{"text_format":"1","workbook":"xlsx","n_sheets":7,"sheets":["Overview","Instructions","Definitions","Fraud Classification","Data","Deleted Data","Maintenance"],"not_rendered":{"charts":0,"images":2,"macros":1,"external_links":0,"defined_names":35,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Overview","index":0,"n_rows":11,"n_cols":2,"rows_kept":11,"cut":false,"hidden":false,"merged":[[10,1,10,18],[0,1,0,18],[2,1,3,18],[7,1,7,19],[8,1,8,19],[4,1,4,8],[5,1,5,8],[6,1,6,8]]}
[null,"\n\nFraud Classification Tool"]
[]
[null,"Overview: The FraudClassifier model provides an intuitive approach to classifying fraud involving payments. It enables users to classify fraud in a simple and similar manner, independently of payment type, payment channel or other payment characteristics. It was produced by the Fraud Definitions Work Group, which is composed of cross-industry payments fraud experts. The Federal Reserve formed and led this work group in 2019 to address the industrywide challenge of inconsistent classification of fraud in ACH, wire and check payments and untimely fraud reporting."]
[]
[null,"This tool will guide you through three questions in order to help you classify fraud according to the model construct:"]
[null,"1) Who initiated the payment? This question focuses on whether the payment was initiated by an authorized or an unauthorized party.\n\n2) How was the fraud executed? Based on your answer to the first question, this one focuses on the how the fraud was conducted, with consideration given to the multiple parties that may have been involved. For example, an authorized party may have been manipulated by a fraudster – or could have intentionally acted fraudulently. Alternatively, an unauthorized party may have taken over an account or obtained key payment information that allowed the party to initiate a payment.\n\n3) How was the specific type of fraud carried out? Based on your answer to the second question, this one focuses on the specific tactic(s) and approach(s) used to carry out the fraud – for example, how the fraudster took over an account or manipulated an authorized party. "]
[null,"Dependent on how much information you have at the time of the initial fraud classification, you may answer one, two, or all three questions. The answer options for these questions (the resulting fraud classifications) include definitions to help clearly and simply describe the intent of each classification option. To learn more, review the available classification options and accompanying definitions in the Definitions tab.  \n\n"]
[null,"Each fraud classification record is saved to a master list of fraud classifications (on the Data tab) that can be analyzed as desired by you and your organization. "]
[null,"To get started in using this tool and classifying fraud according to the FraudClassifier model, review the information provided on the Instructions tab."]
[]
[null,"DISCLAIMER: The FraudClassifier model was developed by a cross-industry work group to provide a consistent way to classify and understand how fraud occurs across the payments industry. The FraudClassifier model is not intended to result in mandates or regulations, and does not give any legal status, rights or responsibilities, nor is it intended to define or imply liabilities for fraud loss or create legal definitions, regulatory or reporting requirements. While sharing and use of the FraudClassifier model throughout the industry is encouraged, any adoption of the FraudClassifier model is voluntary at the discretion of each individual entity. Absent written consent, the FraudClassifier model may not be used in a manner that suggests the Federal Reserve endorses a third-party product or service.\n"]

{"sheet":"Instructions","index":1,"n_rows":59,"n_cols":4,"rows_kept":59,"cut":false,"hidden":false,"merged":[[58,2,58,17],[39,2,39,15],[2,1,2,17],[0,1,1,17],[10,2,10,17],[13,2,13,17],[14,3,14,17],[15,3,15,17],[16,2,16,17],[17,3,17,17],[24,2,24,17],[26,2,26,17],[29,2,29,17],[25,2,25,15],[27,2,27,15]]}
[null,"Instructions"]
[]
[null,"These instructions are intended to provide assistance on the initial setup of this tool as well as the continual use of the tool. Additional resources around the FraudClassifier model can be found at FedPaymentsImprovement.org."]
[]
[null,"I.  Initial Setup and Ongoing Tool Maintenance"]
[null,"Note: These steps are to be used for the initial setup within your organization and for any updates you wish to make to select fields."]
[null,"a.","Save Excel tool in desired folder location."]
[]
[null,"b.","Open file and enable macros."]
