MITRE Launches F3 Financial Fraud Framework, Drawing on ATT&CK to Standardize Defenses

Financial fraud combines conventional cyberattacks with industry-specific tactics, but differences in tools and terminology have made it difficult for cybersecurity and fraud-prevention teams to piece together the full chain of criminal activity. U.S. nonprofit MITRE said financial fraud losses reached $13.7 billion in 2024, prompting its Center for Threat-Informed Defense (CTID) to draw on ATT&CK in developing a shared taxonomy of adversary behavior.

MITRE CTID formally released the first version of its free, open Fight Fraud Framework (F3) on April 9, 2026. It organizes the fraud process into seven major tactics: reconnaissance, resource development, initial access, defense evasion, staging and positioning, execution, and monetization. Staging and positioning and monetization are new phases not covered by ATT&CK, allowing F3 to map the entire process from intrusion and account manipulation to the cashing out of assets.