The Saturday Fraud Strategist

For a couple of years now, Jaanus Uudmäe’s LinkedIn posts have kept showing up in my feed, and they always carry a practical take on what fraud looks like at Bolt. Bolt is an on-demand marketplace headquartered in Estonia that operates in more than 50 countries, with ride hailing, food delivery, scooters, e-bikes, and car rentals. That means his team sees almost every kind of customer and almost every kind of abuse. Jaanus started as a software developer at Skype in 2007 and landed on the fraud team by accident. He joined Bolt in 2017 as a hands-on analyst when the fraud team had two people, and today he has 14 reporting to him.In this conversation, we spend most of our time in what I’d call the gray zone. Gray zone fraud is behavior where you can’t tell whether you’re looking at a fraudster, a frustrated customer, or an ordinary person who tried a trick a friend told them about. We talk about refund abuse and bonus abuse, why first time customers are the hardest to judge, and how to build labels when no one hands them to you. We also get into how to explain losses to the business when the numbers aren’t clean, and how Jaanus’s team uses AI in a way that surprised me.What you’ll hear in this episode:How Jaanus went from a software developer at Skype to leading a 14 person fraud team at BoltWhy marketplace fraud prevention gets harder in a three sided marketplace with riders, drivers, restaurants, and couriersWhat gray zone first party fraud looks like in practice, from refund abuse to bonus abuseWhy first time customer fraud is the hardest call, and how Bolt decides when to act and when to fall back on standard policyThe difference between opportunistic vs professional fraud, and why opportunistic customers make A/B testing unreliableHow fraud label manufacturing works when nobody hands you the answers, and how to avoid recursive fraud labelingWhy label maturity matters, and which proxy metrics keep a team honestHow Bolt thinks about fraud risk appetite and fraud expansion cost when entering a new marketHow AI works as a context layer for analysts, and why the fraud analyst mindset still mattersYou should listen to this episode if you:Deal with refund abuse or bonus abuse and can’t prove intentWork at a marketplace or on-demand platform with more than two sidesAre launching in a new market and need a way to talk about fraud losses with the businessCreate your own fraud labels and worry about fooling yourselfWant to see how a technical fraud team uses AI for analysis without removing human judgment

We talk about fraud rules all the time, but I rarely hear anyone ask what we actually mean by the word. What are rules for, who should write them, and how often should they be reviewed? Over the course of my career, I've found that fraud rule types fall into three distinct categories, and most teams manage all of them the same way. That habit quietly costs a lot. Teams end up over-monitoring some rules, under-monitoring others, handing ownership to the wrong people, and expecting rules to perform in ways they were never designed for.In this episode, I walk through strategy rules, behavioral rules, and trend rules, and explain how each one is written, measured, and owned. If you manage a rule engine, or you're responsible for how a fraud team spends its time, this is a practical way to organize that work.What you'll hear in this episode:Why the three fraud rule types need different monitoring cadences, different owners, and different success criteriaHow ML score fraud rules and threshold fraud rules segment your population into approve, decline, and step-up groupsWhy changing one threshold in a strategy ruleset often means adjusting the others, and why those rules should be measured as a setHow behavioral rules fraud teams write, including velocity rules fraud examples, can catch several rings with the same MO without overfitting to one attackWhat compound fraud rules look like in practice, including a device fingerprint fraud rules example that combines email risk, a new device, and a country mismatchWhy trend rules are your fastest and most accurate tool at first, and why they degrade so quicklyHow the fraud rule lifecycle should work, with narrow rules acting as a stopgap while stronger defenses take overWhat goes wrong with fraud rule prioritization when every rule gets the same attentionYou should listen to this episode if you:Manage a rule engine and want a clear framework for how to write fraud rules that fit their purposeAre building or restructuring a fraud team and need to decide which team should own which rulesWant to improve fraud rule deployment by tying strategy rules to your model release processKeep adding narrow rules to stop attacks and are worried about the false positives piling upRely on a vendor model and need to know what to ask them for when setting thresholds

