Loss Taxonomy and Attribution

How to classify transaction losses (fraud vs credit vs operational, first vs third party, scam vs unauthorized) and attribute each dollar to a mechanism, money path and control gap.

Core components

The classification axes

Classify every loss on independent axes rather than one flat list. Each axis answers a different question and drives a different response.

Axis	Values	Why it matters
Loss nature	Fraud · Credit · Operational · Policy/goodwill · Disputed-unresolved	Who owns it. Fraud vs credit decides the model, the reserve and often the regulator's view.
Initiator	Authorized party (customer or agent) · Unauthorized party	Reg E, card network and scam-reimbursement rules all turn on this. Mirrors the first question of the Federal Reserve's FraudClassifier.
Actor	First-party · Third-party · Insider · Organized ring · Victim-authorized (scam)	Different signals and controls. Matches the vault's `actor` vocabulary.
Mechanism	One primary mechanism from the vault's mechanism list (secondary optional)	Drives control investment and maps to playbooks
Enabler	ATO, synthetic/farmed account, mule, insider, logic flaw, none	Separates how they got in from how they monetized
Money path	Funding · Purchase · Payout/withdrawal · Redemption · P2P/transfer · Trade · Refund/claim	Where the decision point was
Rail	card, ach, wire, check, instant-payments, p2p, digital-wallet, crypto, gift-card, rewards, securities, store-credit	Recovery options and timelines
Liability holder	Us · Customer · Merchant · Issuer/acquirer · Partner bank · Shared	Who actually ate it, after rules and contracts
Control gap	No control · Control bypassed · Control misconfigured · Manual decision error · Accepted risk	What to fix

Fraud vs credit vs operational

This is the hardest boundary and the one most often fudged.

Situation	Usually classified as	Test
Customer funds via ACH, withdraws instantly, debit returns NSF, never repays	Credit if intent to repay is plausible; first-party fraud if the pattern shows intent	Look at evidence of intent: new account, immediate withdrawal, no contact, linked accounts, repeated pattern. See Instant Funding Abuse (Kiting).
Account opened with a fabricated identity, maxes limits, disappears	Fraud (synthetic); often misbooked as credit charge-off	No real person to collect from. See Synthetic Identity Fraud, Bust-Out Fraud.
Customer disputes a purchase they made	First-party fraud (if false claim) vs merchant/service dispute	Evidence of receipt and prior undisputed use. See Chargeback and Friendly Fraud.
Promo paid out to a farmed account network	Fraud (promo abuse); often booked as marketing spend	If it would not have been paid under the promo's intended eligibility, it's abuse loss. See Sign-Up Bonus Abuse, Multi-Accounting.
Payout sent to wrong account because of an internal bug	Operational	Exploited bug → Business Logic Exploitation (fraud) if users knowingly extracted value
Scam victim sends money; firm reimburses voluntarily	Scam loss (goodwill/voluntary)	Track separately from liability-driven reimbursement
Scam victim sends money; firm is liable under rule or contract	Scam loss (liability)	See Authorized Push Payment (APP) Scams, Regulation E and Unauthorized Transfers

Scam vs unauthorized

Regulators and networks treat these differently, so your taxonomy must too.

Unauthorized: someone other than the customer initiated the transfer without actual authority. This includes cases where a third party tricked the customer into handing over credentials and then initiated the transfer. CFPB's 2021 Reg E FAQs said such transfers are unauthorized EFTs (see Regulation E and Unauthorized Transfers).
Authorized (scam): the customer initiated the payment themselves, under deception. In the US this is generally not an "error" under Reg E. Reimbursement is voluntary, contractual or network-driven. See Authorized Push Payment (APP) Scams.
Gray zone: remote-access-tool sessions, coached transfers where the fraudster drives, or customers who share an OTP while on the phone. Code the facts (who clicked, whose device, whose credentials), not just the conclusion, so the label can be re-derived if the legal view changes.

The Federal Reserve's ScamClassifier defines a scam as deception or manipulation used for financial gain. It sorts scams into two groups: products/services scams, and relationship/trust scams where someone impersonates a trusted party. It then assigns one of nine scam types (merchandise, investment, property sale/rental, romance impostor, government impostor, bank impostor, business impostor, relative/friend, other trusted party). Using these codes makes your data comparable across institutions and intel-sharing groups.

Attribution: from a loss dollar to a mechanism

Attribution means assigning each loss event to the mechanism, enabler, money path and control gap that produced it.

Diagram: Loss event (chargeback, return, write-off, reimbursement, clawback failure), Join to originating transaction(s), Join account timeline: login, changes, device, funding, prior cases, Case investigated?, Use investigator's coded mechanism + enabler, Apply deterministic attribution rules, Rule matched?, Assign mechanism with 'rule-attributed' flag, 'Unattributed' bucket, sample for review, Record control gap and liability holder

Attribution rule examples (illustrative; build your own from investigated cases):

Loss on a payout made within N days of a payout-destination change plus a new-device login → Payout Redirection, enabler Account Takeover (ATO).
ACH debit returned R10 after the funded value was withdrawn, on an account under 30 days old → ACH Funding Fraud. The actor depends on whether the bank account owner matches the customer (see Bank Account Ownership Verification).
Card dispute reason code in the fraud family on a CNP purchase with no prior history on the device → Card-Not-Present Fraud. With prior undisputed history on the same device and address → candidate Chargeback and Friendly Fraud.
Cashback paid on a receipt later flagged duplicate or altered → Receipt Fraud (Cashback).
Liquidation of holdings followed by purchase of a thin security after an anomalous login → Ramp-and-Dump via Account Takeover.

