Threat Intelligence and Horizon Scanning
How to find emerging transaction fraud MOs before they show up in losses: intel sources, information sharing, internal sentinels, red-teaming your own flows, and turning intel into controls.
Core components
Intelligence vs horizon scanning
| Threat intelligence | Horizon scanning | |
|---|---|---|
| Time frame | Now to the next quarter | 6–36 months |
| Question | What is hitting us or our peers right now? | What will change the threats we face? |
| Examples | A new mule recruitment pretext; a surge in scam payments via a particular rail; a receipt-editing pattern seen across cashback apps | Agentic AI initiating payments; deepfake-capable identity verification attacks; new instant rails; regulatory shifts in scam liability |
| Output | Detection hypotheses, emergency rules, SOP updates | Risk assessment inputs, roadmap bets, launch review criteria |
| Consumers | Strategy, ops, incident response | Leadership, product, data science, risk committee |
The intelligence cycle, adapted to fraud
Priority intelligence requirements keep the function focused. Examples:
- What new cash-out paths are being used against instant rails and payouts similar to ours?
- How are scammers coaching victims to get past our type of in-flow warnings? (Collect the fact that coaching exists and how it shows up in customer behavior. Don't collect scripts.)
- Which incentives in our category (sign-up bonuses, cashback, referral rewards) are being discussed in abuse communities?
- Which identity verification methods are being degraded by synthetic media?
- What are our payment partners, networks and regulators warning about?
How to build it
Source map
| Source type | Examples (categories) | Strengths | Limits |
|---|---|---|---|
| Regulators and government | FinCEN alerts and advisories (with SAR key terms), FTC Consumer Sentinel data and Data Spotlights, FBI IC3 reports and PSAs, CFPB, FINRA, SEC investor alerts, Nacha | Authoritative; often signals regulatory expectations; red-flag lists | Lagging (months); general |
| Industry information sharing | Financial-sector ISACs, the FinCEN 314(b) program for eligible financial institutions, consortium networks, payment network bulletins, industry working groups | Peer-validated, timely, specific | Membership requirements; legal constraints on what can be shared |
| Vendors and partners | Fraud vendor research, processor and issuer bulletins, BaaS bank partners, retailer and brand partners | Cross-client view | Marketing bias; verify claims (see Vendor Selection and Evaluation) |
| Open sources | Security researchers, academic papers, press, consumer complaint patterns, social media trend monitoring | Early, broad | Noisy; hype |
| Underground-market monitoring | Commercial intel providers that monitor underground markets on your behalf | Earliest signal of targeting | Legal, ethical and safety constraints; use specialist providers under legal guidance, not analysts browsing on their own |
| Internal | Analyst observations, QA findings, support contacts, complaint text, anomaly sentinels, incident post-mortems | Specific to your flows; the highest-value source | Needs structure to capture |
| Red team | Internal abuse testing of your own products and promos | Finds gaps before launch | Needs scope, authorization and safety rules |
Internal sentinels
Internal sentinels are usually your earliest warning. External intel shows what's possible, while sentinels show what is actually hitting your flows. Members detail is in Playbook - Novel Attack Detection Members. At program level, establish:
- Volume and mix sentinels per money path: new-account share, funding-method mix, payout-destination mix, redemption mix, geography and device mix
- Ratio sentinels: approval rate, step-up pass rate, hold-release rate, and early return or dispute rates by cohort
- Unexplained-loss review: every confirmed loss with no rule or model hit is treated as a potential new MO and reviewed weekly
- Analyst signal channel: a lightweight way for ops to report "something weird" with a case link, triaged weekly by strategy
- Customer contact mining: themes in support contacts and complaints, such as "I didn't authorize this" or "someone called me claiming to be you" (see Customer Contact Signals)
- Promo and offer chatter monitoring: public deal forums and social media for your offers, to catch leaked codes and exploit discussions early
Red-teaming your own flows
Structured abuse testing of your own products, ideally before launch (see New Product and Promo Launch Review):
- Scope: a specific money path or promo
- Method: a threat-modeling workshop that walks the path as each actor type (third-party, first-party, organized ring, insider, coached victim), plus authorized testing in non-production or tightly controlled production environments
- Rules of engagement: written authorization; no real customer data; test accounts flagged; findings handled as confidential and fixed before broad discussion
- Outputs: a gap list with severity, mapped to controls; reusable test cases for future launches
Converting intel into controls
Every relevant intel item should end in one of these outputs:
| Output | Example | Owner |
|---|---|---|
| Detection hypothesis | "Check whether accounts receiving first-time large inbound P2P and then immediately buying crypto match the mule pattern in the alert" | Strategy, via Fraud Strategy Lifecycle |
| Emergency rule | Narrow, time-boxed control while analysis proceeds | On-call strategist |
| SOP update | Add a new red flag to the review checklist | Ops / policy |
| Training update | Brief support on a new impersonation pretext | Training (see Support Team Fraud Training) |
| Customer education | In-app warning on a newly active scam type | Product, CX (see Customer Education and Scam Warnings) |
| Launch criteria | Add a check to the launch checklist | Strategy / governance |
| Risk assessment update | Raise the likelihood rating for an affected flow | Governance (see Fraud Risk Assessment) |
| Share back | Contribute your observation to peers or a consortium | Intel lead, with legal |
| No action, with rationale | "Not applicable: we don't offer that rail" | Intel lead |
Emerging-threat watchlist (as of late 2026)
These themes deserve standing coverage. Each links to the mechanism note.
