Azhar Khan · Fintech · Agentic AI Deployment
02 · FINTECH · FRAUD & RISK
9:00minutes · account takeoverAn investigator opens 12 screens across 8 systems by hand.
THE ENGINE
4:00minutes · account takeoverIn a payments company’s fraud operation, the engine reads 8 systems. The investigator approves, corrects or escalates.

129 signals, one decision.

660,000 cases a month

Each case needed a complete, documented decision. Investigators assembled the evidence by hand. In account takeover, 33% of manual deny-list checks were wrong; customers waited with locked accounts.

The redesign

I led the redesign from twelve source screens to one case record and directed the deployment in a payments company’s fraud operation. Change management ran jointly with the client. The deployment runs in production.

The boundary

Name and card changes close under written policy. Every regulated decision reaches an investigator, who approves, corrects and sends back, or escalates. Account-takeover handling time fell from 9 minutes to 4.

Customer experience

I evaluated where Sierra and Decagon could help the service team track interactions, draft replies and trigger actions. A guardrail audit of the chatbot and voice AI checks that every billing dispute reaches a person.

Illustrative case · Case 4471. Scroll through the twelve source screens, or skip to the assembled record.Skip to the assembled record
{{ twlProgress }}
Your account is locked.
A review is in progress.
We will be in touch.
{{ q.sys }}{{ q.tab }}
{{ r.k }}{{ r.v }}

{{ twlCap }}

{{ twlClock }}
{{ twlHud }}
{{ q.sys }}{{ q.tab }}
{{ r.k }}{{ r.v }}
ONE RECORD · ONE DECISION

The twelve source screens become Case 4471. The investigator approves, corrects and sends back, or escalates the regulated decision.

Inspect the assembled record →
DECIDE · RULES AND MODELS

Rules carry written policy, and models score the rest.

Every rule and every score is logged with its version, so a reviewer can trace each decision.

Rules
7 SOP parameters resolve to yes or no, with a version number.
Models
The model returns a score with confidence as evidence for the investigator.
Combined
One score lands in tiers 1 to 4. It informs the investigator who approves, corrects or escalates.
Rules · SOP v124 of 7
Joined ≤ 6 monthsp1 · v12
Alias matchp2 · v12
Compliance flagp3 · v12
Prior denylist hitp4 · v12
Device count ≥ 3p5 · v12
Account linkingp6 · v12
ZIP mismatch on new sourcep7 · v12
Models · scored with confidence
Device driftv3.2
3 devices · 2 new in 24 h · 0.78
Geo-velocityv2.7
Chicago → Seattle → Miami · 20 h · 0.84
Behavior vs baselinev1.9
$3,000 in 60 s against a $40 median · 0.62
Combined · tier 368
BUILD · ONE RECORD

The engine opens 8 systems and returns one record.

It keeps the evidence for every field it reads, about 150 data points in all.

{{ saClock }} Minutes · account takeover
{{ t.n }} {{ t.m }}
{{ w.n }}
Case 4471 · 129 signals8 systems read
Account takeover. Confidence 0.94. Hold and refund.
Deviceunseen
Velocity10×
Data points~150
The investigator approves, corrects or escalates→
{{ saHud }}
GOVERN · THE GATE

2 queues close themselves and 6 reach a person.

The policy gate opens only where written policy is the whole decision.

{{ pfPctAuto }}%
closed by policy
100%
of regulated decisions reach a person
policy gate · auto-approve
investigation channel
The engine map It draws all 8 systems at once, and the gate where the investigator approves, corrects or escalates. →
Fraud desk · 660,000 cases a month
Case 4471
{{ timer }}
minutes · account takeover
8 systems · ~150 data points
Every regulated decision reviewed
9:00 → 4:00
Checklist{{ checkCount }}/12
{{ c.label }}{{ c.mark }}
{{ caseCount }}
{{ caption }}
{{ w.app }}{{ w.meta }}
{{ r.k }}{{ r.v }}
Case 4471 · account takeover suspected129 signals · 12/12 checks · 4:00 minutes
129 signals
{{ g.k }}{{ g.n }}
The engine reads 8 systems, and nobody logs into any of them.
Outbound · new beneficiary · new device, 3 days
$4,200.00
Recommendation
Hold and refund
Score
0.94
−3 dSIM change on the registered numberDevice
−3 dFirst session from an unseen phone, trust 0.21Device
−11 minBeneficiary J. Adeyemi created, then $4,200 sentTxn
+5 minBeneficiary shared by 3 accounts, matches 212 prior ATO casesGraph
Approve, correct or escalate→
Investigator only
Checks12/12
{{ c.label }}✓
AML & sanctions The regulated stream keeps a person on the decision. Policy gate 02
Scroll ↓
Fraud desk · 660,000 cases a month
Case 4471
4:00
minutes · account takeover
8 systems · ~150 data points
Every regulated decision reviewed
9:00 → 4:00

