Mechanism to Control Matrix

Matrix of mechanisms against the controls that prevent, detect and respond to them.

44 mechanisms in 8 categories, mapped to 37 controls.

Account Takeover

Gaining control of a legitimate account, which opens the way to unauthorized withdrawals, trades, redemptions and purchases.

Mechanism	Prevent	Detect	Respond and recover
Account Recovery Abuse	Secure Account Recovery Design Customer Support Verification Protocols Contact Change Cooling-Off Periods Document Verification and Liveness Withdrawal and Payout Controls Insider Access Controls Passkeys and Phishing-Resistant Authentication
Account Takeover (ATO)	Passkeys and Phishing-Resistant Authentication Risk-Based Authentication and Step-Up Device Binding and Trusted Devices Contact Change Cooling-Off Periods Withdrawal and Payout Controls Real-Time Transaction Risk Scoring Secure Account Recovery Design Customer Support Verification Protocols Velocity and Exposure Limits
Credential Stuffing	Bot Management and CAPTCHA Rate Limiting and Throttling Breached Password Detection Passkeys and Phishing-Resistant Authentication Multi-Factor Authentication (MFA) Risk-Based Authentication and Step-Up Withdrawal and Payout Controls
MFA Bypass and OTP Interception	Passkeys and Phishing-Resistant Authentication Multi-Factor Authentication (MFA) Risk-Based Authentication and Step-Up Device Binding and Trusted Devices Payee Confirmation and Payment Friction Customer Education and Scam Warnings Secure Account Recovery Design
Payout Redirection	Withdrawal and Payout Controls Bank Account Ownership Verification Contact Change Cooling-Off Periods Risk-Based Authentication and Step-Up Seller Onboarding and Reserves Negative Lists and Deny Lists Real-Time Transaction Risk Scoring
Phishing and Credential Harvesting	Passkeys and Phishing-Resistant Authentication Risk-Based Authentication and Step-Up Device Binding and Trusted Devices Payee Confirmation and Payment Friction Contact Change Cooling-Off Periods Customer Education and Scam Warnings Withdrawal and Payout Controls
Session Hijacking and Infostealers	Device Binding and Trusted Devices Risk-Based Authentication and Step-Up Passkeys and Phishing-Resistant Authentication Breached Password Detection Withdrawal and Payout Controls Real-Time Transaction Risk Scoring Contact Change Cooling-Off Periods
SIM Swap and Port-Out Fraud	Passkeys and Phishing-Resistant Authentication Multi-Factor Authentication (MFA) Contact Change Cooling-Off Periods Secure Account Recovery Design Withdrawal and Payout Controls Risk-Based Authentication and Step-Up Device Binding and Trusted Devices

Synthetic and Farmed Accounts

Fake, synthetic, multiplied and farmed accounts: the infrastructure behind promo abuse, mules and bust-outs.

Mechanism	Prevent	Detect
Account Farming and Resale	Device Binding and Trusted Devices Risk-Based Authentication and Step-Up Document Verification and Liveness Velocity and Exposure Limits Negative Lists and Deny Lists	Transaction Monitoring Graph Analytics
Fake Account Creation (Bots)	Bot Management and CAPTCHA Rate Limiting and Throttling Promotion Design Guardrails Reward Vesting and Clawback KYC and Customer Identification Program (CIP) Velocity and Exposure Limits	Graph Analytics
Multi-Accounting	Promotion Design Guardrails Reward Vesting and Clawback Referral Program Controls Negative Lists and Deny Lists Bank Account Ownership Verification KYC and Customer Identification Program (CIP)	Graph Analytics
Synthetic Identity Fraud	KYC and Customer Identification Program (CIP) Document Verification and Liveness Consortium and Data Sharing Velocity and Exposure Limits Bank Account Ownership Verification	Graph Analytics Transaction Monitoring

Rewards and Promotions

Retail transaction fraud: receipts, card-linked offers, coupons, referrals, bonuses, promo codes, loyalty and logic exploits.

