FT3c is the cross-framework relationship catalog for FT3. It maps other fraud and security frameworks onto FT3, holds the result in a graph, and builds the combined catalog with a coverage report. Every external concept is reviewed and recorded as a typed mapping to FT3, a gap, or unassessed. It covers 1,387 concepts from 13 frameworks.

How is FT3c different from FT3?

FT3 is the ATT&CK-style fraud framework, built for the future of agentic commerce. FT3c is the mapping of other fraud frameworks to FT3. It solves a practitioner problem: understanding how the other frameworks relate to FT3 and to each other. FT3c depends on FT3; FT3 never depends on FT3c.

How does FT3c map MITRE F3 and ATT&CK?

Mappings resolve through FT3. Each entry is anchored to the most precise FT3 concept (a technique, tactic, or dimension) with a typed relationship and a recorded review, or it is recorded as a gap. F3 and ATT&CK are compared through FT3, not mapped to each other directly; a chained match stays a candidate until it is reviewed. 101 of 123 F3 entries and 147 of 697 ATT&CK Enterprise entries are covered by reviewed mappings.

Which frameworks are included?

MITRE Fight Fraud Framework (F3) (v1.1), MITRE ATT&CK Enterprise (v19.1), PCI DSS (v4.0.1), VERIS threat actions (1.4.1), GSMA telecom fraud (v1), PSR UK APP scam types (Measure 1, cycle 3 (Dec 2024)), SPF ScamShield scam types (28 May 2026), NPA special fraud (Japan) (2026.4), RBI Fraud Monitoring Return (Circular 2024-25/118), MISP cryptocurrency-threat (v2), MISP cryptocurrency-market (v1), MISP carding (v1), OWASP Automated Threats (Handbook 1.3); pinned with ledgers under review: MITRE ATLAS (2026.07), EBA PSD2 fraud reporting (GL/2018/05 + GL/2020/01). Each is pinned to a specific release, and FT3 is the target they all map to.

How does FT3c handle PCI DSS?

FT3c maps PCI DSS v4.0.1 requirements to FT3’s security controls in a separate control ledger, not to fraud techniques. All 273 requirements were reviewed: 135 map to at least one FT3 control and 138 are gaps. FT3’s own mitigates and disrupts relationships lead from each control to techniques. Outputs carry requirement identifiers and FT3c’s own labels, never PCI SSC text.

What formats does FT3c export?

Each build produces a combined STIX 2.1 bundle (every FT3 object plus external-framework nodes, crosswalk relationships, and gap objects), deterministic RDF graphs in N-Quads, per-framework coverage reports in CSV and Markdown, and an SSSOM mapping table. All are built against pinned framework versions. They are used within the project and are not distributed publicly.

Who builds FT3c, and is it open source?

FT3c is authored by Vincent Passaro. It is not open source and is not published publicly. Like FT3 2.0, it is shared through trust groups: the communities where analysts, researchers, and threat hunters already share, teach, and solve problems, with reciprocity as the membership criterion.

Many fraud frameworks. Only one programmatic crosswalk built for expansion.

Compare fraud and security frameworks, understand where their concepts correspond, and see where mappings or coverage are missing.

1,387 concepts from 13 frameworks · 408 covered by reviewed mappings · 966 recorded gaps · 13 unassessed

See how it works

Fig. 1 · 1,387 concepts from 13 frameworks, crosswalked to FT3

01 · The problem

More fraud frameworks, less shared language.

Fraud now has more than one public matrix: FT3 and MITRE F3, alongside the security and compliance frameworks teams already use, such as ATT&CK and PCI DSS. Practitioners have to decide which framework to use, how each describes a fraud technique, and where they overlap.

Why fraud frameworks must converge

Technique matrices

MITRE Fight Fraud Framework (F3)

The other public fraud matrix. 101 of its 123 entries correspond to FT3 through 102 reviewed edges; 38 publisher-verified F3↔ATT&CK lineage edges are carried as an overlay.

101 of 123 mapped · 22 ratified gaps→ Reaches 72 FT3 techniques

Publisher: MITRE Center for Threat-Informed Defense
Region: Global
Version: v1.1
Retrieved: 9 Jul 2026
Format: STIX attack-pattern
License: Apache-2.0
Source: fight-fraud-framework

MITRE ATT&CK Enterprise

Enterprise domain only. 147 of 697 live techniques correspond to FT3 through 155 reviewed edges; every other entry is accounted as a ratified gap.

147 of 697 mapped · 550 ratified gaps→ Reaches 51 FT3 techniques

Publisher: MITRE
Region: Global
Version: v19.1
Retrieved: 13 Jul 2026
Format: STIX attack-pattern
License: MITRE ATT&CK terms of use
Source: attack-stix-data

MITRE ATLAS

Adversarial-AI technique matrix, pinned at 178 subjects. Its mapping ledger is still under review (FT3C-41), so it is not yet in the coverage totals.

