What is the difference between spotting a known fraud pattern and building detection for unknown fraud patterns?

How Known Fraud Detection Differs From Unknown Pattern Detection

Known-pattern detection is rule driven. It looks for events that match a fraud type you already understand, such as a specific account-takeover sequence, a card-testing burst, or a known mule-account pattern. Unknown-pattern detection is hypothesis driven. It tries to surface behaviour that is unusual, inconsistent, or weakly correlated, even when you do not yet know the fraud typology.

What Each Approach Is Optimised to Catch

Known-pattern detection is strongest when fraud has repeatable signatures. It performs well when you can define explicit thresholds, identifiers, sequence rules, or typologies and then tune them for precision. Unknown-pattern detection is strongest when the adversary changes tactics faster than the rule set can be updated, because it can flag novel combinations of signals rather than only pre-declared patterns.

The practical difference is coverage versus certainty. Rule-based detection usually gives clearer explanations, easier case triage, and lower ambiguity. Anomaly and signal-combination detection usually casts a wider net, but it also produces more false positives and requires stronger investigation logic to decide whether a deviation is truly fraudulent or simply rare but legitimate.

How Practitioners Should Use Both Together

Most mature fraud programmes do not choose one approach exclusively. They use known-pattern rules for high-confidence detection, then layer unknown-pattern analytics to catch emerging tactics, edge cases, and cross-channel behaviour that would otherwise sit outside the rule library. That combination improves resilience when fraud shifts from familiar typologies into new account, payment, or behavioural patterns.

For teams building the broader detection stack, this is also a monitoring-design problem: known patterns support explicit controls, while unknown patterns depend on good signal quality, feature stability, and review workflows. A useful internal reference for the lifecycle of identity-driven fraud is Identity Fraud Prevention Guide, which covers how fraud signals, device intelligence, and account-creation abuse can be combined in prevention and detection logic. For defensive pattern libraries and countermeasure mapping, MITRE D3FEND is useful, and for practitioner operations and investigation discipline, SANS Security Resources provides relevant detection-engineering material.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1027 — Obfuscated Files or Information	Fraud detection benefits from mapping evolving attacker tradecraft to known technique patterns.
Recommendation — Map observed fraud behaviours to ATT&CK-style techniques and update detections as abuse patterns change.
NIST CSF 2.0	DE.AE-03 — Anomalies are analyzed to ensure they are not false positives and to determine their significance	Unknown-pattern fraud detection depends on anomaly analysis and triage of unusual behaviour.
	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	Fraud detection is fundamentally a monitoring and signal-observation problem.
Recommendation — Analyze anomalies for fraud significance before escalating alerts. Monitor activity continuously for suspicious or unusual fraud indicators.
OWASP API Security Top 10	API10 — Unsafe Consumption of APIs	Fraud patterns can emerge through abused API interactions and suspicious request sequences.
Recommendation — Inspect API interaction patterns for abuse and escalation paths.

Practitioner Guidance

What to prioritise: Treat known-pattern rules as the fast, explainable layer and unknown-pattern detection as the discovery layer. If a fraud scenario is already well understood and repeatable, a precise rule usually outperforms a generic anomaly score for day-to-day operations.

What to verify: Check whether your “unknown” model is truly detecting novelty, or just repackaging the same known fraud typologies with softer thresholds. If investigators can describe the alert in the same terms as an existing rule, you are probably not gaining real unknown-pattern coverage.

Common mistake: Teams often overfit unknown-pattern detection to volume reduction instead of signal quality. That can suppress useful edge-case fraud, especially when the model is tuned to silence legitimate rare behaviour rather than preserve investigative value.

Practitioner takeaway: Use known-pattern detection to answer “have we seen this before?” and unknown-pattern detection to answer “what is behaving differently enough to deserve a closer look?” The best fraud programmes make those two questions complementary, not competitive.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.