Ingest bank fraud signals without leaking PII to marketing segments

• Ingest fraud signals into restricted DMO fields with role-based access separate from marketing data extensions • Derive non-sensitive risk bands for operational segments—high, medium, low—without raw alert text • Block marketing segment builder access to fraud DMO via permission set design • Use Data Actions to push risk bands to authentication systems—not broad profile export • Audit any query touching fraud fields with automated alerting on marketing role access attempts • Align retention: fraud signals shorter than marketing profile retention where regulations require • Document lawful basis for fraud processing separate from marketing consent