178 subjects pinned · ledger under review (FT3C-41)

Publisher: MITRE
Region: Global
Version: 2026.07
Retrieved: 30 Aug 2026
Format: STIX attack-pattern
License: Apache-2.0
Source: atlas-data

Controls, incident and telecom taxonomies

PCI DSS

Mapped to FT3 controls, not techniques. 135 requirements land on 13 FT3 controls, most often attack-surface hardening, audit-log integrity and secret management.

135 of 273 mapped · 95 outside control scope · 43 with no corresponding control→ Reaches 13 FT3 controls

Publisher: PCI Security Standards Council
Region: Global
Version: v4.0.1
Retrieved: 24 Jul 2026
Format: OSCAL catalog (public-thin)
License: Identifier-only; redistribution unresolved
Source: Not redistributed

VERIS threat actions

Incident-taxonomy threat-action varieties, labels only. All 128 are accounted; none has a reviewed FT3 edge yet.

0 of 128 mapped · 128 deferred-external gaps

Publisher: VERIS Community (vz-risk)
Region: Global
Version: 1.4.1
Retrieved: 31 Aug 2026
Format: Action-variety index (labels)
License: CC-BY-SA-4.0
Source: vz-risk/veris

GSMA telecom fraud

Telecom fraud labels without definitions, so every label is deferred to external review.

0 of 49 mapped · 49 deferred-external gaps

Publisher: GSMA, via MISP taxonomies
Region: Global
Version: v1
Retrieved: 31 Jul 2026
Format: MISP machinetag
License: CC0-1.0
Source: misp-taxonomies/gsma-fraud

Regulator and police typologies

PSR UK APP scam types

UK authorised push payment scam types. Its “Investment” type maps to FT3-TEC-0103 Pig-Butchering Investment Confidence Fraud.

3 of 9 mapped · 6 active gaps→ Reaches 3 FT3 techniques

Publisher: Payment Systems Regulator
Region: UK
Version: Measure 1, cycle 3 (Dec 2024)
Retrieved: 30 Aug 2026
Format: Scam-type index (labels)
License: All rights reserved; identifier-only
Source: psr.org.uk

SPF ScamShield scam types

Singapore scam-type headings. “Investment Scams” maps to the same FT3 technique as PSR’s “Investment”.

4 of 12 mapped · 8 deferred-external gaps→ Reaches 4 FT3 techniques

Publisher: Singapore Police Force
Region: SG
Version: 28 May 2026
Retrieved: 30 Aug 2026
Format: Scam-type index (labels)
License: All rights reserved; ID + category name only
Source: scamshield.gov.sg

NPA special fraud (Japan)

Thirteen special-fraud types with definitions, all drafted and awaiting review before any edge or gap is published.

0 of 13 mapped · 13 unassessed, drafted for review

Publisher: National Police Agency
Region: JP
Version: 2026.4
Retrieved: 3 Sept 2026
Format: SOS47 case index (definitions)
License: PDL-1.0
Source: npa.go.jp · SOS47

RBI Fraud Monitoring Return

Indian fraud-reporting heads, labels only. All eleven are accounted and deferred to external review.

0 of 11 mapped · 11 deferred-external gaps

Publisher: Reserve Bank of India
Region: IN
Version: Circular 2024-25/118
Retrieved: 30 Aug 2026
Format: FMR head index (labels)
License: All rights reserved
Source: rbi.org.in

EBA PSD2 fraud reporting

EU payment-fraud reporting types under PSD2, pinned at 9 subjects. Its mapping ledger is still under review (FT3C-37).

9 subjects pinned · ledger under review (FT3C-37)

Publisher: European Banking Authority
Region: EU
Version: GL/2018/05 + GL/2020/01
Retrieved: 31 Aug 2026
Format: Fraud-type index
License: Reproduction authorised with acknowledgement
Source: eba.europa.eu

Threat-intelligence taxonomies and bot threats

MISP cryptocurrency-threat

Crypto threat definitions. “Pig Butchering Scam” maps to FT3-TEC-0103, the technique PSR and SPF name differently.

5 of 12 mapped · 7 active gaps→ Reaches 5 FT3 techniques

Publisher: MISP Project
Region: Global
Version: v2
Retrieved: 31 Aug 2026
Format: MISP machinetag
License: CC0-1.0
Source: misp-taxonomies

MISP cryptocurrency-market

Crypto market facets with descriptions. All twenty are accounted as niche gaps.

