Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Shifting to Cyber Fraud Fusion Centers
Transcript
- Lucas: So there's a structural problem inside most big companies that attackers have been exploiting for years, and it's finally getting a real fix. I'm talking about the wall between the security team and the fraud team. Luna: Right—they're often in different departments, reporting up through different chains, using different tools, sometimes not even sharing data. Lucas: Exactly. And that gap is a goldmine for attackers. They'll use a credential stuffing attack on a retail website—that's a fraud problem—but the initial breach of credentials might have come from a phishing campaign the security team spotted months ago. If those two teams don't talk, the attacker gets to reuse those credentials across accounts. Luna: So the fix is what's being called a cyber fraud fusion center. A dedicated team that combines threat intelligence, fraud detection, and incident response into one unit. Lucas: Yeah. And it's not just a buzzword—major banks and retailers have been quietly building these for the last couple of years. JPMorgan Chase, for example, has a pretty advanced one. They've merged what used to be separate fraud ops and cyber threat intel teams under a single umbrella, with a shared data lake and common playbooks. Luna: What does that actually change day-to-day? I mean, beyond just co-locating people. Lucas: Good question. The key difference is data integration. In a traditional setup, the fraud team sees transaction anomalies—like a sudden spike in failed logins from a single IP—but they may not have context on whether that IP is known for malware command and control. Meanwhile, the security team has that intel but doesn't see the transaction data. In a fusion center, both signals hit the same analytics engine. Luna: So you can correlate a phishing campaign with a subsequent account takeover wave in near real time. Lucas: Exactly. There's a case from early 2025 where a large e-commerce company detected a new strain of info-stealer malware through their security telemetry. Within minutes, the fusion center cross-referenced that with fraud alerts showing a spike in gift card redemption from accounts created two weeks earlier. They shut down the redemption flow before attackers could cash out. Luna: And that's the kind of thing that falls through the cracks when teams are separate. The fraud team might not even know about the new malware strain until the chargebacks start rolling in. Lucas: Right. And by then the attackers are long gone. The fusion center model is really about shortening that detection to response cycle. It's not just about sharing a Slack channel—it's about shared data pipelines, shared case management, and shared metrics. Luna: I've seen some organizations call it 'converged security operations' or 'unified threat and fraud management.' But the core idea is the same. Lucas: Yeah. And it's not just for banks. Retailers, healthcare companies, even software as a service firms are adopting this. Anywhere there's a digital transaction that can be abused. The threat landscape for fraud and cyber is increasingly overlapping—credential theft, account takeover, synthetic identity fraud—they all involve both technical exploitation and transactional abuse. Luna: What about the cost? Building a fusion center sounds expensive. You need new tooling, maybe new hires, definitely a data lake. Lucas: It can be, but there's a spectrum. At the high end, you have dedicated facilities with dozens of analysts. But smaller organizations can start with something simpler: integrating fraud and security data in a single analytics platform, establishing a joint incident response playbook, and having a weekly cross-functional review. The common denominator is breaking down the data silo. Luna: And the cultural piece. Security and fraud teams have different incentives. Security is about preventing breaches; fraud is about minimizing financial loss. Those can conflict. Lucas: Absolutely. Security might want to block a suspicious transaction outright, but fraud might want to let it through to gather more intelligence on the attacker. You need leadership that sets a shared goal—like reducing total fraud losses plus security incidents by a certain percentage—so both teams are rowing in the same direction. Luna: I've read that some fusion centers use something called 'joint key performance indicators.' For example, mean time to detect combined fraud and security incidents, or percentage of incidents with shared investigation. Lucas: Exactly. And it's working. A 2025 industry survey found that organizations with a formal fusion center reduced their account takeover losses by an average of 40 percent compared to those with separate teams. That's huge. Luna: So this is not an experimental concept anymore. It's becoming a best practice. Lucas: I'd say it's still early adoption—maybe 20 to 25 percent of large enterprises have something resembling a fusion center today. But the trend line is clear. And regulators are starting to take notice. The Office of the Comptroller of the Currency in the US has issued guidance encouraging banks to better integrate fraud and cyber risk management. Luna: That's a strong nudge. Once regulators start pushing, adoption usually accelerates. Lucas: It does. And honestly, the technology side is getting easier. Cloud-based security information and event management platforms now offer fraud detection modules. Fraud platforms are adding threat intelligence feeds. The plumbing is there—it's more about organizational design and willingness to change. Luna: What about the human element? Analysts in a fusion center need to understand both domains. That's a pretty specialized skill set. Lucas: It is, and that's a challenge. Some organizations train existing staff cross-functionally. Others hire analysts with backgrounds in both cyber and financial crime. There's also a growing certification—Certified Cyber Fraud Fusion Analyst—that's gaining traction. But you don't need everyone to be an expert in both. You need enough overlap to have informed conversations. Luna: So it's more about creating a team that speaks a common language, even if they come from different specialties. Lucas: Exactly. And that common language is built on shared data and shared processes. One of the most effective tactics I've seen is a joint morning stand-up where fraud and security analysts review the top alerts from the last 24 hours together. Just 15 minutes a day. It builds trust and surfaces connections nobody would catch in separate meetings. Luna: That's low cost, high impact. And it scales down to small teams. Lucas: Right. You don't need a $10 million technology investment to start. You need a commitment to break down the wall. And if you're a CISO or a fraud director listening, that's the first step. Luna: Speaking of low cost, high impact—Lucas, one thing I've noticed about this show is that we keep it ad-free, and that's partly because of listeners who chip in a couple of dollars a month. It genuinely makes a difference. If these conversations help you think differently about security, you can support the show at buy me a coffee dot com slash fexingo. That's buy me a coffee dot com slash fexingo. Lucas: Yeah, and we really mean that. A few dollars a month is what keeps the lights on and lets us keep digging into topics like this without any sponsor influence. So if you value that, the link is simple. Luna: And we're back to the fusion center idea. One thing I want to circle back to: how does this affect the end customer? If I'm a consumer, do I notice any difference? Lucas: You might not see it directly, but you'll feel it. Fewer false positives on your credit card, less friction when you travel, fewer annoying multi-factor authentication prompts. Because the fusion center can better distinguish between legitimate behavior and actual fraud. They have a richer data set to make decisions. Luna: So it's not just about catching bad guys—it's about reducing friction for good users. Lucas: Exactly. And that's the business case beyond loss prevention. Customer experience is a competitive advantage. If your security and fraud systems are tightly integrated, your legitimate customers have a smoother ride. And that translates to retention and revenue. Luna: I think this is one of those rare security initiatives where the business case is actually easy to sell to the board. Lucas: It really is. Lower fraud losses, better customer experience, and stronger security posture all at once. The ROI is compelling. And with the regulatory winds blowing in that direction, it's becoming harder to justify keeping those teams separate. Luna: Alright, so practical takeaway: if you're in security or fraud, start by mapping the data that flows between your teams. Find the gaps. Then set up one shared meeting a week to review joint metrics. Lucas: That's exactly right. And if you want to go deeper, there's a great framework published by the Financial Services Information Sharing and Analysis Center—they call it the Cyber Fraud Fusion Maturity Model. It walks you through five levels of integration. We'll link to it in the show notes. Luna: Perfect. Lucas, this was a really good one. I think a lot of listeners will be rethinking their org charts after this. Lucas: I hope so. Because the attackers already figured out that the gaps between teams are the easiest way in. It's time we closed those gaps.