Profile A
Digital-first annuity platforms
Fast asset growth, thin back offices, and exactly the account takeover exposure that established carriers spent the last decade armoring against. Your growth curve is the attacker's target list.
Fraud & Risk Advisory · For Financial Institutions
We build the fraud capability. You keep it.
Account takeover and disbursement fraud now target the firms least equipped to fight them: lean, fast-growing annuity platforms, recordkeepers, TPAs, and regional financial institutions. Enderassey brings the playbook that protected a top-tier carrier, scaled to operations that can't justify a full-time fraud team.
Who calls us
Three profiles, one exposure
Profile B
Recordkeepers & TPAs
DOL cybersecurity guidance now expects documented fraud and disbursement controls. Venture-backed recordkeepers and independent TPAs carry that pressure with lean operations teams.
Profile C
Credit unions & community banks
P2P and wire account takeover losses are climbing fastest at regional institutions that face enterprise-grade attackers without enterprise-grade fraud budgets.
Engagement 01
4–6 weeks · Fixed fee
Disbursement Fraud Diagnostic
What it is
A structured, examiner-led assessment of your exposure to account takeover and fraudulent disbursements: the highest-loss fraud pattern in retirement and annuity operations. We walk your controls the way an attacker walks your process.
Designed for the executive who suspects there's a gap but needs evidence, priorities, and a defensible plan before asking for budget.
What you receive
A findings report and a prioritized remediation roadmap covering: an intake-to-payout control walkthrough, callback and bank-account-change procedure review, detection rule assessment, and benchmarking against the practices the FraudShare-member tier of the industry already runs.
Every finding is written so it can go straight into your board pack or your auditor response.
Engagement 02
4–6 months · The core engagement
Fraud Program Build
What it is
A complete fraud defense capability designed, implemented, and handed over to your team. This is the playbook that produced a 93% reduction in third-party account takeover fraud at Symetra, adapted to your products, your volumes, and your staff.
The diagnostic tells you where you stand. The build closes the gaps.
What you receive
A COSO-aligned fraud risk assessment. Control design for disbursements and account maintenance. Vendor selection and implementation support across fraud intelligence, account verification, and device intelligence platforms. An incident response runbook, staff training, and board-ready reporting your executives can stand behind.
The deliverable is a capability your team owns, not a binder that gathers dust.
Engagement 03
Annual agreement · Continuous coverage
Fractional Fraud Officer
What it is
Senior fraud leadership on your roster without the full-time hire. A loaded fraud manager costs well into six figures a year; most mid-size operations need the judgment, not the headcount.
When an incident hits at 4 p.m. on a Friday, you have a named Certified Fraud Examiner who already knows your controls.
What you receive
Quarterly control testing and threat briefings tuned to your product set. On-call incident support. Regulator and auditor response support. An annual program refresh that keeps your defenses current as attack patterns shift.
Most clients arrive here after a Diagnostic or a Program Build, when the question changes from “are we exposed?” to “who keeps watch?”
How we price
Against the loss, not the day rate.
A single successful annuity account takeover disbursement routinely exceeds six figures, before counting the regulatory findings, the auditor scrutiny, and the customer trust that follow it. A loaded full-time fraud manager costs more still, every year.
Every Enderassey engagement is fixed-scope and fixed-fee, stated in writing before work begins. No discovery surprises, no meter running. If the scope changes, the fee conversation happens before the work does.
Next step
Start with the conversation, not the contract.
Thirty minutes, confidential, no obligation. Describe your operation and your worry; you'll leave with a straight answer about whether and where you're exposed.