Case 4471. The clock starts at the lock.

Assembling it by hand takes 9 minutes.

{{ w.app }}{{ w.meta }}
{{ r.k }}{{ r.v }}

Beneficiary history gets skipped again.

Checklist11/12
{{ c.label }}{{ c.mark }}

The engine holds all 129 signals in one view.

AML & sanctions The regulated stream keeps a person on the decision.
Case 4471 · account takeover suspected
129 signals · 12/12 checks · 4:00 minutes
129 signals
{{ g.k }}{{ g.n }}
The engine reads 8 systems, and nobody logs into any of them.
Outbound · new beneficiary · new device, 3 days
$4,200.00
Recommendation
Hold and refund
Score
0.94
−3 dSIM change on the registered number Device
−3 dFirst session from an unseen phone, trust 0.21 Device
−11 minBeneficiary J. Adeyemi created, then $4,200 sent Txn
+5 minBeneficiary shared by 3 accounts, matches 212 prior ATO cases Graph
Approve, correct or escalate→
Investigator only
Checks12/12
{{ c.label }}✓

The investigator approves, corrects or escalates.

Only a name change and a card change close themselves.

Fraud desk · 660,000 cases a month

{{ caption }}

{{ w.app }}{{ w.meta }}
{{ r.k }}{{ r.v }}
Checklist11/12
{{ c.label }}{{ c.mark }}
AML & sanctionsThe regulated stream keeps a person on the decision.
Case 4471 · account takeover12/12 checks
Outbound · new beneficiary
$4,200.00
Recommendation
Hold and refund
Score
0.94
Signals
129 in one view
Checks
12/12
Approve, correct or escalate→
{{ timer }}
minutes · account takeover
4:00
minutes · account takeover
{{ loopState }}
4:00
EscalatedNetwork graph
Shared device2 accounts
Shared beneficiary3 accounts · 9 d
ClusterATO-212
Matched byInvestigation agent
InvestigatorCase queue
CaseATO-4471 · auto lock
ModelP2P velocity
SLA00:09:00
Queue depth38 waiting
Case 4471 · account takeover12/12 checks
Outbound · new beneficiary
$4,200.00
Recommendation
Hold and refund
Score
0.94
Signals
129 in one view
Checks
12/12
Beneficiary history{{ loopRowV }}
{{ loopBtnT }}{{ loopBtnA }}
The engine
The engine reads 8 systems, and nobody logs into any of them.
RUN · THE ENGINE

The engine cuts account takeover to 4 minutes.

Minutes · account takeover
4:00from 9:00

The record is ready before the investigator opens it.

60–65%less overall handling time
12 → 1screens a person opens
660Kcases a month
43%of volume closes by policy
Queues that close themselves
2 of 8

Name and card changes close by written policy.

Case accuracy
98%

Case accuracy reached 98%.

Signals per case
129 in one record

The engine assembles them across 8 systems and about 150 data points, none of them retyped.

Through a person
100%

of regulated decisions go to an investigator, who approves, corrects or escalates.

Report filing

The engine drafts the report and a person files it, with every actor and source named.

{{ tkEyebrow }}

{{ tkH }}

{{ tkP1 }}

{{ tkP2 }}

{{ tkNext }} → Let's talk about a deployment leadership role.
← HomeUtilities → ap.applyy@gmail.comlinkedin.com/in/azharpathanResume →
PRESS . FOR THE NEXT PAGE