Fraud Typology

A fraud typology is a structured description of one method of committing fraud: who carries it out, who the victim is, how value is obtained, which channels and products are used, and which warning signs tend to appear. Banks, payment firms, card networks and regulators use typologies to label cases consistently, design detection rules, train staff and report fraud statistics.

The word "typology" is borrowed from anti-money laundering work, where the FATF and financial intelligence units publish laundering typologies. A fraud typology focuses on how the original loss happens; a money laundering typology focuses on how the proceeds are moved and hidden afterwards. In practice the two meet, because stolen funds usually pass through mule accounts that AML monitoring is meant to catch.

Doctors do not treat every illness the same way. They have names for diseases, each with known symptoms, causes and treatments, so that when a patient walks in they can match what they see to a known pattern. A fraud typology is a named "disease" of the payments world, with its own symptoms.

For example, one typology describes a crook who phones a customer pretending to be the bank and talks them into moving money to a "safe account". Another describes someone who builds up a good credit record on a card and then maxes it out and disappears. Giving each pattern a name and a description means staff across the firm spot it the same way and the fraud team can build a specific alarm for it.

There is no single global list, but most frameworks sort fraud along a few dimensions:

• Who commits it. Third-party fraud is committed by someone pretending to be, or acting without the consent of, the genuine customer. First-party fraud is committed by the customer in their own name, including bust-out fraud and some forms of friendly fraud. Insider fraud involves employees.
• Authorised or unauthorised. In unauthorised fraud, such as account takeover or stolen card use, the customer did not approve the payment. In authorised fraud, such as authorised push payment fraud, the customer sends the money but was tricked.
• Channel and product. Card-not-present, card-present, online banking, wires, cheques, loans, insurance claims.
• Method. Social engineering, malware, SIM swapping, document forgery, synthetic identity fraud.

The UK's annual fraud reporting by UK Finance, for example, splits losses into unauthorised and authorised push payment fraud and then into sub-types such as investment, romance and impersonation scams. Card networks use their own fraud reason codes for reported fraud and chargebacks.

A typology written for internal use usually covers:

• Narrative. A short description of how the scheme works from start to finish.
• Actors. Fraudster, victim, any mules or complicit merchants, and the role of each.
• Red flags. Observable signs in customer data, device data and transactions, such as a new payee followed by a large first payment.
• Controls. The rules, models and procedures that should prevent or detect it, and who owns them.
• Response. What to do when it is confirmed, including recovery attempts, customer contact and reporting.

Typologies give fraud risk management a common language. Risk assessments list the typologies that apply to each product and rate the strength of controls against each one. Detection teams turn red flags into rules in fraud management systems, in the same way AML teams turn laundering typologies into a transaction monitoring scenario. Investigators tag confirmed cases with a typology in the case management system, so that losses can be reported by type and trends spotted early. Customer education campaigns are also built around the typologies causing the most harm.

Typologies also help link fraud and AML work. Funds from scams are often collected through a money mule network, so a fraud typology for impersonation scams usually points to the AML red flags for mule accounts that receive the money.

Public sources feed internal libraries. Regulators and financial intelligence units publish alerts and advisories listing red flags for specific schemes, card networks circulate fraud bulletins to members, and industry groups share anonymised case data. Firms adapt these to their own products rather than copying them, since a red flag that matters for a card issuer may mean little to a wire transfer business.

Fraud changes quickly, and a typology library that is not reviewed will miss new methods, such as voice cloning or schemes run through new real-time payment rails. Rigid labels can also hide cases that mix several methods. Categories also differ between firms, which makes industry comparisons harder. For these reasons many firms review their typology list at least annually and after any major incident, and share intelligence through industry bodies and public-private partnerships.

• Financial Action Task Force (FATF)
• UK Finance