| Theme | Why it matters for transaction fraud | Where to go |
|---|---|---|
| Synthetic media against identity and authorization | FinCEN's November 2024 alert reported more SARs describing suspected deepfake use, especially fake identity documents used to get through verification. Voice and video impersonation also feed authorized-payment scams. | Generative AI and Deepfake Fraud, Document Verification and Liveness, Case Study - Arup Deepfake Video Call (2024) |
| Agentic commerce | AI agents initiating purchases and payments create new questions about intent, authorization and liability, and new impersonation surfaces | Agentic Commerce Fraud |
| Industrialized investment and relationship scams | Investment scams were the largest reported FTC loss category in 2024 (about $5.7B). FinCEN's 2023 pig-butchering alert lists behavioral red flags visible at the transaction layer. | Investment Scams (Pig Butchering), Case Study - Prince Group Pig Butchering Enforcement (2025), Playbook - Scam Intervention Members |
| Scams paid via bank transfer and crypto | The FTC reported that in 2024, losses to scams paid by bank transfer or crypto exceeded all other payment methods combined | Authorized Push Payment (APP) Scams, Real-Time Payment Rail Fraud |
| Social-media-originated scams | The FTC's April 2026 Data Spotlight reported social-media scam losses about eight times the 2020 level | Impersonation Scams, Customer Education and Scam Warnings |
| Task and job scams that turn victims into mules | FTC flagged gamified job scams as driving record losses (December 2024). Victims also become unwitting money mules. | Money Mules, Playbook - Money Mule Detection Members |
| Crypto ATMs and kiosks as scam off-ramps | FTC Data Spotlight (September 2024) on Bitcoin ATMs as a scam payment portal | Gift Card Fraud, Elder Financial Exploitation |
| ACH credit-push fraud monitoring obligations | Nacha's risk-based fraud monitoring rules took effect in 2026 (Phase 1 March 20; Phase 2 June 19, practically June 22). They cover false-pretenses credits on both the originating and receiving side. | Nacha Rules and ACH Risk, ACH Funding Fraud |
| Fraud-as-a-service specialization | Specialized roles and services lower the skill bar and speed up adaptation | Fraud-as-a-Service Ecosystem |
| Infostealers and session theft | They skip login controls, which pushes defense toward transaction-level step-up | Session Hijacking and Infostealers |
| Viral logic exploits | Social media turns a logic flaw into a mass event within hours | Business Logic Exploitation, Case Study - Chase Infinite Money Glitch (2024) |
Staffing and cadence
| Maturity | Setup |
|---|---|
| Early | A rotating "intel duty" among strategists; 1–2 hours a week reading primary sources; a shared channel |
| Scaling | A part-time intel lead; a weekly digest; a monthly emerging-threats review with strategy |
| Mature | A dedicated intel analyst or team; priority intel requirements set quarterly; formal sharing memberships; a red-team program; intel KPIs |
| Cadence | Forum | Output |
|---|---|---|
| Daily | Intel triage (async) | Items tagged and routed; urgent items to on-call |
| Weekly | Intel digest | 5–10 items, each with "so what for us" and an owner |
| Monthly | Emerging threats review | Hypotheses opened; launch criteria and SOP updates |
| Quarterly | Horizon scan to the risk committee | Risk assessment updates; roadmap bets |
Artifacts and templates
Intel item template
- Title and date observed
- Source (category, reliability A–D, credibility 1–4, or your own scale)
- Mechanism and rail tags (use vault taxonomy: Frameworks and Taxonomies)
- Summary. What was observed, at a conceptual level
- Applicability. Which of our money paths are exposed, and current control coverage
- Indicators. Observable behaviors in our data, described from the defender's side
- Recommended action and owner
- Status. Open / actioned / not applicable (with rationale)
- Feedback. Did we later see it? Did the action help?
Horizon scan template (quarterly)
- Top 5 themes, each with drivers, timeline, exposure and confidence
- Changes since last quarter
- Regulatory and network changes in flight
- Product roadmap items that intersect with the themes
- Recommended investments and risk acceptance decisions
Information-sharing checklist
- Legal review of what can be shared, with whom, and under which safe harbors
- Membership in relevant sharing bodies (sector ISAC, consortiums, industry groups)
- For eligible financial institutions: registration status for FinCEN 314(b) voluntary sharing
- An internal approval path for outbound sharing
- Data minimization rules: share indicators and patterns, not unnecessary PII (see Privacy and Data Use in Fraud Prevention)
- A law enforcement liaison point of contact
FinCEN's June 12, 2026 314(b) fact sheet sets eligibility and scope. Eligible participants are financial institutions subject to a FinCEN AML program requirement, and associations of them. Fraud is covered as a money-laundering predicate, including attempted transactions and mule recruitment. Both parties must be registered, and the sharer must take reasonable steps to verify the counterparty. Registration runs through the FI Portal. Under 31 CFR 1010.540, a notice lasts one year and must be renewed.
Metrics
| Metric | What it tells you |
|---|---|
| Lead time. Days between first external report of an MO and first internal detection or control | The core value of the function |
| Actioned rate. Share of relevant intel items that produced a control, SOP or training change | Intel vs trivia |
| Unexplained-loss share. Losses with no prior rule, model or intel coverage | Blind spots |
| Red-team findings fixed before launch | Pre-emptive value |
| Sharing reciprocity. Items contributed vs received | Standing in the community |
| Time to brief. New MO to support and ops briefing | Frontline readiness |
Pitfalls
- The newsletter trap. A weekly digest nobody acts on. Every item needs a "so what for us" and an owner.
- Hype over evidence. Vendor reports and viral posts inflate novel threats. Weigh by source quality and by your own data.
- Collecting attacker how-to. You need indicators and behaviors, not scripts or tutorials. Collecting the latter creates legal and leak risk.
- Ignoring the inside. Internal anomaly signals and analyst observations usually lead external intel for threats aimed at your specific flows.
- No feedback loop. If you never check whether intel items materialized, you can't calibrate your sources.
- Sharing nothing. Information sharing runs on reciprocity. Teams that only consume eventually get less.
Related
- Fraud Program Overview · Playbook - Novel Attack Detection Members · Fraud Incident Response · Fraud Strategy Lifecycle · Fraud Risk Assessment · Fraud Tabletop Exercises
- Signals and controls: External Intelligence Feeds · Consortium and Data Sharing · Graph Analytics
- Resources: Reports and Data Sources · Regulatory and Government Sources · Communities and Conferences · Newsletters and Podcasts
Sources and further reading
- FinCEN Alert FIN-2024-Alert004 on deepfake media fraud schemes (Nov 2024): red flags for synthetic media in identity verification; SAR key term
- FinCEN news release on the deepfake alert (Nov 13, 2024): increase in SARs describing suspected deepfake use
- FinCEN Alert FIN-2023-Alert005 on pig butchering (Sep 2023): behavioral red flags; SAR key term FIN-2023-PIGBUTCHERING
- FTC, New FTC data show a big jump in reported losses to fraud to $12.5 billion in 2024: 2024 losses, investment and imposter scam figures, bank transfer and crypto payment methods
- FTC Data Spotlight index: spotlights on social-media scams (2026), job scams (2024), Bitcoin ATMs (2024), impersonation targeting older adults (2025)
- FBI Internet Crime Complaint Center (IC3): complaint-reported losses 2020–2024
- Nacha, Fraud Monitoring Phase 1 and Phase 2: 2026 risk-based ACH fraud monitoring obligations and effective dates
- OWASP Automated Threats to Web Applications: framing automated abuse as misuse of valid functionality
- Federal Reserve FedPayments Improvement, FraudClassifier and ScamClassifier: shared classification vocabulary for tagging and sharing intel