ACH credits). In a pull payment the payee initiates (cards, ACH debits). Push payments are harder to reverse. See Payment Rails Map.
  • Push-to-card: Instant disbursement to a debit card via card networks. A fast cash-out rail. See Real-Time Payment Rail Fraud.

Q

R

  • R01: ACH return code for insufficient funds (2-banking-day window). Often a kiting or first-party precursor. See Nacha Rules and ACH Risk.
  • R02 / R03 / R04: ACH returns for account closed, no account/unable to locate, and invalid account number. Fast signals of bad funding sources. See Funding Source Signals.
  • R05: ACH return for an unauthorized debit to a consumer account using a corporate entry class (60-day window). See Nacha Rules and ACH Risk.
  • R07: ACH return for authorization revoked by the customer (60-day window). See Nacha Rules and ACH Risk.
  • R10: ACH return where the customer advises the originator is unknown or not authorized to debit (60-day window). A core unauthorized-fraud label for ACH Funding Fraud.
  • R11: ACH return where the entry doesn't match the terms of an existing authorization (60-day window). Still counted as unauthorized. See Nacha Rules and ACH Risk.
  • R29: ACH return where a corporate customer advises the entry was not authorized (2-banking-day window). See Nacha Rules and ACH Risk.
  • R90: A new ACH return code for returns made to meet sanctions obligations, scheduled by Nacha for March 2028. See Nacha Rules and ACH Risk.
  • Race condition: A logic flaw in which concurrent requests produce outcomes the system shouldn't allow (e.g., double redemption). See Business Logic Exploitation.
  • Ramp-and-dump: Using compromised brokerage accounts to buy thinly traded securities and inflate prices for the attacker's exit. See Ramp-and-Dump via Account Takeover.
  • RAT (remote access tool): Software allowing remote control of a device. Used in tech-support and bank-impersonation scams. See Remote Access Tool Detection.
  • RDC (remote deposit capture): Depositing checks by image, typically mobile. See Check and Mobile Deposit Fraud.
  • RDFI: Receiving Depository Financial Institution, the bank receiving an ACH entry for its customer. Under Nacha's 2026 rules, RDFIs need risk-based processes to identify credits initiated due to fraud. See Nacha Rules and ACH Risk.
  • RDR (Rapid Dispute Resolution): Visa/Verifi automation that resolves eligible disputes by merchant-defined rules before they become chargebacks. See Playbook - Chargeback Management Members.
  • Reason code: The network code describing why a dispute was raised (e.g., Visa 10.4 card-absent fraud, Mastercard 4837). See Card Network Dispute Rules.
  • Recall: The share of actual fraud detected. Also called catch rate or true positive rate. See Fraud Metrics and KPIs.
  • Receipt fraud: Fabricated, edited, duplicated or shared receipts submitted for cashback or rebates. See Receipt Fraud (Cashback), Receipt and Purchase Verification.
  • Red flag: An indicator that warrants scrutiny. Regulators publish red-flag lists in advisories and rules such as Reg S-ID. See Regulatory and Government Sources.
  • Redemption: Converting rewards, points or balances into value (cash, gift cards, transfers). See Promo and Reward Redemption Patterns, Loyalty and Rewards Redemption Fraud.
  • Referral abuse: Self-referral, referral rings and farmed referrals that convert referral incentives into cash. See Referral Abuse, Referral Graph Patterns.
  • Refund-as-a-service: Paid operators who file fraudulent refund or claims on behalf of customers (described conceptually). See Refund and Return Fraud.
  • Reg CC (Regulation CC): The Federal Reserve rule (12 CFR 229) governing funds availability and check collection, including exception holds. See Funds Availability Holds.
  • Reg E (Regulation E): The CFPB rule (12 CFR 1005) implementing the Electronic Fund Transfer Act, covering consumer liability limits and error resolution for unauthorized EFTs. See Regulation E and Unauthorized Transfers.
  • Reg E liability tiers: Consumer liability for unauthorized EFTs is generally capped at $50 if reported within two business days of learning of loss or theft of the access device. The cap rises to $500 after that. Liability can be greater after 60 days from the statement. See Regulation E and Unauthorized Transfers.
  • Reg S-ID: The SEC/CFTC Identity Theft Red Flags rule requiring covered firms (incl. broker-dealers) to maintain an identity theft prevention program. See Broker-Dealer Obligations (FINRA and SEC).
  • Reg S-P: The SEC privacy rule for broker-dealers and advisers, including safeguarding and incident-response requirements. See Broker-Dealer Obligations (FINRA and SEC).
  • Remote access scam: A scam in which the victim is persuaded to install remote-control software so the scammer can operate the account. See Remote Access Tool Detection, Impersonation Scams.
  • Representment: A merchant's challenge to a chargeback, with evidence. See Playbook - Chargeback Management Members.
  • Reserve (seller): Funds a platform withholds from seller payouts to cover future claims and chargebacks. See Seller Onboarding and Reserves.
  • Reshipper: An address or service that forwards packages. It can hide the final destination of goods bought with stolen credentials. See Address Risk Signals, Triangulation Fraud.
  • Residual risk: Risk remaining after controls. The output of a fraud risk assessment. See Fraud Risk Assessment.
  • Return fraud: Fraudulent merchandise returns (stolen goods, receipt fraud, wardrobing, item swaps). See Refund and Return Fraud.
  • Review rate: The share of events sent to manual review. Constrained by staffing and SLAs. See Alert Review Operations.
  • Risk appetite / tolerance: The level of fraud loss and friction the organization accepts in pursuit of growth, set by leadership. See Fraud Risk Assessment, Three Lines of Defense.
  • Risk-based authentication: Adjusting authentication requirements to the risk of the session or transaction. See Risk-Based Authentication and Step-Up.
  • Rooted / jailbroken device: A mobile device with OS restrictions removed. Raises tampering risk. See Emulator and Rooted Device Detection.
  • RTP (Real-Time Payments network): The Clearing House's U.S. instant payment network. Also used generically for real-time payments. See Real-Time Payment Rail Fraud.
  • Rule 2165 (FINRA): Permits broker-dealers to place temporary holds on disbursements or transactions in accounts of specified adults when exploitation is reasonably suspected, with notice, review and time limits. See Trusted Contact and Senior Investor Holds.
  • Rule 4512 (FINRA): Requires broker-dealers to make reasonable efforts to obtain a trusted contact person for non-institutional accounts. See Trusted Contact and Senior Investor Holds.
  • Rules engine: The system that evaluates deterministic conditions to approve, decline, hold or route events. See Rules Engine, Rule Governance and Change Management.

