Fraud Risk Assessment Template: Scenarios and Controls

Most fraud losses land on a product or channel that nobody assessed: a new instant payout option, a call centre route that resets credentials, or a partner API that opens accounts without the checks the website applies. This template gives fraud, risk and security teams a working fraud risk assessment that runs product by product and channel by channel, scores each fraud scenario for inherent risk, tests the controls against it and records the residual risk and the decision taken. It follows the Assess component of the GAO Fraud Risk Management Framework and the risk assessment principle in the UK Home Office guidance on the failure to prevent fraud offence. It covers external fraud against customers and the organisation, and fraud by employees, agents and other associated persons. It is written for fraud strategy leads, second line risk teams, product owners and the security engineers who own the identity controls fraud depends on. For the programme around it, read the Fraud Prevention Guide for Digital Businesses; this page is the document you fill in and keep as evidence.

How to use this template

Replace text in square brackets, such as [Organisation], [product] and [risk owner], with your own details. Keep the section numbers so the assessment can be cross-referenced from the risk register and from audit findings.
Complete sections 1 and 2 once, then repeat sections 3 to 6 for each product or business line. Small organisations can run the whole assessment as one workshop; large ones should run it per business line and roll the results up.
Score inherent risk before you look at controls. GAO describes the order as identify inherent risks, assess likelihood and impact, set tolerance, examine existing controls and prioritise residual risk, then document the fraud risk profile. Scoring after controls hides where the exposure sits.
Record the reason for every score and every decision not to act, with the name and role of the person who approved it. The Home Office guidance asks for a documented, dynamic assessment and for decisions not to implement procedures to be recorded with who authorised them.
The scoring scales, thresholds and review periods in this template are NHI Mgmt Group suggestions. Set your own in section 2 and apply them consistently.

1. Assessment scope and context

Field	Value
Assessment owner and sponsor	[Head of fraud], [Executive sponsor, for example CFO or CRO]
Business lines and legal entities in scope	[entities], [countries of operation]
Fraud types in scope	[external fraud against customers], [external fraud against the organisation], [internal and associated person fraud], [fraud committed for the organisation's benefit]
Data used	[loss data for the last 12 to 24 months], [chargebacks and disputes], [complaints], [case management records], [industry alerts], [internal audit findings]
Participants	[fraud operations], [product], [customer service], [identity and access management], [security operations], [finance], [legal and compliance], [HR for internal fraud]
Regulatory drivers	[for example the UK failure to prevent fraud offence, payment scheme rules, sector regulator rules]
Assessment date, version and next review	[date], [version], [next review date and triggers from section 7]

If [Organisation] is a large organisation under the Economic Crime and Corporate Transparency Act 2023, section 6 is needed for the failure to prevent fraud offence, in force since 1 September 2025. The Home Office guidance defines large as meeting two of three tests: more than 250 employees, turnover above £36 million, total assets above £18 million. Take legal advice on whether you meet it. See the UK Failure to Prevent Fraud Offence Guide.

2. Risk tolerance and scoring scales

GAO recommends defining fraud risk tolerance in specific, measurable terms where possible. Write it down before scoring so that the treatment decision in section 5 is a comparison, not a debate.

Tolerance statement	Example wording to adapt
Loss tolerance	Fraud losses for [product] below [x basis points of volume] or [£ amount] a year
Customer harm	No tolerance for fraud scenarios that let a third party take over a customer account without the customer's action
Internal and associated person fraud	No tolerance; every credible scenario needs a preventive or detective control
Friction	Step-up checks may add [n] seconds or [x%] abandonment to [journey]

Score	Likelihood (next 12 months)	Impact
1 Rare	Not seen in our data or the industry	Loss below [£a]; no customer harm; no regulatory interest
2 Unlikely	Seen in the industry, not in our data	Loss [£a to £b]; limited customer harm, fully reimbursed
3 Possible	Seen in our data in the last two years	Loss [£b to £c]; customers affected; complaints
4 Likely	Seen in our data in the last year	Loss [£c to £d]; regulator notification or press interest
5 Almost certain	Seen in our data this quarter or being actively attempted	Loss above [£d]; enforcement, criminal liability or loss of a licence or scheme membership

Risk score is likelihood multiplied by impact. As a starting point (ours), treat 15 to 25 as high, 8 to 14 as medium and 1 to 7 as low. Impact covers more than money: GAO lists non-financial effects such as reputation and compliance, so score the worst of the financial, customer, regulatory and reputational columns.

3. Product and channel inventory

List every product and every channel through which it can be opened, changed or used. Fraud usually moves to the weakest route into the same account, so a product with strong online controls and a weak telephone route is only as strong as the telephone route.

