Fraud & Identity: Mission Domain Intelligence Guide

The synthetic identity that just passed your onboarding checks has a credit file, a utility bill and eighteen months of clean history. It has never existed.

What Fraud & Identity covers as a mission domain

Fraud and identity intelligence covers deception for financial gain against individuals, businesses and public bodies, together with the identity infrastructure that enables it. The domain spans authorised push payment and romance fraud, business email compromise, investment and recovery fraud, account takeover, synthetic and stolen identity, document and credential forgery, card-not-present fraud, insurance and benefits fraud, and the mule networks that move proceeds. Analysts treat fraud as an industrialised service economy with specialist suppliers of data, infrastructure, scripts, call-centre capacity and cash-out channels.

The supply side matters as much as the schemes themselves. Credential and personal data markets feed identity fraud; bulletproof hosting, domain resellers, messaging gateways and proxy providers supply infrastructure; mule recruitment runs through social platforms and job adverts; and large-scale scam operations are increasingly staffed by trafficked workers held in compounds, so perpetrator and victim categories overlap. Effective detection therefore targets shared infrastructure and cash-out chokepoints rather than individual scripts.

Why it matters

Fraud is the most prevalent crime in many countries and among the least reported, so official figures understate it substantially. Losses are personal and frequently unrecoverable: pensions, house deposits, business working capital. Victims report shame, isolation and lasting psychological harm, and identity compromise generates years of remediation. Public-sector fraud drains benefit, tax and procurement budgets, and proceeds are reinvested directly into further organised criminal activity.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Identity records combining a valid but recently issued national identifier with a thin credit file and no verifiable offline footprint.
Multiple accounts sharing a device fingerprint, browser configuration or behavioural biometric pattern behind entirely different names.
Domains registered days before a campaign, resolving to shared hosting with certificates covering many lookalike brand strings.
Inbound payments from many unrelated individuals into a single personal account, immediately dispersed onward to further accounts or crypto.
Payment instruction changes on an invoice arriving from a lookalike domain or from a compromised mailbox with a new forwarding rule.
Job adverts offering payment for receiving and forwarding funds, or for lending a personal account for company use.
Victim reports describing identical script phases, platform migration paths and fake trading dashboards across different brand names.
Recovery approaches made to known victims within weeks of an initial loss, indicating a resold or leaked victim list.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

FBI IC3 annual reports — US complaint volumes and loss data by scheme type, with business email compromise and investment fraud trend analysis.
FTC Consumer Sentinel — Aggregated consumer complaint data broken down by fraud type, contact method and payment method.
UK Action Fraud and NFIB data — Reported fraud and cybercrime volumes with offence classification and regional breakdown for the UK.
Europol IOCTA and threat assessments — Structure of fraud-as-a-service ecosystems and money mule network operations across the EU.
Certificate Transparency logs — Near-real-time record of certificate issuance, exposing lookalike domain preparation before a campaign launches.
Passive DNS, WHOIS, URLhaus and PhishTank — Registration, resolution and reported malicious URL data supporting infrastructure clustering.
IOSCO Investor Alerts and national regulator warning lists — Named unauthorised firms and clone entities soliciting retail investors across borders.
Have I Been Pwned and public breach indices — Exposure of credentials and personal data that feeds downstream identity and takeover fraud.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Classify the scheme precisely — Distinguish authorised from unauthorised fraud and identify the deception mechanism, because liability, remedy and reporting route all turn on it.
Preserve victim evidence — Capture communications, payment records, URLs, applications and dashboards with timestamps before the infrastructure is torn down.
Cluster the infrastructure — Pivot across domains, certificates, hosting, phone numbers, wallets and application builds to expose the single operator behind many brands.
Map the cash-out chain — Trace beneficiary accounts, mule layers and exchange deposits to the point at which funds leave the recoverable perimeter.
Identify enablers — Attribute hosting, registrar, gateway and payment processing providers, and assess which are negligent and which are knowingly complicit.
Pursue recovery and protection — Trigger freezing and recall mechanisms quickly, notify affected institutions and secure identity remediation for the victim.
Refer and share indicators — Report to national fraud reporting bodies and share technical indicators with affected platforms and financial institutions.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Financial Intelligence — Following Value Through the Financial System
Identity Intelligence — Resolving and Verifying Who Someone Is
Cyber Intelligence — Adversary Activity in Networks and Systems
Breach Intelligence — Exposed Credentials and Compromised Data
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Telephony Intelligence — Phone Numbers, Networks, and Telephony Data
Email Intelligence — Email Addresses, Headers, and Mail Infrastructure

Worked in these data points

Email Address — Electronic mail address tied to an individual or organization.
Phone Number — Telephone number for voice, SMS, or messaging identification.
Person / Name — A named individual — the subject of identity resolution and profiling.
Domain Name — Human-readable address that maps to IP infrastructure via DNS.
URL — Uniform Resource Locator pointing to a web resource.
Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
Password / Credential — An exposed password or credential pair from leaks or dumps.
Data Breach — A known data breach or leak incident with exposed records.

Adjacent mission domains

Inside the platform: where Fraud & Identity lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

blockchain.php — Fraud & Identity dashboard
domain.php?d=fraud — Mission domain hub
theater.php?d=fraud — Threat theater view
email-profile.php — Email Address profile
phone-profile.php — Phone Number profile
search.php — Person / Name profile
url-profile.php — Domain Name profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Fraud & Identity:

Phishing Investigation & Takedown — a step-checked workflow with the pivots, sources and handling rules already wired in.
Business Email Compromise — a step-checked workflow with the pivots, sources and handling rules already wired in.
Breach & Credential Exposure — a step-checked workflow with the pivots, sources and handling rules already wired in.
Cryptocurrency Tracing — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Export STIX/MISP
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Classify the scheme precisely is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Cluster the infrastructure turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Refer and share indicators feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Fraud & Identity

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence relevance is twofold. First, personnel and their families are targeted by romance, investment and impersonation fraud at elevated rates, and compromised individuals become security risks through debt and coercion, so fraud awareness sits inside personnel security. Second, procurement and payroll fraud against defence budgets is a persistent internal threat requiring the same analytical techniques. Products support security education, insider risk triage and referral to service investigative branches. Constraints include privacy protections for service personnel, the need to route criminal matters to the appropriate investigative authority rather than handling them internally, and care that debt-related vulnerability is treated as a welfare and security issue rather than purely a disciplinary one.

🕵 National intelligence

National interest focuses on industrial-scale fraud operations with state tolerance or organised crime backing, on the trafficking dimension of scam compounds, and on fraud proceeds funding other threats. Requirements ask who operates the infrastructure, where the compounds and call centres are, and how proceeds move. Fusion combines financial intelligence, telecoms and internet infrastructure data, corporate registries, imagery of compound sites and victim reporting. Handling must account for victim personal data and for the fact that many compound operators are themselves trafficking victims. Dissemination runs to law enforcement, foreign partners, platform and payment providers, and diplomatic channels where a host state is complicit.

👮 Law enforcement

Fraud investigation is volume-constrained, so the analytical priority is clustering isolated reports into cases worth resource. Evidence includes victim statements, banking and payment records, telecoms and subscriber data, device and account data from platforms, and infrastructure records from hosting and domain providers, most requiring production orders and, for foreign providers, mutual legal assistance. Money mule accounts are the accessible layer and rarely lead upward without disciplined network analysis. Charging decisions turn on demonstrable control of infrastructure or proceeds. Victim vulnerability, particularly in romance and investment fraud, affects both evidential presentation and safeguarding obligations.