0 of 20 mapped · 20 deferred-niche gaps

Publisher: MISP Project
Region: Global
Version: v1
Retrieved: 31 Aug 2026
Format: MISP machinetag
License: CC0-1.0
Source: misp-taxonomies

MISP carding

Carding facets with descriptions; one has a reviewed FT3 edge.

1 of 19 mapped · 18 deferred-niche gaps→ Reaches 1 FT3 technique

Publisher: MISP Project
Region: Global
Version: v1
Retrieved: 31 Aug 2026
Format: MISP machinetag
License: CC0-1.0
Source: misp-taxonomies

OWASP Automated Threats

Automated threats to web applications. Twelve of its twenty-one events map to FT3 techniques.

12 of 21 mapped · 9 deferred-external gaps→ Reaches 12 FT3 techniques

Publisher: OWASP Foundation
Region: Global
Version: Handbook 1.3
Retrieved: 30 Aug 2026
Format: OAT event index (definitions)
License: CC-BY-SA-3.0
Source: owasp.org · OAT

Fig. 2 · 15 frameworks mapped against FT3 · 13 with merged ledgers

Correspondence has a shape.

A flat mapping says two concepts are linked. It does not say whether they are equivalent, whether the external concept is narrower or broader than FT3’s, or whether they only partly overlap. FT3c records which, so frameworks can be compared without losing those distinctions.

Fig. 3 · Five links that look alike until typed

Equivalent: The same concept in both frameworks.
Narrower: The external concept is a specific case of the FT3 concept.
Broader: The external concept covers more than the FT3 concept.
Related: The concepts partly overlap.
No correspondence: FT3 has no matching concept. Recorded as a gap.

02 · How it works

Every external concept has an explicit state.

FT3c’s crosswalk and graph catalog connects concepts from external frameworks to FT3. Each entry is a reviewed mapping, a proposal, a gap, or unassessed, so a missing correspondence is never confused with one nobody has examined.

Fig. 4 · Each entry resolves to one of four states

Reviewed mapping: A correspondence to FT3 confirmed by review. Only these count as coverage.
Proposal: A candidate correspondence awaiting review. Not counted as coverage.
Gap: Reviewed, with no corresponding FT3 concept.
Unassessed: Not yet reviewed. Recorded separately from a gap.

03 · Compliance

From PCI DSS v4.0.1 requirements, through FT3 controls, to fraud techniques.

FT3c maps PCI DSS requirements to FT3’s security controls in a separate, typed control ledger. FT3 already records which fraud techniques each control mitigates or disrupts, so a compliance team can follow a requirement through its control to the fraud behavior it addresses.

135 of the 273 PCI DSS v4.0.1 requirements map to at least one FT3 control, reaching 13 of FT3’s 69 controls. The other 138 are gaps: 95 fall outside FT3’s control scope and 43 have no corresponding FT3 control.

Fig. 5 · PCI DSS requirements reach fraud techniques through FT3 controls

04 · Pipeline

Built against specific framework versions.

Mappings are validated before they enter the catalog. Graph exports, STIX exports, and coverage reports are built from the catalog against pinned framework versions, so each output refers to the releases it describes. The same catalog feeds FT3’s MCP integration.

Fig. 6 · Pinned inputs to machine-readable outputs

05 · Exports

Machine-readable by design.

Each build produces a combined STIX 2.1 bundle, RDF graphs in N-Quads, and per-framework coverage reports in CSV and Markdown. The exports are used within the project and are not distributed publicly.

Where STIX falls short for fraud

Graph01

RDF graphs of concepts and typed correspondences as nodes and edges.

STIX 2.102

A STIX 2.1 bundle, including FT3’s custom object types, for threat-intelligence platforms.

Coverage reports03

Per-framework, per-version reports of what is mapped and what is missing.

06 · Coverage

Frameworks crosswalked to FT3.

A concept counts as covered when at least one reviewed mapping links it to FT3.

Framework	Pinned version	Concepts	Covered by reviewed mappings	Gaps	Unassessed
MITRE Fight Fraud Framework (F3)	v1.1	123	101	22	0
MITRE ATT&CK Enterprise	v19.1	697	147	550	0
PCI DSS	v4.0.1	273	135	138	0
VERIS threat actions	1.4.1	128	0	128	0
GSMA telecom fraud	v1	49	0	49	0
PSR UK APP scam types	Measure 1, cycle 3 (Dec 2024)	9	3	6	0
SPF ScamShield scam types	28 May 2026	12	4	8	0
NPA special fraud (Japan)	2026.4	13	0	0	13
RBI Fraud Monitoring Return	Circular 2024-25/118	11	0	11	0
MISP cryptocurrency-threat	v2	12	5	7	0
MISP cryptocurrency-market	v1	20	0	20	0
MISP carding	v1	19	1	18	0
OWASP Automated Threats	Handbook 1.3	21	12	9	0
Total	13 frameworks	1,387	408	966	13

Also pinned against FT3, with ledgers under review and so outside these totals: MITRE ATLAS (2026.07, 178 subjects); EBA PSD2 fraud reporting (GL/2018/05 + GL/2020/01, 9 subjects).

