The Larigent Fraud Lifecycle
Elder fraud is not a single moment of bad judgment. It is a six-phase process a target is moved through - and every phase has a point where it can still be stopped.
Most fraud-prevention material treats a scam as a single event: the call, the wire, the loss. The Larigent Fraud Lifecycle maps the full sequence instead - from the moment a target is identified through the moment they are approached again. Each phase names what the attacker is looking for, the control that interrupts it, and how the conversation differs depending on who is having it: a professional working from a duty of care, or a family member working from love and proximity.
Already know the model? Skip ahead to the Practice Assessment →
The same six-phase model, read left to right. Each column names what the fraudster is looking for at that stage, the named Larigent control that interrupts it, and the signals and actions for the two people most likely to notice first — a professional working from a duty of care, and a family member working from proximity.
A signal is what was actually observed — not a diagnosis or a judgment about the person. Record the signal; what it implies is a separate question, asked later, by someone with more of the picture.
Scroll sideways to see all six phases →
Targeting & Exposure
Reconnaissance
LFL‑P1
Criminals build a profile from data brokers, breach data and public records, then select targets with no one positioned to notice unusual activity.
The fraudster looks for
- No trusted contact or power of attorney on file
- Home address, age and family details findable online
- A recent life event — widowhood, diagnosis, a move
Named control
The Safeguards Inventory · LFL‑C01
Records what protection is already in place, and installs what is missing — credit freezes, data-broker opt-outs, a property alert, USPS Informed Delivery.
For professionals
- S01No trusted contact or POA on file at onboarding or review
- S31Says they couldn’t cover a small unexpected expense
DoIntroduce it as standard for every client — not a response to suspicion.
For families
- S03A recent loss, diagnosis, move or big life change
- S29Has mentioned feeling lonely or isolated
DoSet up a trusted-contact form and a regular check-in — a precaution for any older adult, not a comment on this one.
Contact & Pretext
The Hook
LFL‑P2
A pop-up, call, text or ad opens with a plausible, low-stakes reason to keep talking — a familiar brand name does most of the work.
The fraudster looks for
- Willingness to engage with unsolicited contact
- Trust in a familiar name — the bank, Microsoft, “the IRS”
- No household habit of verifying before responding
Named control(s)
Pretext Pattern Recognition · LFL‑C02
The PACE Framework · LFL‑C07
For professionals
- S05The caller stated a detail rather than asking for it
- S06Client can’t say who contacted whom first
DoOpen with curiosity, not alarm: “tell me more about how that started.”
For families
- S04Mentions unsolicited contact from a “familiar” brand or agency
Tech-support pop-up“Power the device off — do not click anywhere on the screen, and do not call the number displayed.”
Trust-Building & Isolation
The Fear Override
LFL‑P3
Grooming, escalating authority, or manufactured urgency — then the instruction to keep it private, which removes the one person who might notice.
The fraudster looks for
- Loneliness, or a need for validation
- A lifelong habit of deference to authority
- No pre-agreed family passcode or verification routine
Named control(s)
The Isolation Flag · LFL‑C03
The Refusal Script · LFL‑C08
For professionals
- S07Repeats an instruction to keep this private — the single highest-value signal in the model
- S09Was told in advance that friction is part of the problem
DoAsk directly and without judgment: “did someone tell you not to share this with anyone?”
For families
- S08“They already knew about my account”
- S10New secrecy or defensiveness about money
The exit line“I am hanging up now. I’ll call back on a number I trust.”
Extraction
The Ask
LFL‑P4
Wire, gift cards, crypto, gold, or remote device access — the point of maximum financial risk, driven by fear rather than persuasion.
The fraudster looks for
- High-liquidity accounts with no transaction holds
- No dual-authorization or verified-callback requirement
- Unfamiliarity with how wires, crypto or gift cards work
Named control
The Red Phone Protocol · LFL‑C04
Installed at Phase 1, activated here: a mandatory pause and a verified callback on a channel the family or institution controls — never a number the caller supplies.
For professionals
- S11Unexplained urgency about a transfer
- S16A first-ever wire, first-ever kiosk use, or an atypical amount
Do“I need to make a call before I process this — that’s standard procedure, not a judgment about you.”
For families
- S13A third party present, or on the phone, during the transaction
- S14A courier or unexpected visitor scheduled at the house
The rule“Authentication rests entirely on pre-agreed content exchanged over a pre-enrolled channel, never on recognizing how someone sounds.”
Post-Incident Response
The Golden Hour
LFL‑P5
Funds are gone or in transit. The reversal window narrows by the hour, and shame usually delays reporting more than a lack of information does.
The fraudster looks for
- No pre-existing incident checklist to act on
- Shame that delays disclosure past the reversal window
- No judgment-free contact to call first
Named control
The Golden Hour Protocol · LFL‑C05
Bank recall, an IC3 report, and credit freezes at the three bureaus, in that order.
For professionals
- S17Disclosure of a completed transfer, however it is minimized
- S18A delay between the event and disclosure
DoWalk the sequence calmly and in order — no lecture on what should have happened differently.
For families
- S17A parent discloses a transfer, even a minimized one
- S18Learning of it only after a delay, out of shame
DoLead with reassurance before logistics — and watch for a “recovery” call as a second scam.
Re-Fortification
Closing the Loop
LFL‑P6
Confirmed victims are re-targeted at higher rates — the same gap that allowed Phase 1 targeting is still open unless someone deliberately closes it.
The fraudster looks for
- Contact details now circulating on “confirmed payer” lists
- An exposure profile unchanged since Phase 1
- A wish to “put it behind them” that skips the review
Named control(s)
The Re-Fortification Review · LFL‑C06
The Redress Plan · LFL‑C09
For professionals
- S20Exposure profile unchanged since the incident
- S25Asks what happened to the report, or calls it unfinished
DoFrame the review as strengthening infrastructure, not re-litigating what happened.
For families
- S19A call from a “recovery” service after a known incident
- S21Declines to talk about what happened at all
DoAsk what’s still unanswered rather than just reassuring — those questions are usually specific and answerable.
Phase 6 feeds back into Phase 1, because confirmed victims are disproportionately re-targeted. Closing the gap is infrastructure that has to hold — not a one-time conversation.
The cycle, at a glance
Navy marks the four phases before a loss; gold marks the two after. Each wedge carries the phase’s named-control ID. The dashed arrow is the moment a closed case starts the cycle again.
From the six phases above
Where does your own practice stand?
This model describes how the fraud unfolds. The Fraud Lifecycle Practice Assessment turns it around - a self-scored worksheet for financial planners, RIAs, and professional fiduciaries, checking your own procedures against these same six phases, one at a time.
Take the Practice Assessment →