Part 3 of 3 in our MITRE F3 series: It’s time to execute.

MITRE F3 does a great job of giving fraud and cyber teams a shared language for what they’re seeing. But it doesn’t tell you where to open the suspicious link, how to validate the spoofed portal safely, where to put the evidence once you’ve collected it, or how to safely accelerate your work with emerging tech and AI. This is where investigations get messy, ad-hoc, and fragmented.

The case: A text message that leads somewhere

Consumers reported $470 million in text-message fraud losses in 2024. Most start the same way: a message about a delivery issue, a fake fraud alert, an unpaid toll. The initial message is almost always harmless. The sequence of malicious steps behind it is where things get complicated.

Reconnaissance & Resource Development

Your fraud team gets an alert. A customer reports receiving a text that looked like it came from your payment processor. They didn’t click, but your team wants to validate what’s happening. One analyst needs to examine the SMS infrastructure, trace where the message came from, and determine if there’s a compromised supplier or spoofed sender. They can’t do this on their normal endpoint, because opening suspicious infrastructure exposes your network to attack infrastructure. They can’t do it from a shared machine; they’ll contaminate the evidence. They can’t open it on their personal device, because compliance won’t allow it.

So they open it in an isolated environment. They spin up a clean workspace with OSINT tools, message tracing software, whatever their investigation requires. They validate the sender, trace the infrastructure, and collect evidence without risking anyone.

Initial Access & Positioning

Your SIEM flags a spike in login failures from a residential IP. Someone clicked the link. Your cyber team now has context: this isn’t an isolated phishing event; it’s the beginning of a fraud sequence. Now your fraud team documents what they found: the message appears to route through a legitimate service that’s been compromised. They share this finding with your cyber team in the same investigation workspace. No email. No message that gets lost. Both teams read from the same incident timeline using the same vocabulary. Your cyber team hunts for similar patterns in your logs… but now they’re hunting for the specific indicators your fraud team identified, going faster than ever with secured access to AI agents.

Execution & Monetization

Three customer accounts show signs of manipulation. Account permissions were briefly elevated. Two wire transfers were initiated but never completed. One transferred successfully before being frozen. All of this happens in the same protected investigation environment. A junior analyst reviews account modifications without touching customer-facing systems. A senior investigator validates wire transfer mechanics without risking production databases. Your compliance team reviews the evidence chain without exposure. Multiple people working the same case, same environment, same incident record.

Evidence & Handoff

Your team exports the investigation package: timeline, evidence snapshots, account modification logs, wire transfer records, infrastructure analysis. Complete chain of custody. Audit trail showing who accessed what, when, and from where. You hand this off to law enforcement, your legal team, and your customer relations team with full confidence. This takes one day instead of one week. One environment instead of five different systems. Evidence instead of partial reconstructions.

Making it operational

F3 gives your teams a shared vocabulary for the sequence. When your fraud and cyber teams work together in a space designed for sensitive investigation – where they can open suspicious infrastructure, validate account changes, trace attack chains, and coordinate findings – then, the framework becomes operational instead of theoretical.

Without that space, every step becomes a problem. Opening the suspicious link on a corporate machine potentially compromises it. Sharing findings over email creates audit liabilities. Jumping between systems loses your evidence chain. Handing off partial documentation weakens your legal case. Having any interaction with AI models potentially exposes or compromises your case.

To operationalize F3, create a dedicated investigation workspace: not your production environment, not a shared endpoint. A protected space where your team can open hostile content, run specialized tools, and maintain full audit trails. Your cyber team, fraud team, and compliance team should all have access to the same investigation record, using F3 tactics as your touchpoint words: Reconnaissance, Initial Access, Positioning, Execution, Monetization.

Fraud investigators are increasingly using AI to accelerate analysis. An investigator might ask an AI agent to generate a system profile, view the same suspicious site across three different virtual environments to compare how it renders, then run a diff to spot inconsistencies that signal fraud. They might use AI to answer questions about their fraud kill chain, like looking for which tactic matches this account behavior, without exposing corporate infrastructure to the AI model or leaking investigation details to a third-party service.

This matters even more when investigations require collaboration across sector partners. Multiple fraud teams from different organizations can work together in a shared investigation environment on threats affecting the entire sector. They can analyze attack patterns, compare indicators, build collective defenses, without exposing their individual networks, or using insecure channels. This stands in contrast to approaches that leave teams isolated or require sensitive coordination through email and screen sharing.

Capture evidence in the investigation workspace before you hand anything off externally. For screenshots, logs, and system states, your workspace becomes your evidence repository with a complete chain of custody. When you’re ready to escalate to legal, law enforcement, or leadership, export the complete investigation package: timeline, evidence, audit trail, F3 annotations. This turns weeks into days. It turns fragmented findings into coordinated responses. It turns individual observations into a case.

How fraud gets staged and paid out, and why investigators need to see the whole sequence without exposing themselves

Fraud frameworks are usually written by people who have never had to stop it.

Everyone talks about initial access. Phishing, credential theft, lateral movement. The playbooks are solid. But that’s not where fraud wins. Fraud wins in the middle-ground: when the actor starts preparing the environment, testing controls, moving money, and you’re watching it happen in real time with no safe way to investigate.