[]
[null,"c.","On the Maintenance tab, you have the ability to determine the values for the following fields: user names, payment type, and payment channel:\n• User Names: This field will be part of the initial information collected when a user is entering a fraud classification and represents those who will be using the tool within your organization."]
[null,null,null,"- Edit the User Names list in column J in the Maintenance tab. "]
[null,null,null,"- This will change the \"Entered By\" dropdown list choices in Section 1 (cell D20) on the Fraud Classification tab."]
[null,null,"• Payment Type: This is a field that will display in the payment attribute section of the Fraud Classification form, allowing your organization to indicate which payment type (e.g. wire transfer, ACH debit, ACH credit, check, etc.) was involved with this fraud event. Understanding organizations may have different terminology for payment types, you can set up the tool to list those specific to your organization. "]
[null,null,null,"- Edit the Payment Type list in column K in the Maintenance tab. "]
[null,null,null,"- This will change the \"Payment Type\" dropdown list choices on the Fraud Classification tab in cell D41."]
[null,null,"• Payment Channel: This is another field that will display in the payment attribute section of the Fraud Classification form, allowing your organization to indicate which payment channel (e.g. remote, mobile, call center, online, etc.) was involved with this fraud event. Understanding organizations may have different terminology for payment types, you can set up the tool to list those specific to your organization. Edit the Payment Channel list in column L in the Maintenance tab. "]
[null,null,null,"- This will change the \"Payment Channel\" dropdown list choices on the Fraud Classification tab in cell D43."]
[]
[null,"II. Using the Fraud Classification Tool"]
[null,"To Add, Edit or Delete Fraud Classification Records"]
[null,"a.","On the Fraud Classification tab, choose whether you want to create a new fraud classification record or edit/delete an existing one (Cell E6)"]
[]
[null,"Creating a New Fraud Classification Record"]
[null,"a.","If you are creating a new record, proceed to Section 2 and complete all fields in this section. (These fields must be completed prior to saving the record.) These fields will help you and your organization manage multiple records within your data tab. "]
[null,null,"Note: The Organization Reference ID field is a user-defined field to provide your organization a way to correlate this fraud classification to your applicable systems and/or records. (This could be a payment number, transaction ID, account number, check number, etc.) If your organization chooses not to use this feature, simply leave “N/A” in this field."]
[null,"b.","For Section 3, complete the fraud classification section by answering the three questions sequentially. You can advance to the next question by using the Tab button on your keyboard. These fields are optional to allow you to answer what you know at the time of the record entry, with the ability to continue your classification at a later time, if needed. Click on each question to link to the respective definitions for the answer options. "]
[null,null,"Note: If you need to change the classifications while in the form, you may either start over at the first question or you can change an answer for a particular question. The tool will automatically repopulate answer options for subsequent questions based on what question response(s) you change.  "]
[]
[null,"c.","Section 4 provides your organization the opportunity to include characteristics, or attributes, specific to the payment that is being classified. These fields are optional and some can be customized to fit your organization’s needs, as described above in the Initial Setup and Ongoing Tool Maintenance section. "]
[]
[null,"d.","Once completed, click Save Classification. This will add the new fraud classification record to the Data tab."]
[]
[null,"Editing an Existing Fraud Classification Record"]
[null,"a.","If you are editing an existing record, choose the field (Organization Reference ID or Record Number) you would like use to search for that record in cell E9."]
[]
[null,"b.","Choose the Record Number or Organization Reference ID of the record you would like to edit in cell E12."]
[]
[null,"c.","Edit the desired fields in the form. "]
[null,null,"Note: You cannot edit the Organization Reference ID. If you need to edit the Organizational Reference ID, please do so in the Data tab."]
[]
[null,"d.","Click the Save Classification button. This will edit the existing record in the Data tab."]
[]
[null,"Deleting an Existing Fraud Classification Record"]
[null,"a.","If you are deleting an existing record, choose the field (Organization Reference ID or Record Number) you would like use to search for that record in cell E9."]
[]
[null,"b.","Choose the Record Number or Organization Reference ID of the record you would like to delete in cell E12."]
[]
[null,"c.","Click the Delete Classification button. This will take the existing classification from the Data tab and move it to the Deleted Data tab."]
