# Building a system that scores and triages suspected fraud, and helps investigators and customers respond inside a bank

Source: https://www.bankingnewsai.com/agentic-banking/build/fraud
Last updated: Sep 17, 2026

Fraud is the most permissive use case in regulatory terms and the most time-critical operationally. Detection itself is usually a validated model on live data; language models earn their place in triage, investigator assistance and customer contact, where speed and clarity matter and where the threat itself is increasingly generated by AI. The rule to design around: a block or a decline that touches credit is an adverse action, and a customer contact must not be mistakable for a scam.

## The brief (default answers)

| Choice | Answer |
| --- | --- |
| Who is affected | Customers, directly |
| Reversibility | With cost |
| Stakes | Material |
| Knowledge | Live system state |
| Verifiability | By a rule or a test |
| Steps | Known |
| Jurisdiction | United States |
| Delivery route | Through a cloud platform |

- **Pattern:** Augmented call — One model call with retrieval, tools and a structured output, inside code you control.
- **Tier:** 2, Tier 2: act with approval — Material but recoverable. The model may prepare and, within limits, act, with a person approving anything that leaves the bank or touches a customer.
- **Workflow shapes:** 
- **Human involvement:** The model prepares and may act within limits; a person approves anything that reaches a customer or cannot be undone.
- **Knowledge:** Tool calls to the system of record for anything live. Never retrieval for a balance, a case status or a limit.

## Decomposition

| Step | Owner | Note |
| --- | --- | --- |
| Detect | system | The validated scoring model on live transaction data. |
| Triage and enrich | model | Summarise the case, pull related activity via tools, propose a disposition. |
| Act on the account | system | Holds and blocks by rule, within limits; logged. |
| Contact the customer | human | Or a verified channel with a scripted, clearly identified AI assistant. |
| Investigate and report | human | With the model's file, and the SAR where required. |

## Control layer weights (0–4)

| Layer | Weight |
| --- | --- |
| governance | 1 |
| identity | 1 |
| actions | 0.9 |
| data | 0.7 |
| models | 1 |
| runtime | 0.4 |
| observability | 0.7 |
| oversight | 1 |

## Documents that apply

- [FIN-2024-Alert004 (Deepfake Media)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2024-deepfake-media) — The threat picture: synthetic documents, voices and video at onboarding.
- [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689) — Fraud detection is carved out of the high-risk credit category.
- [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Fraud models validated in proportion to materiality.
- [ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9)](https://www.bankingnewsai.com/ai-regulation/documents/cfpb-ecoa-regulation-b-adverse-action) — A fraud-driven decline of a credit application is still an adverse action.
- [DFS AI Cybersecurity Industry Letter (Oct 2024)](https://www.bankingnewsai.com/ai-regulation/documents/ny-dfs-industry-letter-2024-10-16-ai-cyber-risks) — AI-enabled social engineering must appear in risk assessments and MFA design.
- [CFPB Chatbots in Consumer Finance (issue spotlight, 2023)](https://www.bankingnewsai.com/ai-regulation/documents/cfpb-chatbots-in-consumer-finance-2023) — Customer-facing AI must not block access to a person or give wrong answers about rights.
- [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4) — US third-party risk management, including the model provider.
- [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) — Colorado: notice, explanation and human review for consequential automated decisions from Jan 1, 2027.
- [BCBS Third-Party Risk Principles (Dec 2025)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025) — Nth-party supply chains and concentration on cloud providers.
- [BCBS ICT Risk Management Report (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-ict-risk-management-range-of-practices-2026) — How supervisors look at ICT and cloud dependencies.
- [OCC Bulletin 2026-13](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13) — For a national bank, the OCC's copy of the 2026 model-risk guidance.
- [NIST AI RMF 1.0](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-1) — The voluntary Govern, Map, Measure, Manage frame for everything model-risk guidance leaves out.

## Evals

- A golden dataset of at least 150 real cases with expected outputs, including adversarial inputs: wrong documents, unusual formats, prompts that try to change the task.
- Code-based checks on every output: schema conformance, required fields, reconciliations against the system of record. Threshold: 99% or better before launch, every run in production.
- Escalation evals: the cases that must reach a person do, on a held-out set, with precision and recall both reported.
- The same suite reruns on every prompt change, model version change and retrieval change; a regression blocks the release. That is what ongoing monitoring and outcomes analysis mean in model-risk terms.

## Human gates

- Per-action approval by a competent reviewer for anything customer-facing or irreversible; sampled review for the rest.
- Validation proportionate to materiality, with monitoring for drift on inputs and outputs.
- An escalation route to a person that the customer can reach in one step.
- Monthly review of the evals and the exception log by the accountable owner.
- The customer is told they are dealing with an AI system and can reach a person in one step.

## What an examiner will ask

- Where is this system in your inventory, what tier did you assign, and who signed it off?
- What counts as a model here, and what does your validation cover for the parts that are not?
- Show me the data lineage behind the retrieval set and the training or tuning data.
- What can the system do without a person, and where is that written down?
- How do you know it is still working: which evals run, how often, and what happened the last time one failed?
- What did you do about the vendor: due diligence, contract, exit plan, concentration?
- Walk me through one wrong output from production and what the customer, if any, saw.
- Who can switch it off, and has that been tested?
- Show me how a customer reaches a person, and how long it took the last ten who tried.

## What the board should hear

- What it does: scores and triages suspected fraud, and helps investigators and customers respond; the model prepares and may act within limits; a person approves anything that reaches a customer or cannot be undone.
- Pattern: augmented call; tier 2: act with approval.
- Rules it answers to: 4 documents across US, each linked in the brief.
- How we know it works: a golden dataset, automated checks on every release, and human review at the level the tier demands.
- What could go wrong and who answers: the accountable owner, the kill switch, the escalation route.

## Pitfalls

- A fraud decline on a credit product with no adverse-action reasons.
- Customer outreach that trains customers to trust unverified AI voices.
- Training data assembled outside the bank's data governance.

Change any answer on the interactive map: https://www.bankingnewsai.com/agentic-banking/build/fraud

---

Canonical page: https://www.bankingnewsai.com/agentic-banking/build/fraud
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (19 authorities, 166 documents) and AI-strategy profiles of the 100 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.