Fraud Defense Use Case

Fraud Intelligence Beyond the Transaction

Fraud does not begin with a transaction. It develops across the internet services, applications, infrastructure, and adversary ecosystems that make fraudulent activity possible.

Team Cymru gives fraud intelligence teams the visibility and context needed to uncover those connections, accelerate investigations, and move from isolated indicators to informed action.

Talk to a Fraud Intelligence Expert See Command for Fraud Intelligence

Built for

Fraud intelligence Investigations Detection Disruption

Visibility from

NetFlow Passive DNS BGP routing Malware intel

Delivered in

Pure Signal™ Command APIs MCP

See Beyond the Transaction

The transaction is the last step, not the first.

Transaction data shows what happened. Fraud intelligence helps reveal how it happened.

Most fraud detection and prevention programs are strongest at the point of transaction. But by the time suspicious activity reaches a payment system, an adversary may already have:

"Fraud is monetized in payments. It is built everywhere else."
Vincent Passaro Head of Attacker Engineering, Stripe Inside the financial fraud kill chain
  • Acquired or tested stolen credentials
  • Established or accessed malicious infrastructure
  • Automated account access
  • Connected domains, services, and hosting resources
  • Reused infrastructure across victims or campaigns
  • Moved through multiple stages of the fraud lifecycle

Effective fraud defense requires visibility before, around, and beyond the transaction, not only at the final point of monetization.

The kill chain of fraud

Six stages run before a loss is booked. Most programs only engage at the last two.

Team Cymru visibility · stages 01 to 04

  1. 01 · Build

    Infrastructure

    Domains, hosting, IPs, services, and fake sites are assembled to support the operation.

  2. 02 · Target

    Targeting

    That infrastructure is directed toward institutions, accounts, employees, or customer populations.

  3. 03 · Engage

    Lure and engagement

    Phishing, impersonation, malicious domains, and redirects bring the victim into the operation.

  4. 04 · Compromise

    Access and control

    Credentials, sessions, accounts, devices, or victim behavior are compromised to establish control.

  5. 05 · Transact

    Fraud execution

    The operation reaches the payment, account, or claims system and fraudulent activity is initiated.

  6. 06 · Cash out

    Monetization

    Funds move out through mule accounts, purchases, transfers, withdrawals, or crypto channels.

Where fraud detection often begins

What earlier visibility changesStages 01 through 04 are where infrastructure is built, directed, and reused. Seeing them turns a single indicator into the shape of an operation, while there is still something to disrupt.

What waiting costsBy the time fraud reaches the transaction layer, the adversary may already have built the infrastructure, reached the victim, and established control. The remaining decision is increasingly about stopping the loss rather than disrupting the operation.

Intelligence Sources

Turn internet visibility into fraud intelligence

Team Cymru helps fraud defenders investigate the external relationships and activity behind fraudulent campaigns using:

NetFlow visibility

Passive DNS

IP and domain intelligence

BGP and routing context

Web certificates

Service and infrastructure fingerprints

Malware intelligence

Historical and current relationships

Graph-based investigation

AI-assisted analysis and automation

The value is not simply access to more data. Team Cymru helps investigators move faster from a suspicious artifact to a clearer understanding of the broader operation surrounding it.

From a single domain, IP address, certificate, service, or other observable, fraud intelligence teams can uncover connected activity, historical relationships, and additional indicators that may support the same campaign or operator.

Operational Outcomes

Investigate faster. Detect earlier. Disrupt more effectively.

Earlier visibility changes what a fraud team can do with an indicator: how fast it resolves, how much of the operation it exposes, and whether the response ends at containment or reaches disruption.

Reduce fraud investigation time

Move from an isolated indicator to the relationships, infrastructure, and historical activity surrounding it.

Identify connected activity

Find domains, IP addresses, certificates, services, and other resources that may belong to the same campaign, operator, or adversary ecosystem.

Strengthen detection and prevention

Turn adversary behavior and external intelligence into more informed detection logic, analytics, investigative processes, and defensive workflows.

Prioritize what matters

Distinguish isolated suspicious activity from indicators connected to broader malicious operations.

Support disruption

Develop stronger evidence packages for takedowns, platform coordination, law enforcement engagement, and partner collaboration.