🔍 Private investigation and corporate security

Corporate work covers payment fraud investigation, business email compromise response, insider fraud, recovery efforts and support to civil claims. The deliverable establishes how the compromise occurred, where funds went and what can be recovered, with speed being the dominant factor in recovery. A private actor cannot obtain subscriber or banking data without a court order, may not access accounts or systems without authorisation, and must not pretext financial institutions. Recovery activity should run through the banks' own recall processes and civil freezing applications, and any promise of guaranteed recovery is itself a marker of recovery fraud, which targets previous victims.

📰 Journalism and OSINT media

Reporting on fraud requires care with victims, who are frequently blamed and who face acute shame. Verify scheme mechanics through documents and infrastructure evidence rather than through victim recollection alone. Corroborate operator attribution carefully, since infrastructure is shared and misattribution can defame a legitimate business. Protect sources inside banks, platforms and payment firms. Where trafficked workers are staffing an operation, report them as victims and never publish detail identifying individuals in compounds, which places them in immediate danger. Give platforms and financial institutions specific right of reply on their controls rather than general questions.

🌍 NGO, humanitarian and human rights

Consumer protection, victim support and anti-trafficking organisations use this work for prevention campaigns, victim advocacy and pressure on platforms and banks. Practice must be victim-centred and non-judgemental, recognising the deliberate psychological manipulation involved and the disproportionate impact on older and isolated people. Documentation should support regulator complaints and reimbursement claims. Where scam compounds are involved, the anti-trafficking obligations dominate: identification, non-punishment and referral come before any investigative interest. Duty of care extends to staff handling distressing victim contact and to survivors of compounds who face reprisal risk against family.

🎓 University and research

Research covers victimology, behavioural mechanisms of persuasion, network structure of fraud services and the economics of scam operations. Methodology must handle severe reporting bias, since most fraud is never reported and reporting propensity varies by demographic and scheme type, so survey-based prevalence work is essential alongside administrative data. Ethics approval is mandatory for victim research given documented distress and suicide risk, with clear support signposting. Reproducibility is served by publishing instruments and coding frames. Researchers engaging with scam infrastructure should have institutional approval, since interaction with live operations raises legal and safety questions.

Playbook: working Fraud & Identity end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Normalise and cluster the reports

Convert incoming reports into a consistent structure: scheme type, contact vector, narrative used, infrastructure touched, payment method, amounts and timing. Then cluster on shared artefacts rather than on narrative similarity, because scripts are commodity goods while infrastructure and cash-out are not. Output is a set of candidate clusters each hypothesised as one operation. Stop when new reports attach to existing clusters instead of generating new ones.

Phase 2 — Map the infrastructure layer

For each cluster, enumerate domains, hosting, registration data, certificate history, messaging gateways, phone number ranges, app distribution and any reused code or templates. Registrar, hosting provider and certificate patterns persist across rebuilds. Output is an infrastructure profile with the durable indicators marked. Stop when you can predict, from the indicators, which newly registered domains belong to the same operation.

Phase 3 — Reconstruct the victim journey

Document the full path from first contact to loss: advertising or approach vector, platform used, escalation to private messaging, the persuasion sequence, the payment instruction, and any follow-on such as a fake recovery approach. This identifies the intervention points where a bank, platform or telecoms provider could have broken the chain. Stop when you can name each chokepoint and who controls it.

Phase 4 — Trace the money to the first hop and beyond

Identify receiving accounts, payment processors, crypto addresses and remittance channels. The first receiving account is usually a mule; the value lies in the consolidation pattern above it. Preserve identifiers immediately, since account closure destroys the trail. Output is a flow diagram with the consolidation points and the off-ramp identified. Stop when the trail reaches a regulated entity that can be served with process.

Phase 5 — Analyse the mule network

Cluster mule accounts by onboarding pattern, device fingerprint, funding source, transfer timing and destination. Distinguish recruited mules, coerced mules and synthetic accounts, because the response differs entirely between a complicit facilitator, a vulnerable person being exploited and an identity that never existed. Output is a mule typology with the network structure above it.

