Mission and Principles

"Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win" -- John Lambert, 2015

John Lambert was talking about cybersecurity when he said that, but anyone who has spent time working fraud knows it describes our world just as well.

A fraud ring doesn’t hit one company and move on. It tests a stolen identity on a cashback app early in the week, uses that same identity to open an account somewhere else a few days later, and sells what worked to anyone willing to pay for it. The people behind these schemes trade tools and tactics constantly, and every lesson one of them learns gets passed along to the rest.

Those of us on the other side work differently. Most of us sit inside a single company, looking at our own alerts and seeing only the small piece of the picture that happens to touch our customers. Whatever we figure out usually stays inside those walls, and often for good reasons. Customer data has to be protected, companies have policies and legal teams for a reason, and nobody is asking anyone to cut corners.

The costs are real: When one team spots a new pattern and keeps it to themselves, the next team has to learn the same lesson the hard way, usually after the losses are already booked. The fraudsters understand this better than anyone, and they are counting on us to stay in our own lanes.

The Outlier Lab exists to change that. It’s a free place to learn how fraud schemes actually work and how to stop them, built for the people who do this work every day. For professionals who want to go further, Three Sigma is a members-only space where vetted practitioners can bring sanitized cases and work through them together.

None of us will ever see the whole graph from inside one company, but if enough of us start sharing what we know, we can see a great deal more of it than we do today. That’s how we get a step ahead, and it starts with comparing notes.

Principles

1. Defenders come first. Every page should help a defender more than it could help an attacker. When in doubt, gate it or leave it out. See Responsible Publication Policy.
2. Every topic is framed around transactions: where value moves and where the decision points are. If it doesn't connect to a transaction, it's out of scope.
3. Pages are written at practitioner grade, with no vendor voice and no product placement. They're specific, honest about trade-offs and skeptical of silver bullets.
4. Retail and financial fraud sit side by side. The same patterns recur across cashback apps, marketplaces, neobanks and brokerages, and seeing them together helps you anticipate what's coming next.
5. Emerging topics get more attention than evergreen ones. The basics get a page; most of the effort goes into what's changing and how adversaries adapt.
6. Claims are sourced. Facts, statistics and regulatory claims point to primary sources, and opinions are labeled as opinions.
7. Confidentiality is respected. Experience is shared as generalized lessons, never as anyone's internal rules, data or incidents.
8. The library is free and open to the right people. There's no paywall: public basics for anyone, and operational depth for vetted practitioners. See Access Model.
9. Pages are maintained. Each carries a status and a date and gets revisited. Errors get fixed quickly, and stale pages get flagged.