Extend intelligence into automation

Make fraud intelligence accessible to analysts, investigation tools, internal systems, AI assistants, and agents.

Fraud Intelligence Use Cases

Where fraud teams put this to work

Each of these starts with something a fraud team already has: an address, a domain, a certificate, a case that does not add up.

Investigate fraud-enabling activity

Start with an IP address, domain, certificate, service, or other observable and uncover the surrounding relationships and activity.

Connect campaigns and operators

Identify reused resources, common services, historical relationships, and patterns that connect seemingly separate fraud events.

Support account-takeover investigations

Investigate the infrastructure and services supporting credential theft, credential testing, automated access, and account exploitation.

Uncover phishing and impersonation campaigns

Trace domains, hosting, certificates, IP relationships, and adjacent resources associated with phishing, impersonation, and other fraudulent activity.

Investigate automation and bot-enabled abuse

Develop greater context around the resources enabling automated account creation, credential attacks, scraping, testing, and transaction abuse.

Enrich fraud investigation tools and systems

Bring external fraud intelligence into internal analytics, cases, detection systems, investigative workflows, and agentic environments.

Build stronger disruption packages

Give analysts, partners, trust groups, platforms, and law enforcement the context needed to understand connected activity and take informed action.

FT3 2.0

Fraud defenders need more than isolated indicators

They need a shared way to describe adversary behavior, connect fraud intelligence to defensive action, and carry that knowledge into investigations, detections, mitigations, and automation.

200+

Techniques in FT3 2.0, alongside analytics, detections, mitigations, and agentic profiles

  • 01FT3 helped establish a full-lifecycle, machine-readable taxonomy of fraud adversary behavior.
  • 02FT3 2.0 advances that work into a living, agentically driven construct.
  • 03Framework relationships connect fraud behavior to established security frameworks.
  • 04Practitioner led and shaped by the communities helping it evolve.

Team Cymru is proud to be a long-standing supporter of FT3 and the practitioner communities helping it evolve. We believe fraud defense improves when defenders have a shared language, meaningful intelligence, and the ability to carry both directly into action.

Built for the community

The tools defenders need, at no cost

See the Operational Marketplace

Built With the People Doing the Work

Fraud crosses boundaries. Defenders have to as well.

An open repository may demonstrate interest. Effective fraud defense depends on something deeper: reciprocity, trusted relationships, meaningful contributions, and a shared commitment to action.

Fraud crosses organizational, geographic, and industry boundaries. The communities defending against it must be able to do the same.

Team Cymru supports trusted, practitioner-led environments where analysts, researchers, hunters, builders, and investigators can share intelligence, teach one another, and solve problems together.

The strongest fraud defense does not come from one company, one sector, one fraud investigation tool, or one dataset. It comes from trusted people combining visibility, intelligence, expertise, and action.

Pure Signal Command

Fraud intelligence, accessible in one place

Pure Signal Command brings Team Cymru visibility and intelligence into one operational environment, helping fraud investigators discover, understand, investigate, and act.

Step 01

Discover

  • Search and investigate internet activity and infrastructure
  • Pivot across connected IP addresses, domains, certificates, services, and historical relationships

Step 02

Understand

  • Visualize connections between indicators and infrastructure
  • Add malware and adversary context to fraud investigations
  • Use AI assistance to accelerate analysis

Step 03

Act

  • Integrate intelligence into fraud investigation tools and workflows through APIs and MCP
  • Operationalize repeatable fraud investigation playbooks
  • Extend intelligence into AI assistants and agentic systems

Command supports the investigative workflow without replacing existing fraud detection and prevention systems. It gives defenders the external visibility and intelligence needed to understand what may exist beyond the transaction.

Request a Command Walkthrough Compare Pure Signal Products

The mission

The mission is what matters.

Saving and improving human lives.

Team Cymru is honored to advance that mission by supporting better fraud intelligence, faster investigations, stronger collaboration, and better outcomes for the people fighting fraud every day.

Team Cymru

Act before losses compound

Visibility before the transaction
is time you get back.

Fraud evolves through connected services, infrastructure, behaviors, adversaries, and communities. Defending against it requires visibility beyond the transaction, fraud intelligence that reveals the broader operation, and investigative tools that can move at the speed of the adversary.

Speak With Team Cymru         →