Phase 6 — Assess identity and onboarding compromise

Where synthetic or stolen identity is involved, establish how the identity was constructed and which verification controls it defeated: document forgery, injected biometrics, aged credit files, or breach-derived personal data. This produces control recommendations that actually prevent recurrence rather than generic advice to strengthen verification.

Phase 7 — Attribute cautiously

Move from cluster to operator only on convergent evidence: registration details, payment beneficiaries, operational security failures, language and time-zone patterns, and reuse of identifiers across the estate. Record the confidence of each link separately. Shared hosting, commodity kits and franchise models make premature attribution common and damaging. Stop when you can state what would falsify the attribution.

Phase 8 — Handle the trafficking dimension

Where evidence indicates staff are held in compounds under coercion, switch the analytical frame immediately. Document indicators of trafficking, avoid publishing anything identifying individual operators, and engage anti-trafficking and consular channels. Treating coerced workers as offenders is both an ethical failure and a legal one under non-punishment principles in most jurisdictions.

Phase 9 — Package for disruption at the chokepoints

Different findings go to different holders of leverage: registrars and hosts for takedown, platforms for account and advertising action, banks and payment institutions for account closure and reimbursement, telecoms for number ranges, and law enforcement for the operator. Sequence to avoid warning the operator before the highest-value action. Output is a coordinated disruption plan with owners.

Phase 10 — Support victims and recovery

Ensure victims receive reimbursement guidance, credit protection advice, safeguarding referral where vulnerability is present, and a clear warning about recovery fraud, which specifically targets people who have already lost money. Recovery of funds depends almost entirely on speed of bank recall, so victim guidance should prioritise immediate reporting to their bank over anything else.

Phase 11 — Measure and re-baseline

Track whether the actioned cluster returns, whether victim losses in that scheme type fall, and whether the intervention displaced activity to another channel. Fraud responds to friction by moving, so measure the destination as well as the departure. Output is a short assessment of what actually changed, written honestly enough to guide the next campaign.

Phase 12 — Feed controls back to the ecosystem

Convert the mechanics into detection rules for banks, onboarding checks for platforms, advertising policy changes, and public warning content targeted at the actual victim demographic rather than a general audience. Share sanitised indicators through industry channels. Stop when each observed mechanic has a corresponding control owner somewhere in the ecosystem.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
IC3 Internet Crime Complaint Center	Open	US public reporting portal and annual reports with loss figures by scheme type, state and victim demographic.	Establishes scale and demographic patterns for scheme types and provides a referral route for US-nexus cases.
Action Fraud and UK reporting data	Open	UK national fraud and cybercrime reporting service with published trend data and alerts.	Supplies UK reporting baselines and the formal route for referring victim reports into national assessment.
US Federal Trade Commission consumer sentinel data	Open	Aggregated consumer fraud and identity theft reports with scheme categorisation and loss data.	Provides longitudinal consumer fraud trend data for scheme prioritisation and prevention targeting.
Europol threat assessments	Open	European assessments of online fraud schemes, payment fraud and the criminal service economy supporting them.	Identifies which fraud services and structures are active in Europe and how they are organised.
INTERPOL financial crime and anti-corruption programmes	Open	Global operational coordination on fraud, including notices, operations and the global rapid intervention mechanism.	Routes urgent international requests where stolen funds are moving across borders in real time.
urlscan.io	Registration	Records structure, resources, redirects and infrastructure of submitted URLs with historical search.	Fingerprints phishing and investment scam kits and links apparently separate sites to one operator.
crt.sh certificate transparency search	Open	Searchable log of TLS certificate issuance showing domain and subdomain history over time.	Detects newly registered scam domains before they are used and links them by issuance pattern.
VirusTotal	Registration	Multi-engine file and URL analysis with passive DNS, relationship data and community annotations.	Pivots between domains, IPs and samples associated with a fraud kit or delivery infrastructure.
Abuse.ch platforms	Open	Community threat intelligence including malware samples, botnet infrastructure and abused hosting indicators.	Identifies infrastructure shared between fraud operations and commodity malware distribution.
Spamhaus datasets	Registration	Reputation data on IP ranges, domains and networks with a history of abuse and bulletproof hosting.	Assesses whether infrastructure sits in known abuse-tolerant networks, a strong operator clustering signal.
APWG phishing reporting and trends	Registration	Industry group collecting phishing reports and publishing quarterly trend analysis by sector and method.	Benchmarks phishing volumes and targeting patterns for the sector under analysis.
Blockchain explorers and analytics	Open	Public ledger transaction history, address clustering and exchange deposit identification.	Traces investment fraud proceeds to consolidation addresses and the fiat off-ramp for preservation requests.
OpenCorporates	Registration	Company registry aggregation with officers, addresses and filing history across many jurisdictions.	Resolves the corporate fronts used for merchant accounts, fake investment firms and mule company structures.
FCA warning list and regulator warnings	Open	Published lists of unauthorised firms and clone firm warnings issued by financial regulators.	Confirms that a purported investment firm is unauthorised or is impersonating an authorised entity.
Global Anti-Scam Alliance and victim support networks	Open	Cross-sector coalition publishing scam prevalence research and coordinating industry and NGO response.	Provides comparative prevalence data and connects investigations to victim support infrastructure.
UNODC reporting on organised fraud and trafficking	Open	Analysis of scam centre operations in Southeast Asia including trafficking for forced criminality.	Establishes the trafficking dimension and the regional operating model behind compound-based fraud.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Fraud & Identity. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

