Most fraud programs start with payment fraud, and for good reason. It’s the fastest path to measurable loss. But teams that stop there often miss account takeover, fake account creation, and promo abuse until those problems show up in support tickets, chargeback disputes, or a spike in customer complaints. By the time it’s visible, it’s usually been costing the business for months.
Building a fraud strategy that covers the full customer lifecycle, not just the checkout page, means accounting for losses that never show up as a chargeback. In a recent Blueprint session, Sift Trust and Safety Architect Maria Benjamin breaks down where those blind spots typically form and how to close them without inflating headcount.
The losses that don’t show up as chargebacks
A lot of fraud loss never appears as a line item labeled “fraud.” Referral programs, loyalty points, giveaways, and service credits all carry real monetary value, even when they’re not tied to a transaction.
Loyalty points are a good example. “Somebody takes over your account in an ATO attack and they don’t actually use your credit cards. What they do is they spend that amount of points and they take that trip to Amsterdam,” Maria explained. “The company is out the cost of both the flight and the cost of the reimbursement.” Points fraud can hit a company twice: once to restore the stolen points, and again to cover what those points paid for.
Giveaways carry their own risk, including legal exposure if the terms aren’t airtight. Maria pointed to the famous case of a promotional giveaway that promised an outsized prize as a joke, only for a participant to actually try to collect it: “You can’t make these big gestures and then think that people will know it’s a joke. People are going to try and collect.” Poorly designed promotions can also invite internal misuse, as seen in cases where giveaways were rigged so only certain people could win, and the fallout became “a loss driver when you think about what they ended up owing for all the legal fees.”
In a live poll of fraud and risk leaders, 64% named referral programs and giveaways as the loss vector their organization was most vulnerable to. Automatic acceptance of disputes without evidence ranked second.
Mapping fraud, risk, and compliance so they don’t collide
One of the biggest sources of inefficiency isn’t a missing rule, it’s overlapping ones written by teams that never talk to each other. Sanctioned entities typically fall under compliance. Multiple-account abuse and referral gaming sit closer to fraud. Unusual velocity patterns and high-risk payment signals span both.
The problem is that these categories blur in practice. A blocked country might be a compliance requirement, a fraud control, or both, depending on what’s actually happening. As Maria put it, thinking through a suspicious signup: “Is that Hello Kitty disguising Jerry trying to make yet another Netflix account? Or is it actually obscuring Jerry, who’s actually a fraudster or someone in a sanctioned country?”
The fix is designing rules around the business outcome, not the department. “If cybersecurity isn’t blocking IPs from outside the United States, then you’re going to have a gap,” Maria noted, and the reverse is just as true: redundant rules across teams waste effort without closing coverage gaps.
That misalignment shows up most visibly when marketing and fraud pull in opposite directions. Maria described a common pattern: a referral program takes off, marketing celebrates the signup numbers, and “the fraud team over here is saying, ‘We have been closing down accounts of people trying to get the referral bonus for hours and hours. Can we please turn the referral off?'” The goal, she said, is making sure fraud and marketing aren’t “trying to fight” each other, but instead swimming toward the same business goal, whether that’s signups, lifetime value, or some other shared metric.
Sequencing your defenses
Rather than treating brand risk, compliance, fraud, disputes, and customer service as separate silos, Maria recommends sequencing them by loss impact. Brand risk comes first, since reputational damage can be business-ending regardless of dollar amount. Compliance follows, because violations carry fines or shutdown risk on a per-instance basis. Fraud sits in the middle, tied to direct financial loss. Disputes and customer service round out the funnel, handling recovery and policy-based credit decisions.
The logic: if someone is blocked for brand risk or compliance reasons, they never need to reach the fraud or customer service teams at all. It reduces redundant review and clarifies who owns which decision.
When asked which team serves as their organization’s first line of fraud defense, most fraud and risk leaders point to the fraud team itself, followed by compliance. Who fraud reports to can also vary widely across companies, landing under financial crimes, the CFO, the COO, or even cybersecurity, depending on the organization’s structure and priorities.
Knowing when to add headcount vs. change tactics
Scaling a fraud program isn’t always a headcount question. Maria described watching a fraud team get pulled into dispute resolution because the volume was overwhelming, only to find the skill sets didn’t match: “In fraud, if somebody lies to you, sends you a doctored document, or tells you something that’s incorrect, you ban them. But in disputes, if somebody’s just trying to get their money back, you’d likely say, ‘Nice try, I’m denying your dispute.'” Applying fraud instincts to disputes work led to bans that weren’t warranted, a signal that the team needed a different tool or a dedicated headcount rather than more of the same process stretched thinner.
The general rule of thumb is that if a team is spending a large share of its time outside its core competency, that’s the signal to invest, whether in a new tool, an added process, or a new hire.
The cost of losing customer trust
Customers who experience fraud on a platform are markedly less likely to stick around, with roughly 27% saying they’d stop using a platform entirely after a fraud experience. “That erosion of trust is so hard to get back,” Maria said, reinforcing why brand risk sits at the top of the priority sequence rather than being treated as an afterthought.