[]
[null,"III. Searching for Fraud Classification Records"]
[null,"a. ","As noted above, the Organization Reference ID or Record Number can be used to search for fraud classification records on the Fraud Classification tab. "]
[]
[null,"b.","If this information is unknown, users may search on other values by reviewing the Data tab and using general Excel functionality to find the record in question. "]
[]
[null,"IV. To Save Fraud Classification Records as a Separate File"]
[null,"a.","On Data tab, click the \"Export Data\" button."]
[]
[null,"b.","This will copy the contents of the Data tab and open in a new file. You may then save the new file in your chosen format (e.g. Excel, CSV, Text, etc.) and to your chosen file location."]

{"sheet":"Definitions","index":2,"n_rows":75,"n_cols":2,"rows_kept":75,"cut":false,"hidden":false,"merged":[[1,0,1,17],[9,0,9,17],[20,0,20,17],[24,0,24,17],[25,1,25,17],[27,0,27,17],[34,0,34,17],[37,0,37,17],[48,0,48,17],[57,1,58,17]]}
[]
["Definitions"]
["Section 3 Definitions, Question 1: Payment Initiation"]
["Question for this section of the Model: “Who initiated the payment?”"]
[]
["- Authorized Party: An individual or entity with the right to initiate the payment "]
[]
["- Unauthorized Party: An individual or entity without the right to initiate the payment "]
[]
["Note: Payment Initiation is the creation of an instruction to transfer funds. Examples of instructions include a signed check, ACH individual payment or file, or wire instructions; this also includes the instructions for a future-dated or recurring payment"]
[]
["Section 3 Definitions, Question 2: Fraud Method"]
["Question for this section of the Model: “How was the fraud executed?”"]
[]
["I:   For these classifications, assume the answer to the first question in the Model (“Who initiated the payment?”) was “Authorized Party”"]
[]
["- Authorized Party was Manipulated: Authorized Party is deceived or coerced to initiate a payment"]
[]
["- Authorized Party Acted Fraudulently: Authorized Party initiated the payment with intent to defraud"]
[]
["- Unauthorized Party Modified Payment Information: Unauthorized Party modified the payment information and/or payment instructions (including forged \n   endorsement) after initiation without the knowledge of the payment initiator/Authorized Party"]
[]
["II:   For these classifications, assume the answer to the first question in the Model (“Who initiated the payment?”) was “Unauthorized Party”"]
[]
["- Unauthorized Party Took Over Account: Unauthorized Party gains control of the account, which includes the ability to manage or change account information, and initiates payments without the knowledge of an Authorized Party."]
[null,"Note: Examples of account information that can be changed include personal information, credentials, security notifications, etc. This classification would include situations in which the Authorized Party still has access to the payment account and those in which the Authorized Party has been blocked from their account."]
[]
["- Unauthorized Party Misused Account Information/Payment Instrument: Unauthorized Party does not have control of the account, but obtains a payment \n   instrument or enough account information to initiate a payment without the knowledge of an Authorized Party."]
[null,"Note: Examples of account information include personal information, account number, existing transaction details, etc."]
[]
["Section 3 Definitions, Question 3: Fraud Tactic"]
["- Authorized Party Initiated > Authorized Party Was Manipulated"]
["Question is: How was the authorized party manipulated?"]
[]
["- Products and Services Fraud: A situation involving a transfer of funds in exchange for a product or service, irrespective of the nature of the relationship between the two parties, whereby the receiver of the funds does not deliver the product or service, or delivers a grossly inferior product or service than advertised or promised"]
["Note: Examples include rental scams, travel scams, lottery scams, tech support scams, home repair scams, home alarm scams, free trial scams, brain booster scams, gold coin scams, etc. "]
[]
["- Relationship and Trust Fraud: A situation involving a transfer of funds to a trusted party, or an imposter acting as a trusted or authoritative party, where there is no \n   expectation or promise of goods or services in exchange for the transferred funds; the seemingly trustworthy party can be an existing or emerging relationship or a \n   party pretending to be an authority or reputable company "]
["Note: Examples include IRS imposter scams, Social Security impostor scams, sheriff's office scams (jury duty), romance scams, grandparent scams, utility scams, fake debt collections, duplicate payment scams, etc."]
