Fraud Management
Understanding fraud
Fraud is intentional deception for financial gain. The fraud triangle explains perpetrator behavior: pressure (financial or personal incentive), opportunity (weak controls), and rationalization (self-justification). Analysts should classify schemes: card-not-present and account takeover (external and digital), application and identity fraud (onboarding), authorized push payment scams (customer manipulated into paying), cheque and document fraud, and internal fraud such as misappropriation, payroll, vendor, or expense schemes. Detection depends on red flags and analytics: velocity, device anomalies, mismatched contact data, unusual beneficiaries, duplicate invoices, and employees with conflicting access.
Traps
Intent matters. An error is not fraud because it produced a loss; a fraud case needs indicators of deliberate deception. Internal fraud often has no external victim, so questions that look for a customer complaint as the trigger are wrong. Segregation of duties, mandatory leave, and dual authorization are preventive controls; reconciliation and exception reports are detective controls, and questions often swap them. FRAML convergence means fraud and AML teams share data but serve different legal obligations; a fraud alert does not automatically satisfy suspicious activity reporting.
Worked example
One employee can both add a new vendor to the master file and approve payments to it. No loss has occurred yet, but this is a segregation-of-duties gap. The correct response is control remediation plus targeted monitoring, not a fraud report without evidence of intent.
Rule of thumb
Follow the money and the access: identify who could act, what control failed, and whether the pattern is consistent with deliberate deception.