How money goes

Twelve entries in order of expected cost. The order matters more than any single page, because it tells you where to spend attention.

How to read the order

Rank one is not the worst thing that could happen to you. It is the thing most likely to happen multiplied by what it usually takes. A total loss that reaches one reader in a thousand ranks below a partial loss that reaches one in five.

That is deliberately unlike how this subject is usually discussed, and it is the more useful ordering if you are deciding what to actually do differently this week.

01A balance left behindNo attacker involved. The most frequent loss in the whole subject.Very high 02Credentials typed on a copyA copied login page. Cheapest attack there is and the most common.Very high 03Payment sent outside escrowThe only entry here with no process of any kind afterwards.Very high 04An old address that answers againReaches the readers who have been doing this longest.High 05A password reused somewhere elseNobody targeted you. A list from an unrelated breach did.High 06An order that never arrivedUsually recoverable, and most of the outcome is decided before you file.Medium 07A wallet phrase handed overRare, total, and nothing legitimate has ever asked for one.Total 08A dispute filed too earlyA winnable case spent badly. Entirely self inflicted.Medium 09An address swapped on your own machineThe one entry the signature check cannot reach.Medium 10Locked out of your own accountUsually boring, occasionally permanent, and decided at setup.Medium 11Credentials read by a gatewayNot malice. The mechanism reads everything you send.Medium 12An identity linked to another oneNo money moves. It ranks last and it cannot be undone.Unbounded

The ones with no remedyThree entries are marked unrecoverable, meaning there is no process of any kind afterwards. Those deserve attention out of proportion to their rank, because everything else on this list has at least a chance of a remedy.

Three things the order tells you

Attention is misallocated by default. The subjects that get written about most sit in the lower half. The top of the list is where nothing gets written because none of it makes a story.
Most of the cost is self inflicted or preventable for free. Five of the twelve cost nothing at all to close, and two of those five are simply decisions not to do something.
Finality does not follow frequency. The three entries with no remedy sit at ranks three, seven and nine, spread across the table rather than clustered at the top.

How the twelve group

Group	Entries	What they have in common
Nobody involved	1, 8, 10	No other party. The loss is a decision, an impatience or an omission.
Somebody talks to you	3, 7, and part of 2	Arrives inside a conversation, which is why refusing feels rude.
Somebody waits for you	2, 4, 11	A copy or an intermediary sitting where you were going to arrive anyway.
Automated and impersonal	5, 9	Nobody chose you. A list or a piece of software did.
Ordinary commercial failure	6	The one entry that is not about security at all.
No money moves	12	Costs nothing and cannot be reversed.

What is deliberately not here

Seizure, prosecution and exit are not in this table. Not because they are unimportant, but because none of them is something a reader can change by behaving differently, and this list exists to sort actions rather than to catalogue dangers. An entry earns a place by having something you can do about it.

Also absent is anything about products, sourcing or what is being bought. That is a deliberate boundary and it holds across all six languages.

If you only change one thing

Stop holding a balance. It closes rank one entirely, removes most of the cost of rank ten, and reduces a platform ending from a catastrophe to whatever is currently committed. It costs nothing and takes no skill, which is a combination nothing else in this table offers.