---
title: How to Build a Fraud Program: Fraud at the Foundation
source_page: https://www.sardine.ai/media/fraud-forward/episodes/how-to-build-a-fraud-program
canonical: https://www.sardine.ai/media/fraud-forward/episodes/how-to-build-a-fraud-program
format: text/markdown
date: 2026-09-30T04:01:00.000Z
description: Flipping the script to learn how to build a fraud program. From fraud risk assessment and capacity planning to scam intervention and AI readiness…
---

**Quick links:** [Human page](https://www.sardine.ai/media/fraud-forward/episodes/how-to-build-a-fraud-program) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# How to Build a Fraud Program: Fraud at the Foundation

**Published:** 2026-09-30T04:01:00.000Z

Flipping the script to learn how to build a fraud program. From fraud risk assessment and capacity planning to scam intervention and AI readiness…

What’s up fraud fighters, and welcome back to Fraud Forward!
Today I’m sitting in the guest chair.
If you caught the episode of The Saturday Fraud Strategist that dropped alongside this one, you already know Chen Zamir and I decided to swap roles. He came on Fraud Forward to interview me, and I went on his show to interview him. We are heading to Money 20/20 in Vegas together and thought this would be a fun way to kick it off.
I spend a lot of time asking questions. Sitting on the other side of the mic is a different experience, and Chen does not ask easy questions. This conversation went places I did not fully expect. We ended in a discussion about how to build a fraud program that works, and more importantly, what gets in the way.
If you have ever walked into an organization that has been fighting fraud for a year, spent money on vendors and headcount, and still were at the same place you started, this episode is for you. The answer is a lot deeper than adding another tool.
What you will hear in this episode:
How to build a fraud program assessment when you walk into an organization that has been struggling and nobody can tell you why
Why fraud and risk management starts with people, process, technology, and data in that order, and why most organizations start with technology and create more problems
The fraud capacity planning model I built as a practitioner to prove headcount needs to executives, including the three-minute-per-alert calculation and how to build a 40-hour week model that accounts for everything your team actually does
Why fraud team structure matters before you can optimize anything, and how to answer the centralized versus decentralized question before you start hiring or buying
The fraud risk assessment framework I consider the most important tool in a fraud leader's program, including the difference between inherent risk vs residual risk fraud and why a lack of losses does not mean a lack of risk
Why fraud technology layering done wrong looks like stacking medications that interact badly with each other, and what fraud technology gap analysis actually looks like before a vendor demo
How authorized push payment fraud breaks the fraud stack that was built around a single question, is this actually our customer, and why scam detection behavioral signals require a completely different approach
The scam intervention banking framework I used as a practitioner, including targeted friction, cooling off periods, and the phrase I call my mic drop moment
How I approach fraud executive communication and fraud program advocacy when leadership sees losses on a dashboard and misses the fifteen million the team prevented
The fraud dashboard reporting model I want to see: attempted fraud, prevented fraud, actual loss, normalized against transaction volume or deposits, not just gross fraud losses
Why human in the loop fraud AI is not scalable and what human on the loop means for fraud team skill development right now
Where fraud program maturity actually stands based on the benchmarking work I have been doing, and why fraud teams are doing better than we give ourselves credit for
You should listen to this episode if you:
Are building or rebuilding a fraud program and want to hear how I actually approach it from the ground up, not a framework from a textbook but the real process I used as a practitioner
Have ever had to justify headcount, technology, or budget to a leadership team that does not fully understand what fraud prevention actually involves and want a model that makes the case with data
Work at a bank or credit union and are feeling the pressure of the shift from unauthorized fraud to authorized push payment fraud and scams and are not sure how to adapt your fraud stack
Want the fraud capacity planning model I built manually as a practitioner, the three-minute-per-alert calculation and the 40-hour week breakdown that finally got leadership to listen
Are trying to figure out where AI fits in your fraud program without losing the investigators you have spent years developing
Lead a fraud team and want to know where fraud program maturity actually stands based on the benchmarking work I have been doing across financial institutions
Have ever walked into a room of blank stares when you asked your team what is actually driving fraud losses and needed a better starting point for that conversation
### Episode notes
A fraud program assessment when the team does not know what is wrong
Ask the questions that help understand the fraud mix, not just the fraud losses. Did the fraud mix change? Did losses move from card fraud into scams? Did a new digital product launch without telling the fraud team? Did transaction volume grow? Did alert volume grow faster than actual fraud? Did a control somewhere just shift fraud into another channel?
Most of the time, teams that are struggling cannot answer those questions. And if they could, they would not be in the hole they are in. That is not a criticism. It is a diagnostic. What I am looking for before I recommend anything is whether the fraud strategy actually reflects the fraud the institution is seeing today, not the fraud patterns from three, four, or five years ago when the rules were originally written.
The practitioner’s fraud capacity planning model
This is one of the frameworks I am most proud of, and I built it manually before AI could do it for me. The model starts with the simple question of how much time does your team spend per alert? Not an estimate. An actual measurement.
My team landed on three minutes as a compromise between quick alerts that resolved in under a minute and complex alerts that required five minutes of investigation. From there, I tracked how many alerts were worked, how many produced a case, how much time was spent per case investigation, how many phone calls the team took, how much time was spent on private messages and internal communication, how much time was spent with scam victims, and how much time was spent on process and procedure development.
When you calculate all of that against a 40-hour week and multiply it by the number of people on staff, the gaps appear immediately. I also built in annual professional training requirements, CPEs, and other obligations that most capacity models ignore. The result is a document that proves to executives not just that the team needs more resources, but exactly why, down to the hour. Fraud team leadership advocacy has to be data-driven. Saying we are overwhelmed is not enough. Showing the math is.
