On April 18, 2024, the Financial Crimes Enforcement Network published a Financial Trend Analysis counting 155,415 elder financial exploitation-related Bank Secrecy Act reports filed between June 15, 2022 and June 15, 2023, tied to more than $27 billion in reported suspicious activity, a figure FinCEN says may include attempted as well as completed transactions.
Every one of those reports was written after the money moved, or nearly did. A filing describes the end of a sequence. The professional who could have interrupted it was standing somewhere earlier in that sequence, usually without knowing it. A fraud lifecycle is the tool for saying where.
What a lifecycle gives you
A list of warning signs asks a reader to hold dozens of items at once. A lifecycle gives each observation a place and a successor: this is what the caller said, this is what usually comes next, and this is how long you have. The same fact means different things at different points in the run.
It also answers a question a list cannot: who can see this? A pop-up on a screen is visible to the person at the keyboard. A first-ever gold purchase is visible to a bank. A stranger at the door is visible to a neighbour or an aide. The map shows where each observer stands.
There is evidence that structure, not content, is what lasts. In a 2014 field experiment in Basic and Applied Social Psychology, Scheibe, Notthoff, Menkin and colleagues had a former telemarketer run a mock scam on 895 prior mail-fraud victims drawn from US Postal Inspection Service lists, two or four weeks after a warning call.
A warning about the same scam cut acceptance at two weeks and had lost its effect by four. A warning about a different scam still worked at four weeks. The study measured acceptance of an invoice, not an actual payment, and says so. Within that limit, it points one way: teach the shape, not the costume.
Where lifecycles come up short
Credit the model most of them descend from. In 2011, three Lockheed Martin analysts, Hutchins, Cloppert and Amin, published the intrusion kill chain: seven steps from reconnaissance to actions on objectives, with the claim that a defender who breaks any one link stops the whole campaign. That idea reorganised network defence, and it deserved to.
Four things go wrong when that shape is carried into elder fraud.
It ends too early. The kill chain stops at the objective. Most fraud-stage models stop at the money moving or at the report. Neither has a phase for what happens afterwards, and afterwards is where the next approach begins.
A 2024 study by DeLiema, Langton, Brannock and Preble in the Journal of Elder Abuse & Neglect, using US Postal Inspection Service records on about 1.33 million people who paid a mail-fraud solicitation over twenty years, found victims in their 70s and 80s were 9 percent more likely to be revictimized than victims in their 50s.
That is a repeat-victimization finding on a mail-fraud dataset, not a measure of who gets targeted first. It still means a model that ends at the report has drawn a line through a loop.It models one crime and gets used for all of them. FinCEN's analysis attributes roughly 80 percent of the reported activity in those 155,415 filings to scams by strangers and roughly 20 percent to theft by someone the victim knew, with the caveat that filers may simply report scams more often. Those are two different sequences.
The stranger's version has a pretext, a first contact and a discrete moment where money leaves. The relative's version has none of that: no pretext, because the relationship already existed, and no event, because the pattern erodes rather than breaks. A lifecycle built from events cannot see a slow shift in the baseline, and most are.
The same mistake runs through controls. AARP BankSafe's 2019 evaluation, a randomised trial across 82 institutions and roughly 500 branches in 11 states, reported that 70 percent of money-saved cases involved a family member or familiar perpetrator and 31 percent a stranger. It works because a teller can separate a customer from the relative beside them.
That is a strong result, and it is a result for one arc. Nothing in it reaches a victim alone at home on a live call. A control inherits the arc it was tested in, and a lifecycle that does not declare its arc lets the two be quietly swapped.It speaks in conclusions. Many models name their stages as diagnoses: isolation, grooming, exploitation. An expert concludes those; nobody sees them. A receptionist who heard a resident say "the caller told me not to tell my daughter" has an observation. Filing it as isolation asks her for a determination she is not trained to make.
That exclusion costs twice. Frontline staff see the early phases and stop reporting when the form requires a conclusion. And a fiduciary or planner who writes "isolation" in a file has recorded an assessment, with the exposure that follows, where the quoted sentence would have carried the same information and none of it.It assumes one observer. The kill chain assumes a defender who owns the network and sees every link. In elder fraud nobody owns the telemetry. The victim saw the pop-up, a relative the visits, a bank the cash. Each phase has a different witness, and the witness is rarely the person who can stop the money.
A model that does not say who sees each phase describes the crime, not the defence.
Five questions to settle first
Ask which arc it models, and expect a plain answer. If the author cannot say whether it describes a stranger at a distance or a relative with a key, it will be applied to both and fit neither.
Ask where it ends. If the last phase is the report, you will need to add what comes after: the first hours in which funds can still be frozen, and the closing of the exposure that made the approach possible, because the loop is going to come round again.
Ask whether its stage names are observations or conclusions. The test is one line. Could someone with no training record this phase without deciding what it means? Where the answer is no, the model will be used by experts only, and experts arrive late.
Ask who, in your own setting, would see each phase. A phase with no observer is not a gap in the model. It is a gap in your referrals, and it tells you whose call you need to be able to take.
Ask whether the mechanism is stated carefully. A model that says a manufactured emergency makes people comply is right. A model that names a single brain structure as the cause is overclaiming, and Larigent's own framework carried a single-structure version for four months in 2026 before correcting it in the open.
The corrected statement is short, and it is the one we now copy rather than paraphrase: the Fear Override is an induced state in which verification behaviour stops. It is not a failure of intelligence or financial sophistication - it is what a manufactured emergency does to anyone's decision-making for as long as it lasts.
How we answered them
The Larigent Fraud Lifecycle was built to be checked against those five questions, not exempted from them. It has six phases, from Targeting & Exposure to Re-Fortification, and the sixth feeds the first because confirmed victims are disproportionately approached again.
It declares its arc: scams by strangers at a distance, the roughly 80 percent in FinCEN's filings. The slower path a trusted person takes is a separate view of the same model, not forced into one sequence. Each phase names who can see it. Signals record what was seen or heard; the implication is kept apart.
One thing to do before you adopt any of them
Take the phases of whichever lifecycle you are considering and, beside each, write the name of whoever in your practice would see it. For a planner that is usually the extraction phase and little else. For an APS investigator it is the phase after the loss. Whatever is left blank is your next referral relationship.
Sources