FIG/DRG
Systems
Fraud Typologies
Actimize /Guardian
Scopes
100

This document provides the minimum investigation, scope of review, and documentation requirements for the Enterprise Financial Crimes Compliance (EFFC) and Fraud Investigations (FI).

What is the FIG? 

100

This tool is used to conduct research and compile information on DDA account activity. 

What is the DDA inquiry tool? 

100

Erasing information on valid check and replacing it with new information i.e payee name, amount, or signature

What is an altered check? Also check fraud

100

To review your workbench in Actimize, the dropdown list should be set to this. 

What is Fraud-my cases? 

100

This is the scope used for an Alerted Subject Customer to have unusual activity, except for Mortgage, Automobile, Boat and RV Loan cases.

What is scope 7.6.3? 

200

This is primarily used to house the documentation that supports the investigative details and recommendations described in the GED and/or added as case notes directly to the Actimize Case.

What is the Supporting Documentation Spreadsheet (SDS)?

200

This is a mainframe system used to gather and host customer, account, and transactional data.  This system also hosts statement history, teller transactions, wire transactions, and other transactional data/information.

What is hogan?

200

This type fraud occurs when cybercriminals gain unauthorized access to a legitimate user's online account, often by stealing their login credentials, and then use the account for malicious purposes like making fraudulent transactions, changing personal information, or stealing sensitive data. 

What is a account takeover fraud?

200

This red tab is the link that takes us to our case management system that helps create and organize information related to the investigation.

What is Guardian? 

200

This scope is used for Alerted Victim Customers when the Alerted Accounts were closed at the time Triage assigned the case to Investigations

What is scope 7.6.5.1? 

300

Individuals and/or entities are determined to be this when certain identifiers obtained during the investigation meet the criteria:

Full Name (First and Last), 

Tax Identification Number (SSN/EIN)

Government Issued Identification (ID) (Driver License, State ID, or Passport)

OR 

Partial name with :Date of Birth,  Phone Number,  E-mail Address

What is a known subject? 

300

This application is used to pull copies of check images, statements, and return deposit slips. 

What is CaSTR?

300

This scheme, involves using stolen or fake identities to obtain a loan or account. 

The true individual will inform us if they never created or opened an account with USB. 


What is identify theft?  

300

To begin an investigation in Actimize, you set the case to this step. 

What is AML case-Inv in Process? 

300

This general scope is used when the subsequent investigation identifies, specific EVAFE allegations or activity that meets the following EVAFE criteria. 

What is 7.6.6

400

This search must be conducted for all Alerted Customers determined to be Subjects by an Investigator.

What is a TLO search?


400

This is an internal website to look up branch and ATM information 

What is the ATM branch locator? 

400

On 05/15/2025, 1 ACH credit totaling $10,066.59 was received and 3 Zelle debits totaling $6,000.00 were initiated on a USB account. Account is closed to date. The credit was sent from ABC bank, with merchant FAB, the intended recipient of the payment was DAJON BOYD who is not associated with the USB account. What type of fraud is this?

What is ACH fraud?


400

This icon is used to attach case documents to our case. 

What is the paper clip icon? 
400

This scope is used when any account where the Customer is classified as either a Commercial or classified as a National No-Stop or No-Stop Account. 

What is 7.6.5.3

500

U.S. Bank may have an obligation to conduct this on accounts identified with suspicious activity that remained open after the length of review scope covered in a prior SAR, unless the risk of continuing activity has been mitigated.

What is an RV90? 

500

This is used to view Reg E Claims and branch maintenance requests. 

What is customer express? 

500

This is a type of credit fraud where fraudsters acquire credit and then quickly max out their accounts with no intention of repayment. This scam can involve opening multiple accounts, making regular payments to build a positive credit history, and then disappearing after draining the available credit.  

What is bust-out fraud? 

500

This section of Guardian is where notes regarding loss amount, fraud claims, and open-source research should be placed.

What is General Note?

500

This scope is used for victims of a BEC / EAC may be limited to the transactional activity. 


What is 7.6.5.4?