Azhar Khan · Fintech Fraud Engine Map · Agentic AI Deployment
FINTECH · THE ENGINE← Back

129 signals, one decision.

The engine reads 8 systems into one record for the investigator to approve, correct or escalate. An account-takeover case takes 4 minutes, down from 9. Every part on this map runs in production.

8 systems · 129 signals a case · 660K cases a month · about 150 data points

EXECUTION TRACES every agent action captured, in order, with its evidence ONTOLOGY one customer reconciled across 8 systems INTAKE THE AGENT ENGINE an orchestrator and 3 sub-agents on one shared record OUTCOMES Card fraud
Card fraudReal-time card-authorization alerts, with velocity, geography, device and merchant risk scored against the customer’s own history.
 ACH and wire
ACH and wirePayment fraud on ACH and wires, with mule patterns and anomalous flows checked against the customer’s own history.
 Account takeover
Account takeoverLogin and session risk, with credential stuffing, session hijack and SIM swap scored on device and behavior.
 Scams and push payments
Scams and push paymentsAuthorized push payment and scam reports, where the victim sends the money.
 AML and sanctions
AML and sanctionsTransaction monitoring and sanctions screening hits. The regulated stream always has a person on the decision.
 Disputes
DisputesChargeback and dispute intake, each reason-coded and joined to an existing case where one exists.
 Credit and KYC risk
Credit and KYC riskOnboarding and credit-risk review, scored on identity, first-party and synthetic-identity signals.
 Orchestrator
OrchestratorOne orchestrator plans the case, calls the sub-agents in order and holds the state they share.
 Ingestion
IngestionIngestion pulls evidence from the case’s systems, transactions, identity, device, prior cases and dispute history, into shared state. The ontology says which system holds what.
 Investigation
InvestigationIt reasons from the evidence and the risk score to a finding, and cites the record behind it.
 Reporting
ReportingDrafts the case summary and, where a case is reportable, the report narrative. It writes only from retrieved evidence.
 SHARED STATE one case record, about 150 data points
Shared stateEvery sub-agent reads and writes this one record. Each of about 150 data points carries its source and time.
 risk model, tiers 1 to 4
Risk modelA gradient-boosted model scores risk in tiers 1 to 4. The score is evidence, and the investigator decides.
 One analyst decides every regulated decision, 100%
One analyst decidesEverything the engine produces passes one gate, where the investigator approves, corrects or escalates. Every regulated decision is approved, corrected or escalated by a person.
 Customer action
Customer actionThe hold, block, step-up or clear runs in the operation’s own system with the audit trail.
 Report filing
Report filingReportable cases flag on their own. The reporting agent drafts the narrative, and a compliance officer approves and files it.
 Labeled outcome
Labeled outcomeConfirmed fraud and cleared cases are the ground truth the next version of the model trains on.
The engine, end to endHover or tab any part of the map to read what it does.

Intake, 7 alert streams

Card fraudReal-time card-authorization alerts, with velocity, geography, device and merchant risk scored against the customer’s own history.
ACH and wirePayment fraud on ACH and wires, with mule patterns and anomalous flows checked against the customer’s own history.
Account takeoverLogin and session risk, with credential stuffing, session hijack and SIM swap scored on device and behavior.
Scams and push paymentsAuthorized push payment and scam reports, where the victim sends the money.
AML and sanctionsTransaction monitoring and sanctions screening hits. The regulated stream always has a person on the decision.
DisputesChargeback and dispute intake, each reason-coded and joined to an existing case where one exists.
Credit and KYC riskOnboarding and credit-risk review, scored on identity, first-party and synthetic-identity signals.

The agent engine

OrchestratorOne orchestrator plans the case, calls the sub-agents in order and holds the state they share.
IngestionIngestion pulls evidence from the case’s systems, transactions, identity, device, prior cases and dispute history, into shared state. The ontology says which system holds what.
InvestigationIt reasons from the evidence and the risk score to a finding, and cites the record behind it.
ReportingDrafts the case summary and, where a case is reportable, the report narrative. It writes only from retrieved evidence.
Shared stateEvery sub-agent reads and writes this one record. Each of about 150 data points carries its source and time.
Risk modelA gradient-boosted model scores risk in tiers 1 to 4. The score is evidence, and the investigator decides.

The gate

One analyst decidesEverything the engine produces passes one gate, where the investigator approves, corrects or escalates. Every regulated decision is approved, corrected or escalated by a person.

Outcomes

Customer actionThe hold, block, step-up or clear runs in the operation’s own system with the audit trail.
Report filingReportable cases flag on their own. The reporting agent drafts the narrative, and a compliance officer approves and files it.
Labeled outcomeConfirmed fraud and cleared cases are the ground truth the next version of the model trains on.