Business Workflow Fraud Detection Requirements

Start with the irreversible or high-consequence transition

A convincing email asks an employee to change a supplier’s bank account. The message is an influence attempt. The fraud succeeds only when an authorized workflow changes payment instructions and value is later sent.

Identify the consequential transition: payment release, bank-detail change, payroll destination change, new supplier, password recovery, legal filing, or transfer of account control. Work backward to the authority, approvals, communication, and data needed to reach it.

This keeps the detection useful when the attacker changes channels. A phone call, chat message, compromised portal account, or manipulated document can replace email. The protected business decision remains.

Represent the workflow as states and authorities

Map request creation, identity verification, data change, review, approval, release, settlement, and reconciliation. Name who can perform each action, which separation of duties applies, and which fields or amounts change the path.

An account may be authorized to submit a change but not to approve it. An executive may approve value but not create supplier details. An automated integration may bypass the user interface while remaining legitimate. Preserve actor, role, session, source channel, target object, before-and-after values, approval chain, policy result, and event time.

The workflow model reveals control gaps and detection points. It also prevents a single login anomaly from becoming a fraud verdict without evidence that the account reached a consequential state.

Independent verification must be independent in fact

A callback to the phone number supplied in the suspicious message is not independent verification. A second approval by an account controlled through the same compromised identity path may add ceremony without adding assurance.

Record the verification channel, reference source, verifier, relationship, time, result, and whether the verifier could modify the authoritative contact data. Strong verification uses a pre-existing trusted route and separates the requester from the evidence used to confirm the request.

Detection can identify skipped verification, recently changed contact data, unusual approval concentration, or confirmation through the same channel. It should not claim verification failed merely because the process differs from one ideal path; emergency and regional workflows need explicit approved alternatives.

Use communications as evidence of influence, not proof of action

The email message trace can show claimed sender, authentication, routing, delivery, and recipient exposure. Collaboration logs can show chat edits, guest participation, or file sharing. These observations help explain how the request reached the employee.

Join them to the business object and workflow using case number, supplier, invoice, employee, account, document, and time. Avoid brittle joins on subject text alone. Preserve whether the relationship is directly referenced or analytically inferred.

A message can be malicious without the workflow changing. A fraudulent change can occur without a suspicious message in monitored channels. Report communication and business state as separate facts before assessing their relationship.

Design response around reversibility and time

A pending bank-detail change may be held for verification. A released payment may require bank contact, legal escalation, and reconciliation. A payroll change may affect one employee or a bulk file. Decision latency and response authority differ by state.

The alert should identify the consequential object, before-and-after state, requester, approvers, verification evidence, communication context, amount or scope, settlement state, and the exact deadline for effective intervention. Severity alone cannot communicate this.

Separate fact, assessment, and speculation. The system recorded a new destination and approval outside the expected verification path. Analysts assess likely fraud based on related evidence. Attribution to a person or actor remains uncertain. That clarity supports fast action without turning a detection into an unsupported accusation.