What Changed in the Larigent Fraud Lifecycle This Quarter
The Larigent Fraud Lifecycle isn't a poster. It's a working model, and several additions since spring changed what it can see — and, this quarter, what it can act on before a human ever gets involved.
The clearest gap was in Phase 3, Trust-Building & Isolation. Every existing warning sign in the framework described something that happens once — a call, a request, a transfer. But isolation rarely arrives as a single event.
It's a drift: someone who used to answer their own phone, open their own mail, and see visitors on their own schedule gradually does all three through only one other person. That's a pattern, not a moment, and the framework had no way to name it until this quarter.
The same logic now applies at Phase 4, Extraction, watching for a sustained change from someone's own normal spending or transfer pattern rather than waiting for one transaction that looks unusual on its own.
Neither addition claims more than it should. Someone who stops driving to the bank and starts banking from home can look identical to someone being isolated by a controlling third party — a health event produces the same pattern a scammer does.
The framework flags the shift; it takes a person, not an algorithm, to work out which one it is.
The second change extends who the framework speaks to. Every phase already pairs guidance for a professional intermediary with guidance for a family member.
Neither fits the person who is genuinely present at the moment of extraction but has no relationship to the client at all — a bank teller, a convenience store clerk, someone working a crypto kiosk counter.
That's now a distinct, phase-anchored addition at Phase 4: a plain, non-accusing question anyone in that position can ask without leveling an accusation.
"Excuse me, I don't mean to intrude, but a lot of people using these machines are being directed by someone on the phone. Are you on a call right now?"
A direct challenge tends to confirm the scammer's own story that outside interference is the threat; a question about the machine doesn't.
The third addition doesn't speak to a person at all. Everything above assumes a human having a conversation — a fiduciary, a family member, a bank teller. This quarter also added specifications aimed at the systems behind that conversation.
The additions specify what a risk team's transaction-monitoring engine should flag, what a periodic review of an account's authorized-party list should catch, and what a data field should carry when an institution already runs identity-verification software. None proposes new software — they translate the phases and signals into language an engineering team can act on.
The Phase 3 and Phase 4 signals were also the last requirement for something larger: extending this same model to cases where the person exploiting trust was never a stranger at all — a caregiver, an adult child, someone already inside the family.
That extension is no longer blocked. The document describing it hasn't published yet, but the gap that kept it waiting has closed.
None of this changes the six phases or the loop back to Phase 1. It's the same framework, closing gaps the last version left open.
If this is your family
Pay attention to shifts, not just events. A parent who used to run their own errands and now only leaves the house with one particular person is worth a gentle, curious conversation — not an accusation.
Sources: