Azhar Khan · Fintech, the fraud engine
FINTECH · AGENTIC ORCHESTRATION SYSTEM← Back

129 signals. One signature.

Eight systems feed one case pipeline. The agent assembles the case record in under four minutes. The investigator signs.

systems
signals per case
cases a month
data points · assembled
TRANSACTION MONITOR DEVICE FINGERPRINT VELOCITY ENGINE GEO ANOMALY BEHAVIORAL MODEL ACCOUNT HISTORY NETWORK GRAPH EXTERNAL FEEDS COLLECT 129 signals · about 150 data points. all eight systems queried in parallel CORRELATE · SCORE Cross-system pattern match. risk model outputs a weight · device + behavior + velocity RECOMMEND The agent builds the case record. under four minutes from alert to assembled case INVESTIGATOR SIGNS the decision is an analyst's, by law
  • TRANSACTION MONITOR
  • DEVICE FINGERPRINT
  • VELOCITY ENGINE
  • GEO ANOMALY
  • BEHAVIORAL MODEL
  • ACCOUNT HISTORY
  • NETWORK GRAPH
  • EXTERNAL FEEDS
  • COLLECT129 signals · about 150 data points.all eight systems queried in parallel
  • CORRELATE · SCORECross-system pattern match.risk model outputs a weight · device + behavior + velocity
  • RECOMMENDThe agent builds the case record.under four minutes from alert to assembled case
  • INVESTIGATOR SIGNSthe decision is an analyst's, by law

The decision is an analyst's, by law.

← FintechHome →Resume →
The engine · named

Seven alert streams. One case record. One signature.

Every station on this map is a part of the system that runs in production. Hover or tab one to read what it does.

EXECUTION TRACES every agent action captured, in order, with its evidence ONTOLOGY one customer reconciled across eight systems INTAKE THE AGENT ENGINE one orchestrator, three sub-agents, one shared record OUTCOMES Card fraud
Card fraudReal-time card-authorisation alerts. Velocity, geography, device and merchant risk scored against the customer’s own history.
 ACH and wire
ACH and wirePayment fraud on ACH and wires. Mule patterns and anomalous flows against the customer’s own history.
 Account takeover
Account takeoverLogin and session risk. Credential stuffing, session hijack and SIM swap, scored on device and behavior.
 Scams and push payments
Scams and push paymentsAuthorised-push-payment and scam reports. Victim-initiated transfers that clear every check and fail on intent.
 AML and sanctions
AML and sanctionsTransaction monitoring and sanctions screening hits. The regulated stream always has a person on the decision.
 Disputes
DisputesChargeback and dispute intake. Reason-coded, deduplicated and reconciled to an existing case where one exists.
 Credit and KYC risk
Credit and KYC riskOnboarding and credit-risk review. Identity, first-party risk and synthetic-identity signals at the front door.
 Orchestrator
OrchestratorOne orchestrator plans the case, calls the sub-agents in order and holds the state they share. It is the spine every case runs on.
 Ingestion
IngestionRetrieval pulls evidence from the case’s systems, transactions, identity, device, prior cases and dispute history, into shared state. The ontology says which system holds what.
 Investigation
InvestigationReasons over the assembled evidence and the risk score to a finding, with a citation back to the record each one came from.
 Reporting
ReportingDrafts the case summary and, where a case is reportable, the report narrative. Grounded in retrieved evidence, never free-written.
 SHARED STATE one case record, about 150 data points
Shared stateThe one case record every sub-agent reads and writes. About 150 data points, each with its source and its time.
 risk model, tiers 1 to 4
Risk modelA gradient-boosted model scores risk in tiers 1 to 4 into the agent’s context. Evidence for the agents, never a decision of its own.
 One analyst decides every regulated decision, 100%
One analyst decidesThe narrow waist. Everything the engine produces passes through one gate: the engine recommends, the investigator signs. 100% of regulated decisions pass through a person.
 Customer action
Customer actionHold, block, step up authentication or clear, actioned through the operation’s own system with the whole audit trail behind it.
 Report filing
Report filingReportable cases flag on their own. The reporting agent drafts the narrative, a compliance officer reviews, approves and files.
 Labeled outcome
Labeled outcomeConfirmed fraud and cleared cases are the ground truth the next version of the model trains on.
The engine, end to endSeven alert streams arrive in one intake. One orchestrator and three sub-agents build one case record. One signature takes it out.

Intake, seven alert streams

Card fraudReal-time card-authorisation alerts. Velocity, geography, device and merchant risk scored against the customer’s own history.
ACH and wirePayment fraud on ACH and wires. Mule patterns and anomalous flows against the customer’s own history.
Account takeoverLogin and session risk. Credential stuffing, session hijack and SIM swap, scored on device and behavior.
Scams and push paymentsAuthorised-push-payment and scam reports. Victim-initiated transfers that clear every check and fail on intent.
AML and sanctionsTransaction monitoring and sanctions screening hits. The regulated stream always has a person on the decision.
DisputesChargeback and dispute intake. Reason-coded, deduplicated and reconciled to an existing case where one exists.
Credit and KYC riskOnboarding and credit-risk review. Identity, first-party risk and synthetic-identity signals at the front door.

The agent engine

OrchestratorOne orchestrator plans the case, calls the sub-agents in order and holds the state they share. It is the spine every case runs on.
IngestionRetrieval pulls evidence from the case’s systems, transactions, identity, device, prior cases and dispute history, into shared state. The ontology says which system holds what.
InvestigationReasons over the assembled evidence and the risk score to a finding, with a citation back to the record each one came from.
ReportingDrafts the case summary and, where a case is reportable, the report narrative. Grounded in retrieved evidence, never free-written.
Shared stateThe one case record every sub-agent reads and writes. About 150 data points, each with its source and its time.
Risk modelA gradient-boosted model scores risk in tiers 1 to 4 into the agent’s context. Evidence for the agents, never a decision of its own.

The gate

One analyst decidesThe narrow waist. Everything the engine produces passes through one gate: the engine recommends, the investigator signs. 100% of regulated decisions pass through a person.

Outcomes

Customer actionHold, block, step up authentication or clear, actioned through the operation’s own system with the whole audit trail behind it.
Report filingReportable cases flag on their own. The reporting agent drafts the narrative, a compliance officer reviews, approves and files.
Outcome becomes a labelConfirmed fraud and cleared cases are the ground truth the next version of the model trains on.