A few weeks ago I walked through the framework for the AI transformation journey. This conversation with Lalitha Rao, Chief Risk Officer at Imprint, is the natural next step. It is a real, in-the-field look at what it actually takes when a team commits to scaling agentic AI past the theory stage.In the nine months since her risk team started building out their agentic AI infrastructure in earnest, they’ve grown their loan book by 150%, increased revenue by 2.5x, and actually lowered loss rates on newer cohorts. All without cutting a single headcount. Lalitha’s team didn’t treat this as a cost-cutting exercise, they treated it as a way to create more value for Imprint's members and partners. And the results speak for themselves.If you’re further along in your own AI transformation journey and want a real example of what scaling agentic AI actually looks like once the framework meets the field, this is the conversation.What you'll hear in this episode:Why Imprint's centralized AI platform, built by their CTO's team, turned out to matter more than any individual agent they've builtHow ARIA, an autonomous credit policy agent, scours bureau and internal data to find early signs of portfolio deterioration and pushes the efficient frontier outward instead of just optimizing itWhy agentic AI unlocked something a SQL query or a standalone model couldn't, digesting multiple data sources in different formats into one coherent, repeatable workflowHow a residual mining agent continuously finds model errors, builds new features, and retrains models using out-of-time testing to guard against overfittingWhy Imprint never measured success by headcount reduction, and what they built instead with the team's freed-up timeInside Project Shield, a suite of ten fraud agents that runs for six hours, costs about $300 in tokens, and saves hundreds of thousands of dollars in fraud lossesHow a shared skills repository and clear data ownership let a non-engineering risk team build and maintain production-grade agentsLalitha's honest build versus buy framework, and the specific vendors, including Sardine, LexisNexis, and Proof, Imprint still relies onThe real hiccups Imprint hit along the way, bloated proposals, false certainty in AI-generated reviews, and how they built guardrails to fix bothYou should listen to this episode if you:Are further along in the AI transformation journey and want a concrete look at what scaling actually requires beyond the initial frameworkLead a risk, fraud, or credit team and are trying to decide which agentic AI use cases to prioritize firstAre weighing build versus buy decisions for AI agents and want a clear mental model for where proprietary data changes the calculusWorry that scaling AI means shrinking your team, and want to hear a real counterexampleWant practical detail on how to actually enable non-engineers to build and maintain production-grade AI agents

When you get hit by a fraud attack, the second question should be what kind of fraud am I actually dealing with. First party fraud vs third party fraud isn’t just a technical distinction. It fundamentally changes how you respond and what tools you deploy. I’m constantly amazed by how many teams either can’t tell the difference or don’t think it matters.This episode is about fixing that.What you’ll hear in this episode:The core definitions of first party fraud and third party fraudThe specific signals that separate the two in practiceTwo real, costly examples of teams deploying the wrong toolsWhy third party fraud may be easier to detect than most people assume and why first party fraud may be harderThe specific tool stack each fraud type requiresWhy most fraud prevention tooling was built around third party fraud by defaultYou should listen to this episode if you:Are trying to diagnose a rising fraud rate and aren't sure whether you're facing first party or third party fraudHave invested in KYC identity verification or device fingerprinting fraud tools without seeing the results you expectedAre responsible for account takeover detection and want a clearer sense of which signals actually matterNeed to make the case internally for fraud prevention ROI by matching the right tool to the right fraud typeAre dealing with money mule detection or collusion fraud cases that don't cleanly fit either category

I handed my microphone over to Hailey Windham, host of Fraud Forward. For once, I'm the one answering the questions instead of asking them. Hailey opens by asking how I'd describe my mission today, since "builder" doesn't quite cover what I do anymore between advising, educating, and writing. That question sets up the real spine of this conversation. What fraud strategy actually means, why I think predictive fraud analytics is mostly a fabrication, and how a fraud strategist's real job is making sure a team can react well when things break, not pretending anyone can stay ahead of fraudsters. Hailey and I talk about where healthy skepticism turns into a blind spot, why foundation models are proving more valuable for enriching data than for scoring transactions, and I close out with real advice for anyone quietly wondering whether they could go independent themselves.