The Federal Trade Commission (FTC) may update a rule to make technology companies more liable when fraud occurs. While the specifics aren't finalized, you can prepare by assessing whether your fraud controls, evidence trail, and governance would withstand increased liability on your platform.
This checklist provides clear action items, requirement references where applicable, and descriptions of effective practices. It's designed for fraud risk managers at platforms, fintechs, and payment companies that connect consumers with financial services.
Prerequisites
Before you begin, gather:
- A current inventory of products, flows, and partner integrations involving payments, account creation, messaging, or advertising.
- Fraud loss and dispute data, categorized by typology (e.g., account takeover, authorized push payment scams, merchant fraud, impersonation).
- Existing policies: fraud, AML, incident response, and vendor management.
- A designated owner for monitoring regulatory changes, whether that's compliance, legal, or you.
If you're missing the first two, start there. Every item below depends on knowing where fraud enters your system.
Checklist
1. Assign a regulatory watch owner and a trigger process.
Ensure a named person tracks FTC rulemaking and has a documented path to escalate changes to legal, compliance, and product teams. Good practice includes producing a short, dated impact memo whenever the FTC publishes a notice and having a standing agenda slot in your risk committee.
2. Map every point where your platform could be treated as a facilitator of fraud.
Review each product flow and identify where your service provides a channel, account, payment rail, or audience for scammers. A completed map should be reviewed by product and legal teams, with each flow tagged by exposed fraud typologies and corresponding controls.
3. Quantify your current exposure by typology.
Analyze loss, dispute, and reimbursement data for the last full reporting period. You should be able to state, per typology, how much liability sits on your books versus consumers or partners. Establish a baseline to measure changes in liability after any rule updates.
4. Review Multi-Factor Authentication (MFA) coverage on high-risk actions.
Check login, credential change, payee addition, limit changes, and payout redirection. Align authenticator strength with NIST SP 800-63B and, where applicable, the EU's Payment Services Directive 2. Ensure MFA is enforced on all listed actions, with no fallback to weaker factors.
5. Verify identity and onboarding controls against fraudulent account creation.
Ensure your KYC and onboarding checks, including Watchlist Screening and Politically Exposed Person (PEP) identification, are tested against synthetic and mule account patterns. Document false-negative testing and maintain a feedback loop from confirmed fraud back into onboarding rules.
6. Confirm real-time transaction monitoring covers scam typologies, not just card-present fraud.
Ensure you have scenarios for scam-driven transfers, mule behavior, and Structuring (Smurfing) patterns, with documented thresholds and tuning history. Alerts should be reviewed within a defined SLA, with tuning decisions recorded.
7. Test your Suspicious Activity Report (SAR) workflow end to end.
Where Bank Secrecy Act obligations apply, confirm that fraud and scam cases meeting the filing threshold become SARs. Sample closed cases should reconcile to filings, with consistent narrative quality and timely filing.
8. Protect Cardholder Data in every payment flow you touch.
If scam response increases data collection, your PCI DSS scope may expand. Ensure the Primary Account Number (PAN) is unreadable where stored (Requirement 3.5), access is restricted by Role-Based Access Control (RBAC) and Least Privilege (Requirements 7 and 8), and scope is validated through Segmentation Testing (Requirement 11.4.5). Maintain a current data flow diagram and scope statement.
9. Build the evidence trail now.
Greater liability means proving what you knew, when, and what you did. Log fraud decisions, alert dispositions, takedowns, and customer warnings with timestamps, retain them per policy, and ensure they're retrievable within a stated time.
10. Define your consumer-facing scam response and reimbursement position.
Develop a written policy for reports, holds, recalls, and customer reimbursement, reviewed by legal against existing dispute rights like the Fair Credit Billing Act. Create a decision tree for support staff, with escalation paths and tracked outcomes.
11. Reassess partner and third-party risk.
Ensure contracts with processors, ad networks, messaging providers, and marketplaces specify fraud reporting duties, data sharing, and loss responsibilities. Review indemnity and cooperation clauses with a liability shift in mind, and exercise audit rights.
12. Run a tabletop exercise on a regulatory liability scenario.
Simulate a large scam wave on your platform and walk through detection, containment, customer remediation, and regulator contact. Produce a written after-action report with owners and deadlines for addressing gaps.
13. Document governance and board reporting.
Ensure fraud metrics, control effectiveness, and regulatory change status reach senior leadership regularly. Reference your NIST Cybersecurity Framework (CSF) mapping or FFIEC IT Examination Handbook alignment if applicable. Document leadership's engagement with the data.
Common Mistakes
- Waiting for final rule text. Controls, data, and contracts take longer to fix than a comment period lasts. Start with what's verifiable.
- Treating fraud and AML as separate silos. Scam proceeds move through mule accounts; if your teams don't share data, you'll miss the pattern and the filing.
- Measuring detection but not evidence. Catching fraud without being able to show how you caught it won't help in a liability dispute.
- Expanding data collection without scoping it. New fraud signals can pull more Cardholder Data into your environment. Re-validate PCI DSS scope after every change.
- Leaving reimbursement policy informal. Ad hoc goodwill decisions become precedent, and inconsistent ones become exposure.
Next Steps
Score each item as done or not done, then rank the gaps by two factors: how much liability exposure the gap represents under item 3, and how fast you can close it. Items 1, 3, and 9 are low-cost and unlock everything else, so prioritize those.
Re-run the checklist whenever the FTC publishes new proposed text, and have legal confirm which items change from "good practice" to "obligation." Whatever the final wording, a platform that can map its fraud exposure and prove its controls will be in a stronger position than one still working out where the risk sits.
