Fraud is a defect. The investigation is an 8D.

A few years ago I earned a place on T-Mobile's public bug-bounty Hall of Fame for a clickjacking flaw in a live consumer platform. No scanner found it. I found it the way I read a control plan on a press line: here is the intended process, here is where a human enters it, and here is the junction where nobody defined what happens when that input arrives wrapped in something else. The platform could be framed – loaded inside an invisible overlay and clicked on behalf of the user – because nobody had written a failure-mode line for it. Disclosure ran on the standard rails: reproduce, document, submit, wait, verify the patch. Anyone who has closed an 8D recognises that rhythm. I had found a software defect and filed a CAPA from the outside.

Quality Magazine argued this week that fraud is a quality problem and that our toolset belongs in the fight against it. I agree. I would go further: fraud is not adjacent to quality – it is an escape from an uncontrolled process, and our taxonomy describes it better than any fraud dashboard on the market.

Fraud is a failure mode, not a surprise

In our language, an escape is a failure mode that reached the customer because a control was missing, inadequate or unverified. Fraud obeys the same physics. The exploit is the escape path. The counterfeit part is a supplier defect with a profit margin attached. And the missing check – the approval nobody defined, the document nobody authenticated – is an undocumented PFMEA line: a failure mode nobody sat down to imagine, or imagined and never gave a detection control.

AI changes the scale, not the logic. Generated invoices, cloned voices, synthetic certificates are defect modes with a production rate no human forger could match. Every one still travels a path through your process – an intake, an approval, a payment run – and the criminal reads that path exactly as I read that consumer platform: hunting for the junction with no control written against it.

Crime is an unscheduled audit, conducted by someone who read your process map more carefully than its author did.

AI detection is a metal detector, not a quality system

The industry reflex is to buy AI. The trade press celebrates machine-vision inspection rolling out at Siemens and Procter & Gamble, and it works there for one reason: the camera sits inside a closed control loop – detect, stop, contain, disposition, feed the result back. Fraud detection rarely gets that loop. It gets a dashboard, and a dashboard bolted onto an unchanged process is a gauge with no reaction plan.

Treat the detector as an instrument and it has instrument problems. False positives are your new PPM: every wrongly flagged invoice is a customer insulted and an analyst hour burned, and the cost compounds like any escaped defect. Detection without containment is scrap sorting – you pick out the bad units after the fact while the process keeps producing them. A metal detector at the gate tells you the contaminant got in. It says nothing about the line that made it.

One number from that same coverage: only 12% of manufacturers using AI have it integrated into their business systems. The rest have intelligence bolted onto processes nobody redesigned. That is not a technology gap. It is a control-plan gap, and control plans are not written by the IT department. They are written by us.

Run the crime as an 8D

When fraud lands, treat it as a field failure, because that is what it is. The structure holds:

• D1–D2. Form the team. Describe the defect in process terms: what failed, where it entered, where it escaped, which control was absent.
• D3. Containment the same day: freeze the account, block the channel, quarantine the transaction stream. Not "monitoring".
• D4. Root cause in the process, never the person. "An employee clicked a phishing link" is a five-why that stopped one why early.
• D5–D6. Verify the corrective action the only honest way – attempted re-exploit, the same logic as re-running capability after a tooling change.
• D7–D8. Update the PFMEA and the control plan, retrain, close the case, publish what changed.

Speed beats elegance. QRQC taught me that at SNOP: we cut defect costs by 70% in a 900-strong greenfield plant, not because the analysis was cleverer but because containment happened in hours and root cause landed within a week. I built that quality department from an empty building, so I know what a control system looks like before it exists – and fraud response, in most organisations, is exactly that: a process still waiting for its first control plan. Aerospace keeps relearning the escape-cost lesson in public, deliveries slipping while single flaws get investigated and extra checks pile onto running programmes. The cost mechanism is identical; fraud just skips the airframe.

The security side of my working life taught the same lesson from the other direction. Certified Ethical Hacker training, thirty-plus certifications, the bug bounties – none of the value sat in finding the flaw. It sat in the discipline after the finding: document, disclose responsibly, verify the fix, then sweep every sister platform for the same weakness. That is a CAPA executed to the letter.

When the next wave of generated fraud crests – and with synthetic documents and cloned voices, it will – the fraud team does not need another dashboard. It needs a quality engineer: someone who reads a process and sees the junction with no control written against it, contains the escape in hours, drives the root cause out of the system and verifies the fix by trying to break it again. I spent two decades in automotive and aerospace learning how failing systems are made to stop failing, deliberately. That is not a transferable skill. It is the job description – and someone on your payroll is probably already carrying it, wearing a lanyard that says Quality.