[]
["- Authorized Party Initiated > Authorized Party Acted Fraudulently"]
["Question is: How did the Authorized Party act fraudulently? "]
[]
["- Embezzlement: Theft or misuse of funds legally placed in one’s trust or belonging to one’s employer "]
["Note: This would include situations involving financial power of attorney"]
[]
["- False Claim: An intentional lie or deception in order to receive a payment or avoid a payment obligation "]
[]
["- Synthetic ID: Synthetic identity fraud (SIF) is the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain\n   identities to defraud financial institutions, government agencies, or individuals"]
[]
["- Authorized Party Initiated > Unauthorized Party Modified Payment Information"]
["Question is: How did the Unauthorized Party modify the payment information?"]
[]
["- Impersonated Authorized Party: A person/organization who does not have authorized credentials,  but has enough information to authenticate as the Authorized Party"]
[null,"Note: Authorized credentials includes account login information (e.g. ID/password) that allows one to access an account and is not specific to personal information, contact information, etc."]
[]
["- Compromised Credentials: Account login information, intended only for an Authorized Party, is obtained by an Unauthorized Party"]
[null,"Note: Account login information (e.g. ID/password) allows one to access an account and is not specific to personal information, contact information, etc. Access to personal information, contact information, etc. would be classified under Impersonated Authorized Party."]
[]
["- Physical Alteration: The act of tampering with a physical payment instrument (to include forged endorsement)"]
[]
[]
["- Unauthorized Party Initiated > Unauthorized Party Took Over Account"]
["Question is: How did the Unauthorized Party take over account?"]
[]
["- Impersonated Authorized Party: see above"]
[]
["- Compromised Credentials: see above"]
[]
["- Unauthorized Party Initiated > Unauthorized Party Misused Account Information/Payment Instrument"]
["Question is: How was the account information/payment instrument misused?"]
[]
["- Digital Payment: Legitimate account information is used by an Unauthorized Party to initiate an electronic payment"]
[]
["- Physical Forgery/Counterfeit: An imitation of a legitimate, physical payment instrument is used to initiate a payment"]

{"sheet":"Fraud Classification","index":3,"n_rows":55,"n_cols":18,"rows_kept":55,"cut":false,"hidden":false,"merged":[[17,7,17,8],[0,2,0,13],[1,2,1,13],[0,1,1,1],[5,1,6,3],[6,10,6,11],[8,1,8,3],[8,10,9,12],[54,1,54,13],[45,3,47,7],[25,8,26,12],[28,8,29,12],[31,8,32,12],[28,3,28,5],[31,3,31,4],[31,1,33,2]]}
[null,null,"FraudClassifier Model",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"MAXA(Data!$A$5:$A$1048576,'Deleted Data'!$A$2:$A$1048576)+1","v":1}]
[null,null,"Fraud Classification Tool"]
[]
[null,"Section 1: Getting Started – Select Action"]
[]
[null,"Do you want to create a new fraud classification or edit an existing classification?",null,null,"Select One"]
[null,null,null,null,null,null,null,null,null,null,"                 Record Number"]
[]
[null,"Select how to retrieve the existing classification to edit",null,null,null,null,null,null,null,null,"Click for \nModel and Definitions"]
[null,"(Organization Reference ID or Record Number)"]
[]
[null,"Select existing classification to edit "]
[null,{"$f":"IF(E9=\"\",\"\",IF(E9=\"Organization Reference ID\",\"(based on your organization’s reference ID)\",\"(based on the record number)\"))","v":""}]
[null,"Section 2: General Information"]
[]
[null,"Organization Reference ID"]
[]
[null,"Entry Date",null,null,"MM/DD/YYYY",null,null,{"$f":"NOW()","v":"2021-04-19T13:07:38.250"}]
[]
[null,"Entered By"]
[]
[]
[]
[null,"Section 3: Fraud Classification"]
[]
[null,"Who initiated the payment?",null,null,null,null,null,"Comments"]
[]
[]
[null,"How was the fraud executed?",null,null,null,null,null,"Comments"]
[]
[]
[null,{"$f":"IFERROR(VLOOKUP(D29,Maintenance!$P$1:$Q$5,2,FALSE),\"What fraud tactic was used? \")","v":"What fraud tactic was used? "},null,null,null,null,null,"Comments"]
[]
[]
[null,"Section 4: Payment Attributes"]
[]
[null,"Payment Amount"]
[]
[null,"Payment Date",null,null,"MM/DD/YYYY"]
[]
[null,"Payment Type"]
[]
[null,"Payment Channel"]
[]
[null,null,null,{"$error":"#N/A"}]
[null,"Comments"]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"DISCLAIMER: The FraudClassifier model was developed by a cross-industry work group to provide a consistent way to classify and understand how fraud occurs across the payments industry. The FraudClassifier model is not intended to result in mandates or regulations, and does not give any legal status, rights or responsibilities, nor is it intended to define or imply liabilities for fraud loss or create legal definitions, regulatory or reporting requirements. While sharing and use of the FraudClassifier model throughout the industry is encouraged, any adoption of the FraudClassifier model is voluntary at the discretion of each individual entity. Absent written consent, the FraudClassifier model may not be used in a manner that suggests the Federal Reserve endorses a third-party product or service."]

