The first time around I spent too long explaining a strategic approach alongside tech and data elements. The second time I asked instead if they even prioritised fraud as a business concern and what's their strategy and approach to it. The general problem with risk (like in banks) is people do not know how to define, identify and measure it. Therefore they don't know how much resource to allocate to it.