Product or service	Channels	Value that can move	Speed of value movement	Identity checks at onboarding	Owner
[Current account]	[web, app, branch, telephone, open banking API]	[faster payments up to £x]	[instant, irrevocable]	[document and liveness check]	[name]
[Instant credit or BNPL]	[merchant checkout, app]	[credit limit]	[goods shipped same day]	[credit file, device]	[name]
[Loyalty or stored value]	[app, partner API]	[points balance]	[instant redemption]	[email only]	[name]
[Supplier payments]	[accounts payable, email, supplier portal]	[invoice value]	[payment run]	[supplier onboarding check]	[name]
[Customer service account changes]	[telephone, chat, email]	[contact details, credentials]	[immediate]	[knowledge questions]	[name]

Include machine channels: partner and aggregator APIs, AI agents acting for customers, and automated payouts. Each of these authenticates with keys or tokens rather than people. See the Agentic Commerce Fraud Guide.

4. Fraud scenario register

Write each scenario as who does what, through which channel, to gain what. One row per product and channel combination where the scenario applies. The Home Office guidance suggests the fraud triangle (opportunity, motive and rationalisation) as a lens for internal and associated person scenarios; use the opportunity column for every row.

ID	Scenario	Product and channel	Actor	Opportunity (what makes it possible)	L	I	Inherent score	Basis for score
F-01	Account takeover using breached passwords, then payment to a mule account	[Current account, web and app]	External, organised	Password-only login; no new-payee step-up	[4]	[4]	[16]	[cases last year, industry alerts]
F-02	SIM swap or call centre social engineering to reset credentials	[Customer service, telephone]	External	SMS one-time passcodes; knowledge-based questions	[ ]	[ ]	[ ]	[ ]
F-03	Synthetic or stolen identity used to open accounts or take credit	[Onboarding, all channels]	External	Document checks without liveness; no consortium data	[ ]	[ ]	[ ]	[ ]
F-04	Authorised push payment scam: customer persuaded to pay a fraudster	[Payments, app]	External	No payee name check; no scam warnings on high-risk payments	[ ]	[ ]	[ ]	[ ]
F-05	Supplier bank details changed by email from a spoofed or compromised supplier mailbox	[Supplier payments]	External	Changes accepted by email without call-back	[ ]	[ ]	[ ]	[ ]
F-06	Employee or contractor diverts refunds or creates fictitious payees	[Refunds, finance]	Internal	No segregation of duties; shared admin accounts	[ ]	[ ]	[ ]	[ ]
F-07	Agent or sales staff misrepresent a product to hit targets	[Sales, branch or broker]	Associated person, for the organisation's benefit	Commission tied only to volume	[ ]	[ ]	[ ]	[ ]
F-08	Leaked partner API key used to create accounts or redeem value at scale	[Partner API]	External	Long-lived static key; no rate limit per partner	[ ]	[ ]	[ ]	[ ]
F-09	Deepfake voice or video of an executive requests an urgent transfer	[Treasury, finance]	External	Single approver; approvals by call or video alone	[ ]	[ ]	[ ]	[ ]

Use the Top 10 Online Fraud Attacks as a prompt list so that no common typology is missed, and add scenarios from your own case data. F-09 is not hypothetical: in the Arup deepfake fraud an employee made transfers after a video call with a faked CFO, and the lesson is the customer-side control, an approval route that does not rest on a call alone.

5. Control assessment and residual risk

For each scenario, list the controls that address it, classify them and rate how well they work, then re-score. GAO calls this examining the suitability of existing controls and prioritising residual risks.

Scenario ID	Control	Type	Owner	Design rating	Evidence of operation	Residual L	Residual I	Residual score	Within tolerance?
F-01	[Phishing-resistant MFA or passkeys for login; step-up on new payee]	Preventive	[IAM lead]	[Effective / Partly / Not effective]	[coverage %, test result]	[ ]	[ ]	[ ]	[Yes / No]
F-01	[Credential stuffing detection, device and behaviour signals]	Detective	[Fraud ops]	[ ]	[ ]	[score once per scenario, on the last row]
F-05	[Call-back to a known number before any bank detail change]	Preventive	[AP manager]	[ ]	[sample of 25 changes]	[ ]	[ ]	[ ]	[ ]
F-06	[Segregation of duties between payee creation and payment approval]	Preventive	[Finance]	[ ]	[access review]	[ ]	[ ]	[ ]	[ ]

Design rating: Effective means the control would stop or detect the scenario if it runs as designed. Partly means it covers some channels or some volume. Rate a control that exists on paper but has no evidence of operation as Not effective.
Treatment decision: for every residual score outside tolerance record one of Reduce (action, owner, date), Transfer (insurance or contractual), Avoid (withdraw the product or channel) or Accept (approver name and role, date, reason). Copy accepted risks into the Risk Register Template.
Identity controls: many fraud controls are identity controls owned outside the fraud team: login authentication, account recovery, help desk verification, privileged access to payment systems, and the keys that partners and agents use. Name the owner from that team, not the fraud team.

6. Associated persons and fraud for the organisation's benefit

The failure to prevent fraud offence concerns fraud committed by an employee, agent or other associated person intending to benefit the organisation or its clients. The Home Office guidance suggests first identifying the types of associated person, then assessing opportunity, motive and rationalisation for each.

Associated person type	Where they could commit fraud	Motive or pressure	Opportunity	Rationalisation	Score	Procedures
[Sales staff]	[mis-selling, false statements to customers]	[targets, commission]	[limited call monitoring]	["everyone does it"]	[ ]	[balanced scorecard, call sampling]
[Third-party agents and brokers]	[false applications]	[volume bonuses]	[we rely on their checks]	[ ]	[ ]	[due diligence, audit rights]
[Finance staff]	[false accounting, misleading investors]	[results pressure]	[manual journals]	[ ]	[ ]	[journal review, whistleblowing route]
[Contractors and outsourcers]	[false claims to customers or authorities]	[ ]	[ ]	[ ]	[ ]	[ ]

See the Occupational and Internal Fraud Guide for internal fraud controls.

7. Review triggers, approval and reporting

Scheduled review: [annually]. The Home Office guidance says annual or two-yearly reviews are typical and that a court may find a stale assessment unfit for purpose. GAO notes experts suggested intervals from one to five years and stresses that the assessment is iterative.
Triggered review: a new product, channel, partner or payment rail; a merger or new market; a loss event above [£x]; a new typology in industry alerts; a change in regulation; a control failure found by audit.
Approval: [Fraud risk committee] approves the assessment; [Board or audit committee] receives the fraud risk profile with the top residual risks, accepted risks and overdue actions.
Reporting fraud: in the UK, report fraud to Report Fraud (which replaced Action Fraud on 4 December 2025) at reportfraud.police.uk or on 0300 123 2040; in Scotland, report to Police Scotland on 101. Do this in addition to regulator or scheme reporting.

Approval	Name and role	Date	Signature
Prepared by	[ ]	[ ]	[ ]
Reviewed by (second line)	[ ]	[ ]	[ ]
Approved by	[ ]	[ ]	[ ]

Implementation guidance

Start with data, then workshops. Pull 12 to 24 months of losses, disputes and cases by product and channel before the first workshop, so that likelihood scores rest on evidence rather than opinion.
Pilot one product. Run sections 3 to 5 for the product with the most loss or the newest channel, adjust the scales, then roll out to the rest.
Link to measurement. Each high residual risk should have a metric: loss rate, attack rate, false positive rate or time to detect. See the Fraud Metrics and KPIs Guide.
Feed controls back. Treatment actions become rules, model features or identity changes. See the Fraud Rules and Machine Learning Models Guide.

Small and large organisations: a small business can complete this in one session with finance, customer service and IT, keeping sections 3 to 5 to the top ten scenarios. A large or regulated organisation needs one assessment per business line, a central fraud risk profile and independent challenge from the second line.

Where identity fits: account takeover, account recovery abuse, insider payee creation and partner API abuse are all identity failures before they are fraud. Partner keys, payout service accounts and AI agents that act for customers are non-human identities: record their owner, scope and rotation in section 5, and treat a leaked key as a fraud scenario. See the Fraud and Cyber Convergence Guide.

Common failures: scoring residual risk only, so inherent exposure is invisible; assessing products but not channels; leaving out partner APIs and automated payouts; tolerance never written down, so every decision is a negotiation; accepted risks without an approver; and an assessment last reviewed before a new payment rail went live.

Template section	GAO framework	NIST CSF 2.0	NIST SP 800-53 Rev. 5
1 and 2 Scope and tolerance	Commit; Assess (tolerance)	GV.RM-01	RA-3
3 and 4 Inventory and scenarios	Assess (inherent risks, likelihood and impact)	ID.RA-03, ID.RA-04	RA-3
5 and 6 Controls and residual risk	Assess (residual risk); Design and Implement	ID.RA-05	RA-3
7 Review and reporting	Evaluate and Adapt	GV.RM-01	RA-3

Fraud Risk Assessment Template: Products, Channels, Scenarios and Controls