{"sheet":"Data","index":4,"n_rows":4,"n_cols":16,"rows_kept":4,"cut":false,"hidden":false,"merged":[]}
[]
[]
[]
["Record Number","Entry Date","Entered By","Organization Reference ID","Question 1","Q1 Comments","Question 2","Q2 Comments","Question 3","Q3 Comments","Payment Amount","Payment Date","Payment Type","Payment Channel","Attribute Comments","Last Edited Date"]

{"sheet":"Deleted Data","index":5,"n_rows":1,"n_cols":16,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["Record Number","Entry Date","Entered By","Organization Reference ID","Question 1","Q1 Comments","Question 2","Q2 Comments","Question 3","Q3 Comments","Payment Amount","Payment Date","Payment Type","Payment Channel","Attribute Comments","Last Edited Date"]

{"sheet":"Maintenance","index":6,"n_rows":11,"n_cols":17,"rows_kept":11,"cut":false,"hidden":false,"merged":[[1,9,1,11]]}
["Payment Initiator","Authorized Party","Unauthorized Party","Authorized Party was manipulated","Authorized Party acted fraudulently","Unauthorized Party modified payment information","Unauthorized Party took over account","Unauthorized Party misused account info or payment instrument",null,"List of Choices (Edit Lists)",null,null,null,null,null,"Authorized Party was manipulated","How was the Authorized Party manipulated?"]
["Authorized Party","Authorized Party was manipulated","Unauthorized Party took over account","Products & Services Fraud","Embezzlement","Compromised Credentials","Compromised Credentials","Digital Payment",null,"Place the values in the order you would like them to appear in the dropdown lists. Should you wish the Organizational Reference IDs to appear numerically, please go to the Data tab and sort the records by the Organizational Reference ID.",null,null,null,null,null,"Authorized Party acted fraudulently","How did the Authorized Party act fraudulently?"]
["Unauthorized Party","Authorized Party acted fraudulently","Unauthorized Party misused account info or payment instrument","Relationship & Trust Fraud","False Claim","Impersonated Authorized Party","Impersonated Authorized Party","Physical Forgery/Counterfeit",null,"User Names","Payment Type","Payment Channel",null,null,null,"Unauthorized Party modified payment information","How did the Unauthorized Party modify the payment information?"]
[null,"Unauthorized Party modified payment information",null,null,"Synthetic ID","Physical Alteration",null,null,null,"User 1","ACH Credit","Call Center",null,null,null,"Unauthorized Party took over account","How did the Unauthorized Party take over the account?"]
[null,null,null,null,null,null,null,null,null,"User 2","ACH Debit","Mobile",null,null,null,"Unauthorized Party misused account info or payment instrument","How was the account information/payment instrument misused?"]
[null,null,null,null,null,null,null,null,null,"User 3","Check","Remote"]
[null,null,null,null,null,null,null,null,null,"User 4","Wire Transfer","Online"]
["Choice_One",null,null,null,null,null,null,null,null,"User 5"]
["Select One","Organization Reference ID"]
["New Classification","Record Number"]
["Edit/Delete Classification"]