Stress-test a referral fraud spike by proving that each restore window and hold rule can place rewards inside the planned lane, survive override pressure, and avoid trapping operators inside a green fraud slide that hides long-lived exceptions.
Referral fraud spikes often list a calendar while leaving restore behavior, override authority, and abort ownership implicit. Those edges decide whether a late growth ask stops inside the policy or leaves a broken reward live under launch load. The exercise should follow actual referral tools, fraud exports, and on-call paths rather than a clean growth deck.
Inventory the fraud path
List every referral class with its hold window, restore rule, override behavior, owners, and notification channels. Mark paths that cannot reverse without a manual payout edit. Attach the last three fraud incidents with raw timelines and any waivers. Include the source of truth for open fraud counts during the observation window.
Define the phases for detect, hold, restore, abort, and communicate. Each phase needs an owner and an exit condition. Write the point after which a stuck fraud hold would require a different procedure, then review whether that action is still permitted. Capture maximum acceptable member friction in measurable units, including which cohorts are excluded from the hold and why.
Include the calendar of known events for the next two quarters: campaign launches, partner cutovers, and support peaks that shrink the usable change window. A fraud budget that ignores those dates will look calm until the week they land.
Failure drills
- A minority high-volume referrer keeps a side-channel while the aggregate fraud dashboard stays green.
- A restore has already left a partner surface without a trusted reward state.
- The primary fraud dashboard lags beyond the planned observation window.
- An operator skips a hold gate because a renewal is close.
- Automated and human holds collide under the new restore rule.
- Abort authority is unclear at week end and the page lands on the wrong rotation.
For each drill, identify detection time, member impact, containment, and the authority to force a reward rollback. Require commands and dashboard links in the runbook. A statement that monitoring will catch it does not establish which alert fires or who receives it.
Prove fraud changes are timed and owned
Run the package in Pingpong with growth, product, support, and finance seats. Ask support which member decision becomes unsafe first if rewards still stick after the claimed restore window. Ask finance whether capacity can absorb a forced override. Ask growth to show the exact fraud version or payout export used as the exit condition.
Related reviews include the growth ops lead seat, a referral program review, and the fraud analyst seat. Browse the war-game decisions hub for adjacent controls.
Authorize the published fraud response only after a timed drill restores usable reward hygiene inside the documented budget without an undocumented manual step.