Mechanism	Prevent	Detect
Business Logic Exploitation	Promotion Design Guardrails Velocity and Exposure Limits Rate Limiting and Throttling Reward Vesting and Clawback Funds Availability Holds Withdrawal and Payout Controls	Transaction Monitoring
Card-Linked Offer Abuse	Promotion Design Guardrails Reward Vesting and Clawback Receipt and Purchase Verification Withdrawal and Payout Controls Rules Engine	Graph Analytics
Coupon Counterfeiting and Misredemption	Promotion Design Guardrails Receipt and Purchase Verification Negative Lists and Deny Lists Consortium and Data Sharing Rate Limiting and Throttling Bot Management and CAPTCHA Insider Access Controls
Loyalty and Rewards Redemption Fraud	Withdrawal and Payout Controls Risk-Based Authentication and Step-Up Contact Change Cooling-Off Periods Multi-Factor Authentication (MFA) Rate Limiting and Throttling Insider Access Controls Customer Support Verification Protocols Reward Vesting and Clawback
Promo Code Abuse	Promotion Design Guardrails Rate Limiting and Throttling Bot Management and CAPTCHA Reward Vesting and Clawback Rules Engine	Graph Analytics
Receipt Fraud (Cashback)	Receipt and Purchase Verification Reward Vesting and Clawback Withdrawal and Payout Controls Promotion Design Guardrails Machine Learning Models Negative Lists and Deny Lists Consortium and Data Sharing	Graph Analytics Manual Review Queues
Referral Abuse	Referral Program Controls Reward Vesting and Clawback Promotion Design Guardrails Bank Account Ownership Verification KYC and Customer Identification Program (CIP) Withdrawal and Payout Controls	Graph Analytics
Sign-Up Bonus Abuse	Promotion Design Guardrails Reward Vesting and Clawback Bank Account Ownership Verification KYC and Customer Identification Program (CIP) Funds Availability Holds Withdrawal and Payout Controls	Graph Analytics

Payments and Funding

Card, ACH, check, instant rails, wallets and gift cards, where money becomes available before it becomes final.

Mechanism	Prevent	Detect
ACH Funding Fraud	Bank Account Ownership Verification Funds Availability Holds Velocity and Exposure Limits Withdrawal and Payout Controls Real-Time Transaction Risk Scoring Negative Lists and Deny Lists	Transaction Monitoring
Bust-Out Fraud	Velocity and Exposure Limits Funds Availability Holds Machine Learning Models Consortium and Data Sharing Withdrawal and Payout Controls	Graph Analytics Transaction Monitoring
Card-Not-Present Fraud	3-D Secure and Card Verification Real-Time Transaction Risk Scoring Machine Learning Models Funds Availability Holds Velocity and Exposure Limits	Manual Review Queues
Chargeback and Friendly Fraud	Claims and Returns Policy Controls 3-D Secure and Card Verification Negative Lists and Deny Lists Withdrawal and Payout Controls Consortium and Data Sharing	Case Management Systems
Check and Mobile Deposit Fraud	Funds Availability Holds Velocity and Exposure Limits Withdrawal and Payout Controls Consortium and Data Sharing KYC and Customer Identification Program (CIP) Customer Education and Scam Warnings	Manual Review Queues
Digital Wallet Provisioning Fraud	Risk-Based Authentication and Step-Up Device Binding and Trusted Devices Passkeys and Phishing-Resistant Authentication Customer Support Verification Protocols Customer Education and Scam Warnings	Transaction Monitoring
First-Party Fraud	Velocity and Exposure Limits Funds Availability Holds Claims and Returns Policy Controls Reward Vesting and Clawback Negative Lists and Deny Lists Consortium and Data Sharing	Case Management Systems
Gift Card Fraud	Customer Education and Scam Warnings Velocity and Exposure Limits Rate Limiting and Throttling Bot Management and CAPTCHA Real-Time Transaction Risk Scoring Withdrawal and Payout Controls Trusted Contact and Senior Investor Holds
Instant Funding Abuse (Kiting)	Velocity and Exposure Limits Funds Availability Holds Withdrawal and Payout Controls Bank Account Ownership Verification Real-Time Transaction Risk Scoring Promotion Design Guardrails	Graph Analytics
Real-Time Payment Rail Fraud	Payee Confirmation and Payment Friction Withdrawal and Payout Controls Real-Time Transaction Risk Scoring Velocity and Exposure Limits Contact Change Cooling-Off Periods Customer Education and Scam Warnings Consortium and Data Sharing

Commerce and Marketplaces

Refunds, returns, buyer and seller claims, triangulation, and scams aimed at sellers.

Mechanism	Prevent	Detect
Refund and Return Fraud	Claims and Returns Policy Controls Customer Support Verification Protocols Insider Access Controls Receipt and Purchase Verification Consortium and Data Sharing Machine Learning Models	Graph Analytics
Seller Non-Delivery and Fake Listings	Seller Onboarding and Reserves Withdrawal and Payout Controls KYC and Customer Identification Program (CIP) Bank Account Ownership Verification Contact Change Cooling-Off Periods Velocity and Exposure Limits	Graph Analytics
Seller-Targeted Scams (Fake Payment and Overpayment)	Customer Education and Scam Warnings Funds Availability Holds Payee Confirmation and Payment Friction Real-Time Transaction Risk Scoring Customer Support Verification Protocols

Investing and Brokerage

Brokerage-specific transaction fraud: ramp-and-dump, ACATS transfers, investment scams.

Mechanism	Prevent	Detect	Respond and recover
Investment Scams (Pig Butchering)	Payee Confirmation and Payment Friction Customer Education and Scam Warnings Trusted Contact and Senior Investor Holds Real-Time Transaction Risk Scoring Consortium and Data Sharing	Transaction Monitoring Manual Review Queues
Ramp-and-Dump via Account Takeover	Passkeys and Phishing-Resistant Authentication Risk-Based Authentication and Step-Up Real-Time Transaction Risk Scoring Velocity and Exposure Limits Consortium and Data Sharing Contact Change Cooling-Off Periods	Graph Analytics

Authorized Payment Scams

APP, impersonation and elder exploitation, where the customer is tricked into moving the money themselves.

Mechanism	Prevent	Detect
Authorized Push Payment (APP) Scams	Payee Confirmation and Payment Friction Customer Education and Scam Warnings Real-Time Transaction Risk Scoring Trusted Contact and Senior Investor Holds Consortium and Data Sharing Velocity and Exposure Limits	Transaction Monitoring Manual Review Queues
Elder Financial Exploitation	Trusted Contact and Senior Investor Holds Customer Education and Scam Warnings Payee Confirmation and Payment Friction Real-Time Transaction Risk Scoring Customer Support Verification Protocols Velocity and Exposure Limits	Transaction Monitoring Manual Review Queues
Impersonation Scams	Customer Education and Scam Warnings Payee Confirmation and Payment Friction Customer Support Verification Protocols Real-Time Transaction Risk Scoring Trusted Contact and Senior Investor Holds Passkeys and Phishing-Resistant Authentication Velocity and Exposure Limits

Organized and Emerging Threats

Mules, rings, insiders, the fraud-as-a-service economy, GenAI and agentic commerce.

Mechanism	Prevent	Detect
Agentic Commerce Fraud	Bot Management and CAPTCHA Risk-Based Authentication and Step-Up 3-D Secure and Card Verification Device Binding and Trusted Devices Velocity and Exposure Limits Real-Time Transaction Risk Scoring Promotion Design Guardrails Passkeys and Phishing-Resistant Authentication
Fraud Rings and Collusion	Machine Learning Models Rules Engine Seller Onboarding and Reserves Reward Vesting and Clawback Negative Lists and Deny Lists Consortium and Data Sharing	Graph Analytics Case Management Systems
Fraud-as-a-Service Ecosystem	Consortium and Data Sharing Bot Management and CAPTCHA Machine Learning Models Negative Lists and Deny Lists Rules Engine	Graph Analytics
Generative AI and Deepfake Fraud	Document Verification and Liveness Customer Support Verification Protocols Passkeys and Phishing-Resistant Authentication Payee Confirmation and Payment Friction Customer Education and Scam Warnings Receipt and Purchase Verification KYC and Customer Identification Program (CIP) Machine Learning Models
Insider Fraud	Insider Access Controls Customer Support Verification Protocols Rule Governance and Change Management Withdrawal and Payout Controls	Case Management Systems Graph Analytics Manual Review Queues
Money Mules	KYC and Customer Identification Program (CIP) Funds Availability Holds Withdrawal and Payout Controls Consortium and Data Sharing Negative Lists and Deny Lists	Transaction Monitoring Graph Analytics Case Management Systems