The fraud risk assessment framework
My position is that a fraud risk assessment is the most important thing a fraud program needs in order to advocate for what it requires. And most fraud risk assessments are done wrong.
The purpose is not to confirm that wire fraud is high risk. Anyone in the industry already knows that. The purpose is to answer four specific questions. Where are we exposed? How severe could that exposure be? What controls do we have and how effective are they? And what are we going to do about the residual risk?
That last question is where most assessments fall apart. If the assessment gets completed, assigned red, yellow, and green ratings, presented to a committee once a year, and nothing operational changes, the exercise accomplished nothing.
Inherent risk is the risk before you consider any controls. Residual risk is what remains after your controls are applied. The mistake most teams make is rating inherent risk based on historical losses. A lack of loss does not mean a lack of risk. It may mean your controls are working. It may also mean fraudsters have not found that weakness yet. My check fraud example makes this concrete. If every check your institution has ever taken was fraudulent and you had absolutely no controls, how exposed would you be per item? That is your inherent risk. Not your loss history.
Authorized push payment fraud breaks everything the fraud stack is built around
For years, my fraud infrastructure was built around the question is this actually our customer? Device, password, MFA, biometrics, IP address authentication all answer that question. Scams introduce a second question that authentication cannot answer, does our customer understand what they are doing? I can prove with near certainty that the customer initiated the transaction. That proves nothing about whether they initiated it because someone convinced them their money was in danger.
Scam detection behavioral signals work differently. Is this normal behavior for this customer? Is the destination new? Did they change contact information recently? Did they increase transfer limits? Did they add a new device? Did they move money between accounts immediately before the transaction? Are they draining an account they have spent twenty years building? Each signal alone may not mean much. Together they tell a story. And that story requires a completely different approach than the one I built around authentication.
Fraud executive communication and how AI can change fraud fighting
If the board only sees fraud losses, they are only seeing the failures. They need to see what the program is stopping. The fraud dashboard model I want includes attempted fraud, prevented fraud, and actual losses, all normalized against something meaningful like transaction volume, customer growth, or deposits. A two million dollar loss means something very different at a five hundred million dollar credit union than at a fifty billion dollar bank. Losses are easy to measure. Prevention is hard to measure. The dashboard has to show both or leadership is only seeing half the story.
I will be completely transparent. I do not have a definitive answer for how AI changes the fraud investigator role. What I do have is a clear direction. Human in the loop, where investigators review and validate every AI decision, is not scalable. Human on the loop, where my team governs the policy and oversight of AI systems rather than reviewing individual outputs, is where the role is heading. My advice for fraud teams is to start learning now. Identify what technology your program will likely need in two years and begin developing the skills that make investigators valuable in that environment. We cannot get to a preventative, proactive fraud approach as humans alone. We have to start pouring into our teams now so they are ready when that time comes.
### Key takeaways
How to build a fraud program starts with understanding why losses are happening before assuming the answer is more technology or more headcount. The fraud mix, the alert volume, and the control placement all have to be understood before any solution is proposed.
My fraud capacity planning model starts with three minutes per alert and builds out a full 40-hour week picture that proves resource gaps to executives with data rather than frustration.
Inherent risk vs residual risk fraud is the most commonly misunderstood part of a fraud risk assessment. A lack of historical losses does not mean a lack of inherent risk. It may mean controls are working or it may mean fraudsters have not found the weakness yet.
Fraud technology layering means understanding where each piece fits and how it integrates, not adding another tool every time something is not working. The fraud technology gap analysis that happens before a vendor demo is what separates effective layering from a medication stack with bad interactions.
Authorized push payment fraud requires a completely different question than unauthorized fraud. Authentication proves identity. It does not prove intent. Scam detection behavioral signals are what close that gap.
My fraud executive communication framework puts prevented fraud alongside actual losses, normalized against something meaningful like transaction volume. Leadership needs to see both numbers to understand what the program is actually doing.
Human on the loop is where fraud team skill development needs to point right now. Governing AI systems at the policy level is a different skill than reviewing individual alerts, and the time to develop that capability is now.
### Final takeaway
Chen asked me hard questions in this one and I am glad he did. The conversation we ended up having is the one I wish more fraud leaders were having inside their organizations right now. How to build a fraud program is not a one-time exercise. It is a continuous process of assessing where you are, understanding what is driving your results, and making sure your strategy actually reflects the fraud you are seeing today and not the fraud you were seeing five years ago. If this conversation gave you one thing to bring back to your team this week, I hope it is the permission to slow down before you buy the next tool and ask whether you actually know what problem you are trying to solve.
If you want to hear me turn the tables on Chen, head over to The Saturday Fraud Strategist for the other half of this conversation.
Until next time, stay vigilant, stay informed, and keep moving fraud forward.
Episode resources & links:
Connect with Chen Zamir | LinkedIn
Host of The Saturday Fraud Strategist
Helping fintechs build smarter fraud defenses
Co-author of “The Fraud Fighter’s AI Playbook”
Connect with Hailey Windham, CFCS | LinkedIn
Host of the Fraud Forward Podcast
Banking Community Lead at Sardine
Certified Financial Crimes Specialist (CFCS)
2023 Credit Union Rockstar, CU Magazine
Continuous Improvement Award, SAFE Federal Credit Union, 2023
Top 20 Professionals Under 40, The Sumter Item, 2022