PCI DSS requirements map to FT3 controls, not techniques. A gap records a reviewed decision, not necessarily a hole in FT3.

07 · Questions

Frequently asked questions.

How FT3 and MITRE F3 differ · Why FT3 moved from open source to trust groups

What is FT3c?: FT3c is the cross-framework relationship catalog for FT3. It maps other fraud and security frameworks onto FT3, holds the result in a graph, and builds the combined catalog with a coverage report. Every external concept is reviewed and recorded as a typed mapping to FT3, a gap, or unassessed. It covers 1,387 concepts from 13 frameworks.
How is FT3c different from FT3?: FT3 is the ATT&CK-style fraud framework, built for the future of agentic commerce. FT3c is the mapping of other fraud frameworks to FT3. It solves a practitioner problem: understanding how the other frameworks relate to FT3 and to each other. FT3c depends on FT3; FT3 never depends on FT3c.
How does FT3c map MITRE F3 and ATT&CK?: Mappings resolve through FT3. Each entry is anchored to the most precise FT3 concept (a technique, tactic, or dimension) with a typed relationship and a recorded review, or it is recorded as a gap. F3 and ATT&CK are compared through FT3, not mapped to each other directly; a chained match stays a candidate until it is reviewed. 101 of 123 F3 entries and 147 of 697 ATT&CK Enterprise entries are covered by reviewed mappings.
Which frameworks are included?: MITRE Fight Fraud Framework (F3) (v1.1), MITRE ATT&CK Enterprise (v19.1), PCI DSS (v4.0.1), VERIS threat actions (1.4.1), GSMA telecom fraud (v1), PSR UK APP scam types (Measure 1, cycle 3 (Dec 2024)), SPF ScamShield scam types (28 May 2026), NPA special fraud (Japan) (2026.4), RBI Fraud Monitoring Return (Circular 2024-25/118), MISP cryptocurrency-threat (v2), MISP cryptocurrency-market (v1), MISP carding (v1), OWASP Automated Threats (Handbook 1.3); pinned with ledgers under review: MITRE ATLAS (2026.07), EBA PSD2 fraud reporting (GL/2018/05 + GL/2020/01). Each is pinned to a specific release, and FT3 is the target they all map to.
How does FT3c handle PCI DSS?: FT3c maps PCI DSS v4.0.1 requirements to FT3’s security controls in a separate control ledger, not to fraud techniques. All 273 requirements were reviewed: 135 map to at least one FT3 control and 138 are gaps. FT3’s own mitigates and disrupts relationships lead from each control to techniques. Outputs carry requirement identifiers and FT3c’s own labels, never PCI SSC text.
What formats does FT3c export?: Each build produces a combined STIX 2.1 bundle (every FT3 object plus external-framework nodes, crosswalk relationships, and gap objects), deterministic RDF graphs in N-Quads, per-framework coverage reports in CSV and Markdown, and an SSSOM mapping table. All are built against pinned framework versions. They are used within the project and are not distributed publicly.
Who builds FT3c, and is it open source?: FT3c is authored by Vincent Passaro. It is not open source and is not published publicly. Like FT3 2.0, it is shared through trust groups: the communities where analysts, researchers, and threat hunters already share, teach, and solve problems, with reciprocity as the membership criterion.

08 · The project

About FT3c

FT3c helps investigators and researchers compare fraud and security frameworks without losing the distinctions between them. Its crosswalk and graph catalog connects external concepts to FT3 and distinguishes reviewed mappings, proposals, gaps, and unassessed entries.

The implemented work includes mapping validation, machine-readable graph and STIX exports, and coverage reports built against specific framework versions. I lead the project’s technical direction and mapping review.

The crosswalk, export pipeline, and MCP integration are implemented.

FT3 is the ATT&CK-style fraud framework, built for the future of agentic commerce. FT3c maps the other fraud frameworks to it, so practitioners can see how those frameworks relate to FT3 and to each other.

How FT3 2.0 is structured · See the coverage table · Trust groups

Author: Vincent Passaro
Integration: MCP integration · Built
Coverage: 1,387 concepts from 13 frameworks.
Distribution: Not open source. Shared through trust groups.
Implemented: Crosswalk validation, graph exports, and coverage reports.
Status: Developing · Private source

Working on fraud framework mapping, or need a framework FT3c doesn’t cover?

Contact me about FT3c