That’s what changed in MITRE F3.

The sequence matters more than the moment

MITRE’s new framework adds two tactics that ATT&CK left underspecified: Positioning and Monetization. Translation: what happens after the actor gets in, and what they do to turn access into actual financial loss.

Positioning is the setup phase: Accounts get prepared, data gets staged, controls get tested. A lot of this happens behind the scenes, small actions stacking up into a configuration that’s harder to stop later. You’ll see account modifications, permission changes, reconnaissance of financial systems. It looks like noise until you see the sequence.

Monetization is the finish. That’s where assets move out of your control into theirs. Wire transfers, cryptocurrency movement, account drains. The outcome is visible. The problem is figuring out what led to it. Because by the time you see the loss, the positioning phase was already done.

The real value of F3 isn’t that it renames things. It’s that it forces teams to stop treating access, manipulation, and extraction as separate incidents. They’re one sequence. The work in the overlapping area is where you stop fraud.

 The money is already on the move

The FBI reported nearly $21 billion in cyber-enabled crime losses in 2025. MITRE’s data points to $580 billion in fraud and scams globally. That’s not because attackers are better at breaking in. It’s because we’re not paying attention to what they do after they’re inside.

A suspicious login used to sit in one category. An account change in another. A transfer attempt in a third. You’d investigate them separately, compare notes later, and by then the money was already moving.

With F3, the sequence comes into focus. That login, that account change, that transfer attempt… they’re not three separate incidents. They’re three moves in one attack.

The investigator’s dilemma

Once your team sees the sequence clearly, they need to act fast. An investigator needs to validate activity across accounts, systems, and platforms. They need evidence that holds up. They need to move before the next step in the sequence completes.

Cue the shared endpoints, standard access logs, and credential sharing. The tools they use to investigate often add the same risks they’re trying to contain. You’re trying to stop an actor from moving money, but your investigation process is the one creating exposure, contaminating evidence, or tipping off the attacker that they’ve been spotted.

F3 now gives you a concrete sequence. Next week, we’ll dig into how teams can act on it.

Fraud investigations and cyber investigations have been describing the same incidents in different languages for years. One team sees account activity, payout attempts, or customer impact. The other sees phishing, device abuse, credential misuse, session hijacking, or malicious infrastructure. By the time those views come together, the incident is much further along.

MITRE F3 addresses that operating reality. MITRE’s project materials describe fraud and cyber teams as observing different parts of the same incident and present F3 as a shared behavioral model for relating events, aligning investigations, and disrupting fraud outcomes. It reflects how these incidents unfold across systems, teams, and business processes.

Viewpoints of a fraud incident

F3 treats fraud activity as attacker behavior that can be tracked across a full sequence. It creates a more practical way to connect technical signals to financial outcomes.

F3 is a behavior-based model of fraud actor tactics and techniques built from observed fraud incidents. The project page says the goal is to help organizations align fraud and cyber operations, map observations to attacker behavior, and prioritize actions that prevent and disrupt future fraud. Taxonomy can seem abstract, but this gives teams a clearer way to connect investigations and reduce fragmentation.

That changes how teams work. A suspicious login, a spoofed site, a manipulated session, unusual account behavior, and a payout attempt no longer need to sit in separate queues with separate owners. They can be understood as parts of the same sequence.

Why Now?

MITRE’s Center for Threat-Informed Defense started the Fight Financial Fraud project in 2025 to refine ATT&CK where it already applied to fraud activity and add new content where coverage was missing. Existing models were useful, but they were not giving fraud and cyber teams enough structure for the incidents they were handling.

The timing lines up with the scale and shape of current fraud activity. The FBI said this month that cyber-enabled crimes drove nearly $21 billion in reported losses in 2025. The FTC said consumers reported $15.9 billion in fraud losses last year, and it separately highlighted $470 million in 2024 losses from scams that started with text messages. The common thread is not just volume. It is how often fraud now begins with digital manipulation long before the financial event becomes visible.

The organizations involved reinforce the point. MITRE CTID lists participants including major financial institutions and industry groups alongside security vendors. That level of participation suggests large institutions were already dealing with cyber-enabled fraud patterns that cut across fraud operations, cybersecurity, and business controls.

Key Takeaways

•  Fraud now crosses cyber, payments, and operations.
• Many incidents begin with cyber-driven activity.
• Fraud teams often see the impact later.
• Teams still work from fragmented evidence.
• F3 helps connect one incident end to end.

The Operating Environment Question

A shared model helps teams interpret and communicate what they are seeing. Investigating suspicious sites, validating digital activity, reviewing malicious content, handling sensitive evidence, and coordinating across teams all carry risk when that work happens on exposed endpoints or in the wrong environment. Once teams can connect the behavior chain, they still need a safe, governed place to do the investigation.

F3 brings the behavior chain into view. The next challenge is giving teams a safe place to investigate and act on it.

What’s Next

Part 2 in our series looks at how fraud moves from setup to execution to payout. That is where the framework starts to become especially helpful for teams trying to interrupt activity before the damage is done.