urlscan.io and certificate transparency monitoring — Detects and fingerprints scam sites, often before victims arrive. Limitation: commodity kits produce shared fingerprints that over-cluster unrelated operators.
Passive DNS and infrastructure pivoting services — Links domains, IPs and hosting across time to reveal operator estates. Limitation: heavy use of shared and cloud hosting dilutes the signal considerably.
Maltego — Graphs relationships between accounts, numbers, domains and entities. Limitation: encourages visual over-attribution when link confidence is not recorded separately.
Blockchain analytics platforms — Traces proceeds to exchange deposit addresses for preservation requests. Limitation: attribution is vendor-derived, and speed of asset movement often outpaces process.
Device and behavioural fingerprinting in onboarding — Detects mule account creation at scale through shared device and behavioural signals. Limitation: privacy constraints and false positives against legitimate shared devices.
Consortium data sharing platforms between banks — Enables cross-institution mule account detection that no single bank can achieve. Limitation: legal basis and competition constraints limit what may be shared.
Phone number and telecoms intelligence services — Identifies number ranges, carriers and virtual number providers used in a campaign. Limitation: virtual numbers are cheap and disposable, so persistence is low.
Case management with victim safeguarding flags — Ensures vulnerability is identified and referred rather than lost in volume processing. Limitation: depends on consistent frontline recording quality.
Web archive services — Preserves scam site content and claims before takedown removes the evidence. Limitation: dynamic and geofenced content is frequently not captured.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Export STIX/MISP — Streams the selection in CTI standard formats for sharing with partners and ISACs.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Cluster on infrastructure and cash-out, never on narrative. Scripts, brand impersonations and story types are commodity goods sold between operators, whereas hosting relationships, merchant accounts and mule networks are expensive and therefore diagnostic.
The first receiving account is almost never the target. Value lies in the consolidation layer above the mules, so build the network upward from many first hops rather than investigating each mule account as a separate matter.
Speed determines recovery, and nothing else comes close. Funds move through mule chains within hours, so the operational priority for any live case is immediate bank recall and exchange preservation, with the investigation following afterwards.
Recovery fraud is the reliable second wave. Any victim list in circulation will be worked again by people offering to retrieve the money, so victim communication must include an explicit warning, and a new approach to a known victim is itself an investigative lead.
Treat compound-based operations as trafficking cases with a fraud output. The people running the accounts are frequently coerced, which changes the legal analysis, the publication ethics and the intervention design entirely, and getting this wrong causes serious harm.
Synthetic identities are built patiently and detected retrospectively. Look for thin-file accounts that were cultivated for a year with small legitimate activity before a sudden change in behaviour, since the cultivation phase is where the shared fingerprints sit.
Measure displacement, not just disruption. Fraud responds to friction by moving channel, so a takedown campaign that reports success without checking whether losses appeared in an adjacent payment method has measured its own activity rather than any outcome.
Victim recollection is shaped by the manipulation itself. Persuasion sequences deliberately install a false account of events, so reconstruct the journey from platform records, messages and payment data, and use the victim account to fill gaps rather than as the spine.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Fraud & Identity is producing anything, and they are worth baselining before you change process or tooling.

Funds recalled or preserved as a proportion of reported losses, measured by time-to-report band to show where speed interventions pay off.
Proportion of incoming reports successfully attached to an existing cluster, indicating that network-level rather than case-level processing is working.
Reduction in victim losses for a targeted scheme type after a disruption campaign, controlled for displacement into adjacent channels.
Median time from first appearance of new scam infrastructure to detection and action at the registrar, host or platform.
Number of mule network consolidation points identified per campaign, as against counts of individual mule accounts closed.
Proportion of vulnerable victims identified and referred to safeguarding support with a recorded outcome.
Repeat victimisation rate among known victims, which tests whether recovery fraud warnings and protective measures are effective.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Blaming victim judgement rather than analysing the engineering, when well-constructed schemes routinely defeat careful and experienced people.
Treating mules as principals, when many are coerced, deceived, or themselves trafficked into the role.
Chasing individual phishing domains instead of the kit, registrar pattern or panel that generates thousands of them.
Relying on WHOIS after redaction regimes rendered most registrant fields useless; pivot on infrastructure and payment data instead.
Treating reported loss statistics as reality when under-reporting rates for fraud are extreme and highly uneven across demographics.

Legal and ethical considerations

Fraud casework is dense with personal data about both victims and suspects, requiring a lawful basis, minimisation and secure retention. Access to breached credential sets is lawful in some jurisdictions and not others, and credentials must never be tested against live services. Outreach to victims must avoid replicating the approach used by recovery fraudsters. Where scam operations are staffed by trafficked workers, treat identified operators as potential victims and route them accordingly rather than publishing their identities.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Fraud & Identity, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 8 data points, 5 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Why do takedowns achieve so little on their own?

Because domains and hosting are the cheapest part of the operation. A serious fraud operation registers domains in bulk, keeps replacements staged and can be back within hours at a cost of a few pounds. Takedown removes the shopfront while leaving the mule network, merchant accounts, call centre capacity and victim lists intact. Effective disruption targets the expensive and slow-to-replace layers: payment relationships, bank accounts, telecoms number ranges and the people. Takedowns remain useful for reducing immediate victim exposure, but measuring a programme by takedown volume rewards activity against the adversary's lowest cost item.

How do you tell a coerced operator from a criminal one?

Look at the conditions and the recruitment path rather than the conduct. Indicators include recruitment through a fraudulent job advert, international travel arranged by the employer, confiscated documents, inability to leave a compound, quotas enforced by violence, debt for accommodation and food, and communications showing fear of supervisors. Recovered devices frequently contain both the fraud tooling and evidence of the coercion. Where these indicators are present, non-punishment principles apply in most jurisdictions and the person should be treated as a trafficking victim, with referral to protection services rather than prosecution as the default position.

What is the single most effective prevention control?

