Fraud & Scam Capability Assessment

Signal Score

A quick, confidential self-assessment covering all 16 domains of the fraud and scam lifecycle — from intelligence and onboarding through detection, recovery, and governance — with a maturity score and directional risk signals.

16Questions

~8 minTo complete

16Capability domains

11Risk signals

Domain 01 / 16

Intelligence Signals

1. How would you describe your ability to spot an emerging fraud or scam typology before it shows up in your own losses?

Little to no external threat intelligence; we learn of new schemes from our own losses.

Ad hoc consumption of industry bulletins or vendor alerts.

Active participation in information-sharing groups with a defined internal distribution process.

Deeply embedded intelligence program that contributes as much as it consumes, feeding detection and training directly.

Domain 02 / 16

Bot Protection

2. How mature is your defense against automated, non-human attack traffic (credential stuffing, scripted account creation, card testing)?

No dedicated bot defense; automated attacks look like normal traffic.

Basic rate-limiting or CAPTCHA on a subset of channels.

Behavioral and device-based bot detection across primary digital channels.

Real-time, adaptive bot defense across all channels, tuned continuously against new automation techniques.

Domain 03 / 16

Onboarding

3. How would you describe identity verification (KYC/CIP) at account opening?

Manual document checks with minimal identity data verification.

Basic automated identity verification, applied inconsistently across channels.

Layered identity verification (document, data, biometric) consistently applied, with defined escalation for anomalies.

Adaptive, risk-based onboarding that blends multiple identity signals in real time and continuously incorporates new fraud patterns.

Domain 04 / 16

Authentication

4. How does your institution verify it's really the customer, session after session?

Single-factor authentication with no anomaly monitoring.

MFA available but not required or consistently enforced.

Risk-based step-up authentication tied to session and device signals.

Continuous, adaptive authentication using behavioral biometrics and real-time risk scoring.

Domain 05 / 16

Deposits

5. How mature are your controls on deposited-item risk (check kiting, RDC fraud, counterfeit items)?

Minimal controls on deposited-item risk; holds are generic and not risk-based.

Basic hold policies and manual review of flagged items.

Risk-based hold and review logic informed by account and item history.

Real-time deposit risk scoring integrated with cross-channel account behavior.

Domain 06 / 16

Payments

6. How would you describe fraud screening across payment rails (wires, ACH, cards, P2P)?

Payment screening is largely manual or rules-only, applied per channel in isolation.

Automated rules cover major payment types, with growing digital coverage.

Cross-channel, risk-based payment screening with defined escalation paths.

Real-time, adaptive payment risk scoring across all rails, tuned to emerging typologies like APP scams.

Domain 07 / 16

Credit

7. How integrated is fraud screening with credit origination and ongoing utilization?

Credit decisions rely on stated data with little fraud-specific screening.

Basic fraud checks layered onto credit underwriting.

Integrated fraud and credit risk review, with post-funding monitoring for bust-out patterns.

Continuous fraud-credit risk scoring across the full lifecycle, from application through utilization.

Domain 08 / 16

Servicing

8. Can your frontline and call-center staff recognize and intervene in social engineering during a live interaction?

Frontline staff have little training to recognize social engineering during service interactions.

Basic training exists but isn't reinforced or tested regularly.

Staff are trained, tested, and use defined scripts and escalation for high-risk requests.

Staff are continuously trained and empowered, backed by system flags that surface risk during the interaction itself.

Domain 09 / 16

Detection

9. How would you describe your fraud detection capability across channels?

Mostly manual review and reactive alerts, siloed by channel.

Automated rules in place, with growing coverage but real gaps between channels.

Cross-channel monitoring with risk-based scoring is established.

Real-time, adaptive detection across all channels with continuous tuning.

Domain 10 / 16

Remediation

10. Once fraud is suspected, how consistent and fast is your account containment response?

Account actions after suspected fraud are manual and inconsistent.

Defined steps exist but aren't consistently followed across channels.

Standardized remediation playbooks with clear ownership and timelines.

Automated, immediate containment actions tied directly to detection, with systematic linkage to related accounts.

Domain 11 / 16

Claims

11. How standardized and compliant is your fraud claims handling (Reg E/Z timelines, documentation, decisioning)?

Claims are handled case-by-case with no formal process or compliance tracking.

A defined process exists but compliance timelines and documentation are inconsistently met.

Standardized claims workflow with compliance tracking and quality review.

Automated, compliant claims handling with pattern analysis to catch repeat-claimant and first-party abuse.

Domain 12 / 16

Recovery

12. How systematic is your loss recovery process (subrogation, chargebacks, law-enforcement referral)?

Loss recovery is rarely pursued beyond the initial write-off.

Recovery is attempted inconsistently, largely dependent on individual case handlers.

A defined recovery process covers subrogation, chargebacks, and law-enforcement referral.

Systematic recovery process with tracked outcomes that feed back into risk and control decisions.

Domain 13 / 16

Offboarding

13. How closely do you review accounts for fraud risk at closure, before funds move?

Account closures follow no fraud-specific review.

Basic checks exist for high-risk closures but aren't consistently applied.

Defined exit review process flags suspicious closure patterns before funds move.

Closure risk is scored using the same real-time signals as the rest of the account lifecycle.

Domain 14 / 16

Continuous Improvement

14. After a loss or near-miss, how reliably does that lesson change your rules, models, or training?

Losses and near-misses are recorded but rarely reviewed for root cause.

Periodic reviews happen but findings aren't consistently acted on.

Formal post-incident reviews feed defined updates to rules, models, or training.

A continuous feedback loop connects frontline findings, data, and leadership decisions in near real time.

Domain 15 / 16

Risk Assessments

15. How current and comprehensive is your formal fraud risk assessment?

No formal fraud risk assessment, or one that hasn't been updated in years.

A periodic risk assessment exists but doesn't cover new products or channels well.

Regular, structured risk assessments cover the full product and channel footprint.

Risk assessments are continuously refreshed and directly shape budget and control investment.

Domain 16 / 16

Audits

16. How independently and regularly are your fraud controls tested?

Fraud controls are rarely, if ever, independently tested.

Periodic audits occur but findings tracking is inconsistent.

Regular independent audits with tracked remediation and defined scope.

Continuous audit and monitoring program with full remediation tracking and regulatory-exam readiness.

Almost done

Where should we send your Signal Score?

We'll use this to prepare your results and follow up if you'd like to talk through them. No spam, ever.

Institution name

Your name

Work email

Phone (optional)

Please answer every question and fill in the required fields above.

Your results

0/64

Where this may leave you exposed

Directional risk signals

Inferred from where your capability scores are lowest right now — a conversation starter, not a certified risk assessment.

Next step

Talk through what this means for you

There's no cost or obligation to a first conversation about your results.

Email these results to Atlantic Signal Group Use the contact form instead

Clicking “Email these results” opens your email app with a message pre-filled to Atlantic Signal Group — just review and hit send.