Trust
Where the contact appears and what relationship it claims.
Public-interest fraud research
Understand the payment patterns behind scams
Explore how fraud indicators appear across countries, payment methods and scam journeys. Learn what to notice, what to document and how to respond safely.
Evidence-minded guidance. No live statistics or individual case assessments.
Start here
What brings you here?
Choose the perspective that fits your work or situation. Your pathway stays on this page.
Recognise → pause → verify
General public
Spot warning signs, protect a payment and find a safe next step.
See the response checklist Observe → describe → documentPayment & fraud professionals
Use consistent language for signals, transaction roles and case context.
Review analyst fields Identify → verify → escalateBusinesses & compliance teams
Review payment-risk themes and support clear internal escalation.
Explore context examplesDefensive reference
Fraud Pattern Framework
Fraud Flow and Fraud Map use the same trust → transfer → disconnect model. These fictional examples support defensive pattern recognition, not assumptions about intent.
About the framework and vulnerability contexts
Many scams can be analysed as a cycle of trust, transfer, and disconnect. The duration varies
from minutes to months depending on the scam type, the victim's awareness, and contextual
vulnerabilities such as financial desperation, desire for love or companionship, or the appeal
of money. These are vulnerability contexts, not labels or judgments.
All locations and narratives are fictional sample contexts, not live crime statistics or
prevalence estimates. No country or community is inherently associated with fraud. Each example
follows trust → transfer → disconnect and offers safe response guidance.
Transfer
Which provider, instrument, account or delivery region is relevant.
Disconnect
Where contact ends and where the affected person can seek help.
Three settings, one defensive framework
Trust: where the contact appears and what relationship it claims. Transfer: which provider,
instrument, account or delivery region is relevant. Disconnect: where contact ends and where
the affected person can seek help. A location alone proves nothing.
7 of 7 fictional contexts shown
Account-use offer · unusually good offer · single cycle
Trust setting
A remote employment offer appears in sample Region A from an unverified recruiter. Check the organisation through its independently found contact details.
Transfer setting
The offer proposes using a personal account for funds associated with fictional Region C. Unexplained pass-through activity is a warning; do not forward funds.
Disconnect setting
The recruiter stops replying. The account holder contacts their bank in Region A, secures the account, retains correspondence and seeks guidance through an official channel.
Supplier message · borrowed trust · single cycle
Trust setting
A message claims to come from a known supplier and asks for a change to payment details. Verify using a number you already hold, not the one in the message.
Transfer setting
The request moves to a different bank account with no documented reason. A changed payment instruction is a warning; confirm directly before paying.
Disconnect setting
The sender becomes unreachable once funds move. Preserve the message, invoice and payment reference, and contact the bank through its official channel.
Claimed penalty · threat · recursive cycle
Trust setting
An alleged penalty is announced with an immediate deadline and a demand for secrecy. Contact the claimed organisation independently before acting.
Transfer setting
Payment is requested in cash by post. This is a high-risk method: do not send cash, and preserve any delivery instructions if already sent.
Disconnect setting
Further demands follow after payment. Stop responding through the supplied route, keep the record, and seek provider and local reporting guidance.
Personal correspondence · established trust · recursive cycle
Trust setting
Repeated contact has built rapport over time. Familiarity is offered instead of independent evidence; verify through a separate trusted channel.
Transfer setting
A request for money arrives after a period of rapport. Pause the payment and confirm the person's circumstances independently.
Disconnect setting
Contact may stop abruptly or renew with new demands. Preserve messages and references, and involve the provider and appropriate local service.
Claimed emergency · threat · recursive cycle
Trust setting
A crisis or emergency is described with pressure not to check. Contact the affected person through a number you already know.
Transfer setting
An urgent transfer is requested. Verify the claim separately and contact your payment provider promptly if money has moved.
Disconnect setting
The account may shift or go silent. Retain call details, receipts and transaction references, and report through official channels.
Colleague message · borrowed trust · single cycle
Trust setting
A message appears to come from a colleague, possibly from a genuine but compromised account. Confirm through a separate internal channel.
Transfer setting
Gift-card codes are requested. Codes can be transferred quickly and are difficult to recover; never share codes or photos of them.
Disconnect setting
The request stops once codes are sent. Notify the colleague, preserve the messages, and report to the platform and local service.
Recruiter follow-up · established trust · recursive cycle
Trust setting
A recruiter stays in contact over several weeks and builds a sense of familiarity. Verify the employer and role independently.
Transfer setting
A fee or account arrangement is introduced late in the process. Decline payment until the claim is established and check the provider.
Disconnect setting
Contact fades after the request is questioned. Retain the correspondence and seek guidance from the appropriate local service.
No illustrative contexts match
Try broadening your search or filters, or clear all map filters.
Illustrative comparison
Compare across contexts
The Fraud Map reorganises the pattern library into fictional setting-based narratives rather than separate country risk profiles.
Illustrative only: actual payment practices, protections and reporting channels change. Verify current guidance with local providers and authorities.
If something feels wrong
How to respond
You do not need to investigate the sender yourself. Focus on preventing further loss and preserving useful information.
01 / Pause rushed requests. Take time before making another payment.
02 / Verify independently using a number or website you located yourself.
03 / Never share security codes, gift-card numbers or redemption details.
04 / Retain payment receipts, messages and relevant transaction details.
05 / Contact your payment provider promptly through its official channels.
06 / Report concerns to the appropriate authorities in your location.
For analysts
Document the payment journey consistently
Capture observable facts, distinguish reports from verified findings and avoid recording unnecessary personal details here. These are prompts, not a case-submission form.
Payment method · What instrument was involved?
Transaction direction · Incoming or outgoing?
Urgency signal · Was a deadline or threat reported?
Recipient relationship · Was there a legitimate connection?
Account role · Was an intermediary described?
Geography · Where were parties and payments located?