Roadmaps Security roadmaps Specialised and emerging
Stop the misuse of legitimate features: account takeover, credential stuffing, bots, payment and promotion fraud, impersonation and deepfakes, and harmful content on platforms.
Estimated time: 15–29 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Account takeover, fake accounts, payment fraud, promotion abuse, scraping, spam, scams and harmful content. Each has its own economics and signals.
Fraud is a business. Raise the attacker's cost per success above the payoff and they move elsewhere. Think in costs, not only in blocks.
Credential stuffing, phishing, SIM swap and session theft. Detect impossible travel, new devices and bulk failed logins, and push users to passkeys.
IP reputation, device fingerprints, velocity, behaviour and account history. Good signals are the foundation of every fraud defence.
Start with clear rules, review the cases they flag, and measure false positives. Fraud work is iterative and evidence-driven.
Step-up authentication, rate limits, verification and holds stop abusers but annoy customers. Apply friction by risk, not to everyone.
Separate good bots from bad ones, detect automation through behaviour and challenges, and keep up as attackers use real browsers and residential proxies.
Combine signals into a risk score with models, and act on it in real time. Watch for label quality, drift and adversaries probing your thresholds.
Card-not-present fraud, chargebacks, refund abuse and authorised push payment scams. Use 3-D Secure, velocity checks and behavioural analysis.
Document checks, selfie matching and data verification stop fake accounts, but deepfakes and synthetic identities are improving fast. Layer the checks.
Link accounts by shared devices, payment details and behaviour to uncover rings. Graph analysis turns single cases into whole networks.
Track fraud loss rate, false positive rate, customer friction and time to detect. Report money saved and customers protected.
Harmful content, harassment, scams between users and child safety are platform integrity problems. Learn policy, detection, review operations and appeals.
Write clear rules, enforce them consistently, give users notice and appeal, and publish transparency reports. Laws such as the EU Digital Services Act now require it.
Generated documents, cloned voices, deepfake video calls and mass-personalised scams. Add verification steps that do not rely on what people can see or hear.
Fake apps, lookalike domains, impersonating social accounts and scam ads target your customers in your name. Monitor and take them down.
Human reviewers see the worst content. Design queues, tools, quality checks and wellbeing support as carefully as the detection.
Fraudsters and abusers move between platforms. Share signals through industry groups and with banks and telecoms.
Set the appetite for fraud loss and friction, the operating model across product, security, payments and policy, and the investment to match.
Online safety and digital services laws, payment fraud reimbursement rules and consumer protection now apply. Build compliance into the programme.
The cheapest abuse to fight is the abuse a feature never enabled. Get involved in product design and threat model features for abuse.
Fraud and abuse teams fight attackers who use a product exactly as designed, just for the wrong ends: logging in with stolen passwords, creating fake accounts, abusing promotions, scamming users or posting harmful content. There is often no vulnerability to patch, only behaviour to detect.
The field combines security engineering, data science and operations: building signals and risk scores, designing friction that stops abusers but not customers, running investigations, and working with policy and legal on platform rules. Trust and safety extends it to harmful content and user protection.
Fraud and abuse cost companies and their customers billions, and AI is making scams and fake identities cheaper. Every product with accounts, payments or user content needs people who can keep it trustworthy without driving away genuine users.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact