Mechanisms

Every transaction fraud mechanism in the library, by category, with severity, prevalence, detection difficulty, rails and playbook.

18 mechanisms rate high on both severity and prevalence, and 13 more rate high on detection difficulty.

Mechanism	Summary	Severity	Prevalence	Detection difficulty
Account Takeover (ATO)	A third party seizes control of a legitimate account and monetizes its stored value, credentials and payment rails through withdrawals, trades, P2P, redemptions, purchases or payout changes.	High	High	Medium
ACH Funding Fraud	Funding a brokerage, neobank or fintech account by ACH debit from a bank account the actor doesn't own or will dispute, then extracting value before the return arrives.	High	High	Medium
Authorized Push Payment (APP) Scams	Hub note: scams in which the deceived customer authorizes and sends the payment themselves, covering typology, transaction footprint, intervention points and the shifting liability models in the US and UK.	High	High	High
Card-Not-Present Fraud	Purchases and account funding made online with stolen card credentials, where the merchant usually carries the chargeback liability unless authentication shifts it.	High	High	Medium
Check and Mobile Deposit Fraud	Counterfeit, altered, washed, forged and duplicate-presented checks deposited remotely or at ATMs, with funds withdrawn before the check is returned or a warranty claim arrives.	High	High	Medium
Elder Financial Exploitation	The illegal or improper use of an older adult's funds by strangers (scams) or trusted persons (theft), seen at the transaction layer through behavior changes, new payees and unusual liquidations.	High	High	High
First-Party Fraud	Hub for transaction fraud committed by the real account holder (false disputes, kiting, bust-outs, refund and receipt abuse), and how to separate it from third-party fraud and credit loss.	High	High	High
Fraud Rings and Collusion	Coordinated groups running many accounts, identities or counterparties, including buyer-seller and merchant-customer collusion, so that losses scale and each individual account looks benign.	High	High	High
Fraud-as-a-Service Ecosystem	How the underground economy industrializes transaction fraud: specialized roles, supply chains for access, identities and cash-out, escrow and reputation systems, and pricing that lets low-skill actors run professional attacks.	High	High	High
Impersonation Scams	Scammers pose as a bank, brokerage, government agency, tech support or a known business to make victims move money to 'safe' accounts, pay fake debts, or hand over access.	High	High	High
Instant Funding Abuse (Kiting)	Using provisional credit or instant buying power granted before ACH, check or card funding settles, then extracting value so a later return leaves the platform with the loss.	High	High	Medium
Investment Scams (Pig Butchering)	Long-con investment fraud where scammers build trust, show fake gains on fabricated platforms, and steer victims into repeated, escalating transfers, increasingly via crypto, kiosks, couriers and mule accounts.	High	High	High
MFA Bypass and OTP Interception	How a second factor gets defeated (codes socially engineered, push fatigue, real-time relays, SIM swaps, weak fallbacks) and why money-moving actions need their own transaction-level step-up.	High	High	High
Money Mules	Unwitting, witting or complicit people and accounts that receive and move illicit funds: the cash-out layer nearly every scam, ATO and payment fraud depends on.	High	High	Medium
Payout Redirection	Changing an account's payout destination (bank, card, wallet, gift card or crypto) on a compromised or farmed account, then letting a routine or requested payout carry value out.	High	High	Medium
Phishing and Credential Harvesting	Lures and impersonated login pages, including real-time relays and voice or SMS pretexts, that capture credentials, codes or sessions to move a customer's funds within minutes.	High	High	High
Real-Time Payment Rail Fraud	Fraud on instant, effectively irrevocable rails (RTP, FedNow, push-to-card, P2P), where account takeover cash-outs and scam payments complete in seconds and recovery depends on the receiving side.	High	High	High
Refund and Return Fraud	Wardrobing, empty-box and item-swap returns, receipt-less and counterfeit-receipt returns, false refund claims and refund-as-a-service operations that extract refunds for goods kept or never paid for.	High	High	High
Account Farming and Resale	Creating, aging and selling or renting accounts, including KYC-verified financial accounts and seasoned reward or marketplace accounts, as ready-made infrastructure for downstream transaction fraud.	High	Medium	High
Agentic Commerce Fraud	Emerging risks as AI agents buy and pay for users: agent impersonation, hijacked agents, intent and authorization gaps, disputes, and bot controls colliding with legitimate agents.	Medium	Low	High
Business Logic Exploitation	Abusing flaws in how transaction, pricing, reward or buying-power logic is designed, such as race conditions, rounding, stacking and reversal gaps, to extract value the system never meant to give.	High	Low	High
Bust-Out Fraud	Building an account's good standing to grow credit, overdraft or instant-funding limits, then maxing every limit at once and disappearing, often with a bad payment to reopen the line.	High	Medium	High
Chargeback and Friendly Fraud	The real cardholder disputes a transaction they made or benefited from, using card network dispute rights to reverse payment while keeping the goods, service or value.	Medium	High	High
Coupon Counterfeiting and Misredemption	Counterfeit manufacturer coupons, cloned digital coupons and codes, and misredemption at the till or in the retailer-clearinghouse-manufacturer settlement chain that pays face value for discounts never legitimately earned.	High	Medium	High
Digital Wallet Provisioning Fraud	Adding stolen card credentials to a mobile wallet or token on an attacker-controlled device, usually by defeating issuer step-up verification, then spending the token in-store, in-app or online.	High	Medium	High
Generative AI and Deepfake Fraud	Voice clones, deepfake video, AI-generated documents and selfies, and AI-scaled lures. GenAI lowers the cost and raises the credibility of identity and social-engineering attacks that end in transaction losses.	High	Medium	High
Insider Fraud	Employees, contractors and outsourced support agents who use legitimate access to commit, enable or sell transaction fraud, such as leaking data, changing accounts or approving their own payouts.	High	Medium	High
Loyalty and Rewards Redemption Fraud	Theft and laundering of points, miles and cashback balances via account takeover, farmed balances, insider adjustments and redemption or transfer paths that turn rewards into cash-like value.	Medium	High	High
Receipt Fraud (Cashback)	Fabricated, edited, duplicated, borrowed or bought-and-returned receipts submitted to receipt-scan cashback, rebate and loyalty programs to collect rewards for purchases that never qualified.	Medium	High	High
Session Hijacking and Infostealers	Malware-harvested credentials and stolen session tokens let attackers act inside an already-authenticated session, bypassing login, MFA and login-time risk checks before moving value.	High	Medium	High
Synthetic Identity Fraud	Fabricated identities that mix real and invented personal data to open funded or credit-bearing accounts, which later bust out, launder proceeds as mules, or receive transaction fraud.	High	Medium	High

44 mechanisms in 8 categories.

Account Takeover

Gaining control of a legitimate account, which opens the way to unauthorized withdrawals, trades, redemptions and purchases.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Account Recovery Abuse	Abusing password reset, contact change and support-assisted recovery to take over accounts holding value, often the weakest path once login itself is hardened.	High	Medium	Medium	ACH, Wire, Instant payments, P2P, Securities, Crypto, Rewards, Gift card	Playbook - Account Recovery Hardening Members
Account Takeover (ATO)	A third party seizes control of a legitimate account and monetizes its stored value, credentials and payment rails through withdrawals, trades, P2P, redemptions, purchases or payout changes.	High	High	Medium	ACH, Wire, Instant payments, P2P, Card, Digital wallet, Crypto, Gift card, Rewards, Securities, Store credit	Playbook - Account Takeover Members
Credential Stuffing	Automated replay of username-password pairs stolen elsewhere to find accounts that reuse them, producing validated access that is later monetized through redemptions, purchases and withdrawals.	Medium	High	Medium	Rewards, Gift card, Card, Store credit, P2P, ACH, Instant payments	Playbook - Credential Stuffing Response Members
MFA Bypass and OTP Interception	How a second factor gets defeated (codes socially engineered, push fatigue, real-time relays, SIM swaps, weak fallbacks) and why money-moving actions need their own transaction-level step-up.	High	High	High	Wire, ACH, Instant payments, P2P, Crypto, Securities, Card, Digital wallet	Playbook - Account Takeover Members
Payout Redirection	Changing an account's payout destination (bank, card, wallet, gift card or crypto) on a compromised or farmed account, then letting a routine or requested payout carry value out.	High	High	Medium	ACH, Instant payments, P2P, Card, Digital wallet, Gift card, Crypto, Rewards, Wire	Playbook - Payout and Withdrawal Risk Members
Phishing and Credential Harvesting	Lures and impersonated login pages, including real-time relays and voice or SMS pretexts, that capture credentials, codes or sessions to move a customer's funds within minutes.	High	High	High	Wire, ACH, Instant payments, P2P, Crypto, Securities, Card, Digital wallet, Gift card	Playbook - Account Takeover Members
Session Hijacking and Infostealers	Malware-harvested credentials and stolen session tokens let attackers act inside an already-authenticated session, bypassing login, MFA and login-time risk checks before moving value.	High	Medium	High	Card, ACH, Wire, P2P, Instant payments, Crypto, Rewards, Gift card, Securities, Store credit	Playbook - Account Takeover Members
SIM Swap and Port-Out Fraud	Hijacking a customer's phone number through a fraudulent SIM change or carrier port, to intercept SMS codes and recovery messages, usually just before a high-value withdrawal.	High	Low	Medium	Crypto, Wire, ACH, Instant payments, P2P, Securities	Playbook - SIM Swap and Contact Change Abuse Members

Synthetic and Farmed Accounts

Fake, synthetic, multiplied and farmed accounts: the infrastructure behind promo abuse, mules and bust-outs.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Account Farming and Resale	Creating, aging and selling or renting accounts, including KYC-verified financial accounts and seasoned reward or marketplace accounts, as ready-made infrastructure for downstream transaction fraud.	High	Medium	High	P2P, ACH, Instant payments, Card, Crypto, Rewards, Gift card, Securities	Playbook - Multi-Accounting and Linkage Members
Fake Account Creation (Bots)	Automated mass sign-ups that create accounts to farm incentives, stage mule and cash-out accounts, or launch transaction attacks such as card testing and promo abuse.	Medium	High	Medium	Rewards, Store credit, Gift card, Card, P2P, ACH, Instant payments, Securities	Playbook - Fake Account and Bot Defense Members
Multi-Accounting	One person or group operating many accounts to multiply per-customer offers, limits and payouts, or to return after being banned, usually first-party abuse that converts into cash.	Medium	High	Medium	Rewards, Store credit, Gift card, P2P, ACH, Card, Instant payments, Securities	Playbook - Multi-Accounting and Linkage Members
Synthetic Identity Fraud	Fabricated identities that mix real and invented personal data to open funded or credit-bearing accounts, which later bust out, launder proceeds as mules, or receive transaction fraud.	High	Medium	High	Card, ACH, Check, P2P, Instant payments, Crypto, Securities	Playbook - Synthetic Identity Detection Members

Rewards and Promotions

Retail transaction fraud: receipts, card-linked offers, coupons, referrals, bonuses, promo codes, loyalty and logic exploits.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Business Logic Exploitation	Abusing flaws in how transaction, pricing, reward or buying-power logic is designed, such as race conditions, rounding, stacking and reversal gaps, to extract value the system never meant to give.	High	Low	High	Rewards, Card, ACH, Securities, Store credit, Gift card, Instant payments	Playbook - Business Logic Exploit Response Members
Card-Linked Offer Abuse	Gaming merchant-funded card-linked offers through buy-claim-return, structured or split purchases, multi-card enrollment and stolen or farmed cards linked to reward accounts.	Medium	Medium	Medium	Card, Rewards, Gift card	Playbook - Receipt and Offer Fraud Members
Coupon Counterfeiting and Misredemption	Counterfeit manufacturer coupons, cloned digital coupons and codes, and misredemption at the till or in the retailer-clearinghouse-manufacturer settlement chain that pays face value for discounts never legitimately earned.	High	Medium	High	Rewards, Store credit, Gift card, Crypto, P2P	Playbook - Receipt and Offer Fraud Members
Loyalty and Rewards Redemption Fraud	Theft and laundering of points, miles and cashback balances via account takeover, farmed balances, insider adjustments and redemption or transfer paths that turn rewards into cash-like value.	Medium	High	High	Rewards, Gift card, Store credit, P2P, ACH	Playbook - Payout and Withdrawal Risk Members
Promo Code Abuse	Leaked, shared, stacked, enumerated or misapplied promo codes and offer-eligibility abuse that extract discounts or credits beyond what a promotion was designed to give.	Medium	High	Medium	Card, Store credit, Rewards, Gift card	Playbook - Sign-Up Bonus and Promo Abuse Members
Receipt Fraud (Cashback)	Fabricated, edited, duplicated, borrowed or bought-and-returned receipts submitted to receipt-scan cashback, rebate and loyalty programs to collect rewards for purchases that never qualified.	Medium	High	High	Rewards, Gift card, P2P, ACH	Playbook - Receipt and Offer Fraud Members
Referral Abuse	Self-referral, referral rings, farmed referees and publicly broadcast codes that convert refer-a-friend incentives into cash, stock or credits without acquiring genuine customers.	Medium	High	Medium	Rewards, ACH, Securities, P2P, Gift card	Playbook - Referral Abuse Members
Sign-Up Bonus Abuse	Gaming new-account and funding incentives such as bank and neobank bonuses, free-stock promotions, deposit matches and direct-deposit offers by meeting the letter of requirements without the intended relationship.	Medium	High	Medium	ACH, Securities, Rewards, P2P, Card	Playbook - Sign-Up Bonus and Promo Abuse Members

Payments and Funding

Card, ACH, check, instant rails, wallets and gift cards, where money becomes available before it becomes final.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
ACH Funding Fraud	Funding a brokerage, neobank or fintech account by ACH debit from a bank account the actor doesn't own or will dispute, then extracting value before the return arrives.	High	High	Medium	ACH, Instant payments, Wire, Securities, Crypto, P2P	Playbook - ACH Funding Fraud Members
Bust-Out Fraud	Building an account's good standing to grow credit, overdraft or instant-funding limits, then maxing every limit at once and disappearing, often with a bad payment to reopen the line.	High	Medium	High	Card, ACH, Check, Instant payments, P2P, Crypto, Securities	Playbook - Bust-Out Detection Members
Card-Not-Present Fraud	Purchases and account funding made online with stolen card credentials, where the merchant usually carries the chargeback liability unless authentication shifts it.	High	High	Medium	Card, Digital wallet, Gift card	Playbook - Chargeback Management Members
Chargeback and Friendly Fraud	The real cardholder disputes a transaction they made or benefited from, using card network dispute rights to reverse payment while keeping the goods, service or value.	Medium	High	High	Card, Digital wallet	Playbook - Chargeback Management Members
Check and Mobile Deposit Fraud	Counterfeit, altered, washed, forged and duplicate-presented checks deposited remotely or at ATMs, with funds withdrawn before the check is returned or a warranty claim arrives.	High	High	Medium	Check, ACH, Instant payments, P2P, Wire	Playbook - Mobile Deposit Fraud Members
Digital Wallet Provisioning Fraud	Adding stolen card credentials to a mobile wallet or token on an attacker-controlled device, usually by defeating issuer step-up verification, then spending the token in-store, in-app or online.	High	Medium	High	Card, Digital wallet	Playbook - Digital Wallet Provisioning Members
First-Party Fraud	Hub for transaction fraud committed by the real account holder (false disputes, kiting, bust-outs, refund and receipt abuse), and how to separate it from third-party fraud and credit loss.	High	High	High	Card, ACH, Check, Instant payments, P2P, Rewards, Store credit, Gift card
Gift Card Fraud	Gift cards used as an irreversible scam payment rail and cash-out vehicle: victims coerced into buying cards, stolen cards and accounts converted to gift value, and balances drained or tampered.	Medium	High	Medium	Gift card, Card, Rewards, Store credit, Digital wallet	Playbook - Scam Intervention Members
Instant Funding Abuse (Kiting)	Using provisional credit or instant buying power granted before ACH, check or card funding settles, then extracting value so a later return leaves the platform with the loss.	High	High	Medium	ACH, Check, Card, Instant payments, P2P, Securities, Crypto	Playbook - Instant Funding Abuse Members
Real-Time Payment Rail Fraud	Fraud on instant, effectively irrevocable rails (RTP, FedNow, push-to-card, P2P), where account takeover cash-outs and scam payments complete in seconds and recovery depends on the receiving side.	High	High	High	Instant payments, P2P, Card, ACH, Crypto	Playbook - Payout and Withdrawal Risk Members

Commerce and Marketplaces

Refunds, returns, buyer and seller claims, triangulation, and scams aimed at sellers.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Refund and Return Fraud	Wardrobing, empty-box and item-swap returns, receipt-less and counterfeit-receipt returns, false refund claims and refund-as-a-service operations that extract refunds for goods kept or never paid for.	High	High	High	Card, Store credit, Gift card, Digital wallet, Rewards	Playbook - Refund and Claims Abuse Members
Seller Non-Delivery and Fake Listings	Fake or hijacked seller accounts list goods they never ship, collect buyer payments and withdraw proceeds before claims mature, leaving buyers or the platform with the loss.	High	Medium	Medium	Card, Digital wallet, P2P, ACH, Instant payments, Gift card, Crypto	Playbook - Seller Fraud Members
Seller-Targeted Scams (Fake Payment and Overpayment)	Scams aimed at sellers, such as fake payment confirmations, overpayment and refund-the-difference schemes, off-platform payment lures and verification-code requests, that make sellers ship goods or send money.	Medium	High	Medium	Check, P2P, Instant payments, Wire, Gift card, Crypto, Digital wallet	Playbook - Scam Intervention Members

Investing and Brokerage

Brokerage-specific transaction fraud: ramp-and-dump, ACATS transfers, investment scams.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Investment Scams (Pig Butchering)	Long-con investment fraud where scammers build trust, show fake gains on fabricated platforms, and steer victims into repeated, escalating transfers, increasingly via crypto, kiosks, couriers and mule accounts.	High	High	High	Wire, ACH, Crypto, P2P, Instant payments, Securities, Gift card	Playbook - Scam Intervention Members
Ramp-and-Dump via Account Takeover	Hijacked brokerage accounts are liquidated and forced to buy a thin stock the attackers already hold, so they can sell into that demand before it collapses.	High	Medium	Medium	Securities, Wire, ACH	Playbook - Ramp-and-Dump Members

Authorized Payment Scams

APP, impersonation and elder exploitation, where the customer is tricked into moving the money themselves.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Authorized Push Payment (APP) Scams	Hub note: scams in which the deceived customer authorizes and sends the payment themselves, covering typology, transaction footprint, intervention points and the shifting liability models in the US and UK.	High	High	High	P2P, Instant payments, Wire, ACH, Crypto, Gift card, Card	Playbook - Scam Intervention Members
Elder Financial Exploitation	The illegal or improper use of an older adult's funds by strangers (scams) or trusted persons (theft), seen at the transaction layer through behavior changes, new payees and unusual liquidations.	High	High	High	Wire, Check, ACH, P2P, Crypto, Gift card, Securities, Card, Instant payments	Playbook - Elder Exploitation Response Members
Impersonation Scams	Scammers pose as a bank, brokerage, government agency, tech support or a known business to make victims move money to 'safe' accounts, pay fake debts, or hand over access.	High	High	High	Wire, P2P, Instant payments, Crypto, Gift card, ACH, Securities	Playbook - Scam Intervention Members

Organized and Emerging Threats

Mules, rings, insiders, the fraud-as-a-service economy, GenAI and agentic commerce.

Mechanism	Summary	Severity	Prevalence	Detection difficulty	Rails	Playbook (members)
Agentic Commerce Fraud	Emerging risks as AI agents buy and pay for users: agent impersonation, hijacked agents, intent and authorization gaps, disputes, and bot controls colliding with legitimate agents.	Medium	Low	High	Card, Digital wallet, Instant payments, ACH, Crypto, Rewards	Playbook - Novel Attack Detection Members
Fraud Rings and Collusion	Coordinated groups running many accounts, identities or counterparties, including buyer-seller and merchant-customer collusion, so that losses scale and each individual account looks benign.	High	High	High	Card, ACH, P2P, Rewards, Store credit, Securities, Gift card, Instant payments	Playbook - Fraud Ring Investigation Members
Fraud-as-a-Service Ecosystem	How the underground economy industrializes transaction fraud: specialized roles, supply chains for access, identities and cash-out, escrow and reputation systems, and pricing that lets low-skill actors run professional attacks.	High	High	High	Card, ACH, P2P, Instant payments, Crypto, Gift card, Rewards, Digital wallet, Securities	Playbook - Novel Attack Detection Members
Generative AI and Deepfake Fraud	Voice clones, deepfake video, AI-generated documents and selfies, and AI-scaled lures. GenAI lowers the cost and raises the credibility of identity and social-engineering attacks that end in transaction losses.	High	Medium	High	Wire, P2P, Instant payments, Crypto, ACH, Card, Rewards, Securities	Playbook - Novel Attack Detection Members
Insider Fraud	Employees, contractors and outsourced support agents who use legitimate access to commit, enable or sell transaction fraud, such as leaking data, changing accounts or approving their own payouts.	High	Medium	High	ACH, Wire, P2P, Rewards, Store credit, Card, Securities, Gift card, Crypto	Playbook - Insider Fraud Members
Money Mules	Unwitting, witting or complicit people and accounts that receive and move illicit funds: the cash-out layer nearly every scam, ATO and payment fraud depends on.	High	High	Medium	P2P, Instant payments, ACH, Wire, Check, Crypto, Card, Gift card, Digital wallet	Playbook - Money Mule Detection Members