S

  • Safe-account scam: An impersonation scam persuading victims to move funds to a "safe" account controlled by the fraudster. See Impersonation Scams.
  • Same Day ACH: Faster ACH settlement windows. Nacha plans to raise the per-payment limit to $10 million in September 2027, increasing speed-related exposure. See Nacha Rules and ACH Risk.
  • SAR (Suspicious Activity Report): A BSA report to FinCEN on suspicious transactions. For banks, the threshold is generally $5,000 or more, filed within 30 days of initial detection (up to 60 if no suspect is identified). See BSA-AML and SAR Filing.
  • SAR key term: A phrase FinCEN asks filers to include in SAR narratives so related reports can be aggregated (e.g., for scam center activity). See Regulatory and Government Sources.
  • Scam: Per the Federal Reserve-convened definition, the use of deception or manipulation intended to achieve financial gain. See Authorized Push Payment (APP) Scams.
  • Scam coaching: Scammers instructing victims in real time on what to say or do to get past bank controls. See Scam Victim Indicators, Playbook - Scam Intervention Members.
  • ScamClassifier: The Federal Reserve-convened model (2024) classifying scams into nine types across products/services and relationship/trust categories. See Frameworks and Taxonomies.
  • SCA (strong customer authentication): The EU/UK regulatory requirement for multi-factor authentication on many electronic payments. See 3-D Secure and Card Verification.
  • SEC code (ACH): Standard Entry Class codes describing the type of ACH entry (e.g., PPD, CCD, WEB, TEL). Risk and rules vary by code. See Nacha Rules and ACH Risk.
  • Seller fraud: Fraud by sellers on a marketplace (non-delivery, fake listings, triangulation, collusion). See Seller Non-Delivery and Fake Listings, Playbook - Seller Fraud Members.
  • Session hijacking: Taking over an authenticated session with stolen tokens or cookies, bypassing login controls. See Session Hijacking and Infostealers.
  • Shadow mode: Running a rule or model without acting on its output, to measure performance before launch. See Fraud Strategy Lifecycle.
  • Shared receipt: The same receipt (or a near-duplicate) submitted by multiple accounts. See Receipt and Document Image Forensics.
  • Shrink: Retail inventory loss from theft, fraud and errors. Adjacent to returns fraud. See Retail and Ecommerce.
  • SIM swap: Moving a victim's phone number to a SIM the attacker controls, to intercept OTPs and account recovery. See SIM Swap and Port-Out Fraud, Case Study - FTX Theft via SIM Swap (2022).
  • SKU: Stock-keeping unit, the product identifier on receipts and orders. Used for offer eligibility and anomaly detection. See Basket and SKU Anomalies.
  • Smishing / vishing: Phishing by SMS (smishing) or voice call (vishing). See Phishing and Credential Harvesting.
  • SNAD (significantly not as described): A buyer claim that an item differs materially from its listing. See Buyer Protection Claim Abuse (INR and SNAD).
  • Social engineering: Manipulating people (customers, support agents) into actions that enable fraud. See Customer Support Verification Protocols, Support Team Fraud Training.
  • Specified adult: Under FINRA Rule 2165, a person 65 or older, or an adult the firm reasonably believes has an impairment that prevents protecting their own interests. See Trusted Contact and Senior Investor Holds.
  • Split tender: Paying with multiple payment methods in one purchase. It can be used to game card-linked offer or reward eligibility. See Card-Linked Offer Abuse.
  • Step-up authentication: Requiring additional verification when risk rises (new device, high-value payout). See Risk-Based Authentication and Step-Up.
  • Structuring: Splitting transactions to stay below reporting thresholds. A BSA violation. See BSA-AML and SAR Filing.
  • Support-assisted recovery: Account recovery handled by human agents. A frequent social-engineering target. See Account Recovery Abuse, Customer Support Verification Protocols.
  • Syncable authenticator: A passkey or other cryptographic authenticator whose key can be synced across devices. NIST 800-63-4 accepts these at AAL2 but excludes them from AAL3. See Passkeys and Phishing-Resistant Authentication.
  • Synthetic identity: An identity fabricated from a combination of real and fake PII. See Synthetic Identity Fraud.