Multi-mechanism events. Real losses chain. ATO leads to payout redirection, which leads to a mule account. Assign one primary mechanism: where the money left your control. Record enablers separately. Otherwise ATO gets credited with every loss and the payout control gap stays invisible.

Shared losses. When a ring is responsible for 300 losses across 5 mechanisms, attribute each loss to its own mechanism and tag the ring ID. Ring-level views then come from aggregating on the ring ID, with no re-labeling.

Where loss shows up by industry

Industry	Primary loss lines	Classic misattribution
Brokerage and Investing	ACH return after withdrawal, ATO liquidation and transfer-out, ACATS out to fraudster, ramp-and-dump trading loss	Trading losses from ATO booked as market losses
Cashback, Coupons and Rewards	Paid cashback on fraudulent receipts, referral and bonus payouts, reward balance theft	Abuse booked as marketing or customer acquisition cost
Online Marketplaces	Buyer claims paid, seller non-delivery covered, chargebacks on platform	INR/SNAD abuse booked as customer service cost
Neobanks and Consumer Fintech	Reg E reimbursements, check/RDC returns, kiting, P2P scam goodwill	First-party kiting booked as credit/overdraft loss
Payments and P2P	Unauthorized P2P, scam reimbursements, instant payout losses	Scams mixed with unauthorized
Retail and Ecommerce	CNP chargebacks, refund/return abuse, gift card fraud	Return abuse booked as shrink

How to build it

Inventory every loss line with finance: chargebacks lost, ACH and check returns written off, Reg E credits made final, voluntary reimbursements, promo/reward clawback failures, refund and claim payouts, trading-loss make-wholes, recoveries.
Build the loss ledger. One row per loss event, linked to originating transaction IDs, with the axes above. Reconcile monthly to the general ledger.
Write attribution rules from your top 10 investigated case patterns. Start deterministic, and measure how much of the dollars they cover.
Sample the unattributed bucket weekly and turn findings into new rules or new investigation requirements.
Require coded fields in case notes: primary mechanism, enabler, actor, initiator, control gap. See Case Documentation Standards.
Version the taxonomy. When you add or split a mechanism, backfill or flag the break in trend.

Fraud analytics owns the taxonomy and rules. Investigators and QA own coded-label quality. Finance owns reconciliation. Credit risk co-signs the fraud vs credit boundary.

Artifacts and templates

Loss ledger schema (minimum)

Field	Example
loss_event_id	LE-2026-000123
source	chargeback / ach_return / check_return / reg_e_final / goodwill / clawback_fail / claim_paid
originating_txn_ids	[..]
event_date / txn_date	for vintage reporting
gross_amount / recovered_amount / net_amount
money_path / rail	payout / instant-payments
loss_nature	fraud
initiator	unauthorized
actor	third-party
primary_mechanism / enablers	Payout Redirection / [ATO, SIM swap]
liability_holder	us
control_gap	control bypassed
attribution_method	investigated / rule:R12 / unattributed
ring_id / case_id

Attribution QA checklist

Every loss dollar has a loss_nature and attribution_method
Unattributed share is reported and trending down
Rule-attributed labels are sampled against investigated cases each quarter, with agreement reported
Fraud vs credit boundary is applied consistently (sample of 50 NSF/charge-off cases per quarter)
Scam vs unauthorized fields captured as facts as well as conclusions
Taxonomy changes logged with effective date

Metrics

Attribution coverage: % of loss dollars with a primary mechanism (target: high and rising; unattributed sampled)
Investigated share: % of loss dollars attributed by investigation vs rules
Rule–investigation agreement: where both exist, % match on primary mechanism
Reclassification rate: % of losses whose nature or mechanism changed after initial booking
Loss by mechanism and control gap: the input to Fraud Risk Assessment and the Mechanism to Control Matrix

Pitfalls

A single "fraud" bucket can't tell you whether to buy device intelligence or fix payout holds.
Attributing losses to the enabler. "ATO caused $X" hides that payout controls failed. Primary mechanism = where money left.
Letting chargeback reason codes be your taxonomy. Network reason codes describe the dispute rather than the mechanism, and many fraud-coded disputes are first-party.
Promo abuse hidden in marketing spend. If it isn't in the loss ledger, nobody owns it.
Not recording the liability holder. Whether liability sits with the merchant, the issuer or a partner bank changes who should invest in the fix.
Taxonomy sprawl, such as fifty mechanisms with a handful of events each. Keep a stable top level (this vault's mechanism list) and use tags for sub-variants.

Sources and further reading

Federal Reserve, FraudClassifier model: classification starting from who initiated the payment (authorized vs unauthorized party)
Federal Reserve, FraudClassifier FAQ: three-question structure; channel-independent classification
Federal Reserve, ScamClassifier model: scam definition, two categories and nine scam types
Federal Reserve, Synthetic identity fraud definition (2021): industry definition supporting fraud-vs-credit classification of synthetic losses
Orrick InfoBytes, CFPB unauthorized EFT and error resolution FAQs (Jun 2021): credentials obtained by fraud and the unauthorized classification
CFPB, Regulation E §1005.2 definitions: definition of unauthorized EFT and its exclusions
FinCEN, Financial Trend Analysis: identity-related suspicious activity (2021 data): impersonation, compromise and circumvention as identity exploitation types