Responding to fraud — policy in the pipeline