Friction at the payment step targeted by risk, combined with confirmation of payee. Most authorised push payment losses depend on the victim making a fast, unverified transfer to a new account under pressure. Requiring name matching, imposing a delay on first payments to new payees above a threshold, and delivering a scheme-specific warning at the moment of payment measurably reduce loss. Generic awareness campaigns perform poorly by comparison because the victim is under active manipulation at the point of decision and will discount a general warning they received months earlier.

How should synthetic identity fraud be detected?

Retrospectively and at the portfolio level, not at the point of application. A well-built synthetic identity passes onboarding by design, because it has a credit file, an address history and a plausible footprint. Detection comes from behavioural analysis over time, from identifying shared attributes across many apparently unrelated accounts, and from noticing the cultivation pattern of small, tidy activity followed by rapid credit-seeking. Sharing signals across institutions is what makes this work, since a single lender sees only one account of a portfolio deliberately spread across many.

Is fraud really organised crime, or mostly opportunists?

Both, with an industrialised service layer connecting them. Fraud operates as a service economy: bulk personal data, phishing kits, bulletproof hosting, messaging gateways, mule networks and cash-out services are sold to anyone, which lets small opportunists operate at a scale they could not build themselves. Above that sits genuinely organised activity, including compound operations with hundreds of staff, logistics and management structure. Effective analysis targets the shared service layer, because degrading it affects every operator using it, whereas pursuing individual scripts addresses only one customer of that service.

What should be told to victims immediately?

Three things, in order. Contact your bank now and ask for a recall, because recovery probability falls sharply within hours. Report to the national reporting body so the case can be clustered with others, even though most individual reports do not lead to an investigation. And be aware that you will be approached by someone offering to recover your money for a fee, that this is a second fraud run by people who obtained your details, and that no legitimate recovery service works that way. Add safeguarding referral where vulnerability or repeated targeting is evident.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

UK Payment Systems Regulator reimbursement requirements for authorised push payment fraud, which allocate liability between sending and receiving institutions.
Confirmation of Payee and equivalent name-checking schemes, which address the mismatch between account name and intended payee.
PCI DSS, governing the handling of payment card data and the controls that reduce card-not-present fraud exposure.
EU Payment Services Directive strong customer authentication requirements, which govern authentication and liability for unauthorised transactions.
FATF Recommendations on customer due diligence and wire transfers, which underpin mule account detection and the travel rule for virtual assets.
UN Palermo Protocol and national non-punishment provisions, which govern the treatment of trafficked persons compelled to commit fraud offences.
ISO 27001 and NIST Cybersecurity Framework, where business email compromise and account takeover are treated as control failures.
National fraud reporting frameworks including the US IC3 and UK Action Fraud processes, which structure victim reporting and national assessment.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Internet Crime Report — FBI Internet Crime Complaint Center. Annual US fraud and cybercrime loss data by scheme and demographic.
Consumer Sentinel Network data book — US Federal Trade Commission. Aggregated consumer fraud and identity theft reporting statistics.
Internet Organised Crime Threat Assessment — Europol. European assessment of online fraud and the criminal service economy.
Casinos, cyber fraud and trafficking in Southeast Asia — UN Office on Drugs and Crime. Analysis of scam compound operations and forced criminality.
Phishing Activity Trends Reports — Anti-Phishing Working Group. Quarterly industry data on phishing volume, targeting and methods.
Global State of Scams reporting — Global Anti-Scam Alliance. Cross-country prevalence and loss estimates from survey research.
Warning list of unauthorised and clone firms — UK Financial Conduct Authority. Register of firms operating without authorisation or impersonating authorised entities.
Authorised push payment fraud reimbursement policy — UK Payment Systems Regulator. Regulatory framework allocating liability and requiring reimbursement.
Financial crime and fraud operational coordination — INTERPOL. International mechanisms for urgent cross-border interception of criminal proceeds.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: clusters scam infrastructure and mule chains so isolated reports become network-level cases. Explore the platform, or browse the rest of the library by following any tag above.