T

  • TC40 / TC15: Visa transaction codes for issuer-reported fraud (TC40) and disputes (TC15). Both count toward VAMP ratios. See Card Network Dispute Rules.
  • Thin file: A consumer with little credit or identity history. Hard to verify, and easily confused with synthetics. See Identity Element Consistency, Synthetic Identity Fraud.
  • Third-party fraud: Fraud by someone other than the account holder, using stolen identities, cards or accounts. See Loss Taxonomy and Attribution.
  • Third-Party Sender (TPS): A non-bank intermediary that originates ACH entries on behalf of its customers. Covered by Nacha's 2026 fraud monitoring rules. See Nacha Rules and ACH Risk.
  • Three lines of defense: The governance model separating risk ownership (1st line), oversight and challenge (2nd) and independent assurance (3rd). The IIA calls it the Three Lines Model. See Three Lines of Defense.
  • Threshold: The score or value at which a rule or model triggers. It should be set by expected value and operational capacity. See Rule Governance and Change Management.
  • Time to detect: The elapsed time from an attack's start to detection. A leading indicator of loss. See Fraud Incident Response, Fraud Metrics and KPIs.
  • Tokenization: Replacing sensitive payment data with tokens. It reduces data theft but moves risk to token provisioning. See Digital Wallet Provisioning Fraud.
  • Transaction monitoring: Post-event analysis of transaction flows to detect fraud and money laundering patterns. See Transaction Monitoring.
  • Triangulation fraud: A seller fulfills real buyers' orders using goods bought with stolen payment methods elsewhere. See Triangulation Fraud.
  • True positive: A flagged event that is actually fraud. See Fraud Metrics and KPIs.
  • Trusted contact: A person a brokerage customer designates for the firm to contact about possible exploitation or account concerns. See Trusted Contact and Senior Investor Holds.
  • Trusted device: A device previously verified for an account, used to reduce friction and to flag new devices. See Device Binding and Trusted Devices.
  • Typology: A documented pattern of fraud or money laundering, often with red flags. See Mechanisms Index, Frameworks and Taxonomies.

U

  • Unauthorized entry return rate: Nacha's measure of an originator's returns for unauthorized reasons (R05, R07, R10, R11, R29). Exceeding thresholds triggers scrutiny. See Nacha Rules and ACH Risk.
  • Unauthorized transfer (Reg E): An EFT initiated by someone other than the consumer without actual authority, from which the consumer receives no benefit. See Regulation E and Unauthorized Transfers.
  • Unwitting mule: A person moving illicit funds without understanding it, often recruited through job or romance scams. See Money Mules.

V

  • VAMP (Visa Acquirer Monitoring Program): Visa's combined fraud-and-dispute monitoring program, which replaced its separate dispute and fraud programs in April 2025. See Card Network Dispute Rules.
  • Velocity: The count or amount of events per entity in a time window. One of the most useful and most gamed fraud features. See Velocity Signals, Velocity and Exposure Limits.
  • Vesting (rewards): Delaying when earned rewards or bonuses become withdrawable, until fraud and return windows pass. See Reward Vesting and Clawback.
  • Victim-authorized: This vault's actor value for cases where a deceived customer moves money themselves. See Authorized Push Payment (APP) Scams.

W

  • Wardrobing: Buying an item, using it, then returning it as new. See Refund and Return Fraud.
  • WEB entry: An ACH SEC code for internet-initiated consumer debits. It requires a commercially reasonable fraud detection system, including account validation. See Nacha Rules and ACH Risk.
  • Withdrawal: Moving funds out of an account to an external destination. The decisive control point for most ATO losses. See Withdrawal and Payout Controls.
  • Witting / complicit mule: A mule who knowingly moves illicit funds, sometimes recruited for pay. See Money Mules.

Z

  • Zelle: The bank-owned U.S. P2P network operated by Early Warning Services. It is at the center of scam-liability disputes and litigation. See Case Study - Zelle Scam Liability Disputes (2024-2025), Payments and P2P.
  • Zero liability: Card network policies protecting cardholders from unauthorized card transactions, subject to conditions. See Card Network Dispute Rules.

Sources and further reading

Definitions are paraphrased from vault notes and these primary sources: