The Outlier Lab

Start Here

How the library is organized and suggested reading paths for retail, financial, program, QA and emerging-threat practitioners.

How the library fits together

Diagram: Mechanisms: how fraud works, Signals: how you see it, Controls: how you stop it, Playbooks: how you run it (members), Program: the org that does it, Industries, Case studies

Every mechanism note has the same shape: an at-a-glance summary, how it works (conceptually), its transaction footprint (what it looks like where the money moves, and where you can stop it), variants, red flags, defenses at a glance, and emerging variants and adversary adaptation. Each links to the signals and controls that matter and to a members playbook with the operational detail.

Reading paths

Retail and rewards transaction fraud
  1. Cashback, Coupons and Rewards and Retail and Ecommerce: the business models and money flows
  2. Receipt Fraud (Cashback) → Card-Linked Offer Abuse → Coupon Counterfeiting and Misredemption
  3. Referral Abuse → Sign-Up Bonus Abuse → Promo Code Abuse → Loyalty and Rewards Redemption Fraud
  4. Refund and Return Fraud → Buyer Protection Claim Abuse (INR and SNAD)
  5. Enablers: Multi-Accounting · Device Farms and Emulators · Fraud Rings and Collusion
  6. Signals: Receipt and Document Image Forensics · Basket and SKU Anomalies · Promo and Reward Redemption Patterns · Referral Graph Patterns
  7. Controls: Receipt and Purchase Verification · Promotion Design Guardrails · Reward Vesting and Clawback · Kill Switches and Circuit Breakers
  8. Playbook - Receipt and Offer Fraud Members (members) · Playbook - Referral Abuse Members · Playbook - Sign-Up Bonus and Promo Abuse Members
Financial transaction fraud
  1. Brokerage and Investing · Neobanks and Consumer Fintech · Payments and P2P
  2. Account Takeover (ATO) → Payout Redirection → Ramp-and-Dump via Account Takeover → ACATS Transfer Fraud
  3. ACH Funding Fraud → Instant Funding Abuse (Kiting) → Check and Mobile Deposit Fraud
  4. Real-Time Payment Rail Fraud · Authorized Push Payment (APP) Scams · Money Mules
  5. Signals: Account Change Events · Fast In Fast Out Patterns · Funding Source Signals · Payout Destination Intelligence · Trading Pattern Signals
  6. Controls: Real-Time Transaction Risk Scoring · Withdrawal and Payout Controls · Funds Availability Holds · Contact Change Cooling-Off Periods
  7. Playbook - Account Takeover Members (members) · Playbook - Payout and Withdrawal Risk Members · Playbook - ACH Funding Fraud Members
Running a fraud program
  1. Fraud Program Overview → Fraud Operating Model → Fraud Maturity Model
  2. Fraud Risk Assessment → New Product and Promo Launch Review
  3. Fraud Strategy Lifecycle → Rule Governance and Change Management → Model Risk Management
  4. Fraud Metrics and KPIs → Loss Taxonomy and Attribution → Fraud Labeling and Feedback Loops → Exposure Window Modeling
  5. Friction and Customer Experience Tradeoffs · Experimentation and Champion-Challenger
  6. US Regulatory Overview
Fraud QA and operations
  1. Fraud QA Program → SOP Writing Standards
  2. Alert Review Operations → Manual Review Queues → Case Management Systems → Workforce Management and Capacity Planning
  3. Investigation Standards → Case Documentation Standards
  4. The QA criteria section in every playbook (Playbooks Index Members)
  5. Support Team Fraud Training · Customer Support Verification Protocols · Fraud Tabletop Exercises
Emerging threats
  1. Threat Intelligence and Horizon Scanning and Playbook - Novel Attack Detection Members (members)
  2. Agentic Commerce Fraud → AI Agent Verification (Know Your Agent) · Generative AI and Deepfake Fraud · Fraud-as-a-Service Ecosystem
  3. Session Hijacking and Infostealers · MFA Bypass and OTP Interception · Digital Wallet Provisioning Fraud
  4. Recent cases: Case Study - Japan Brokerage Account Takeovers (2025) · Case Study - Arup Deepfake Video Call (2024) · Case Study - Coinbase Support Insider Breach (2025) · Case Study - AI-Generated Fake Receipts (2025-2026) · Case Study - SDNY Ramp-and-Dump Forfeitures (2025-2026)
  5. Response levers: Kill Switches and Circuit Breakers · Playbook - Business Logic Exploit Response Members (members)
  6. Recent developments: News Index

Maps

Legend

MarkerMeaning
Lock iconMembers-only content in Three Sigma (Access Model)
status: draftWritten, not yet reviewed by the editor
> [!warning] VerifyA fact flagged for checking
Practitioner notesFirst-hand experience, generalized