02 · FINTECH · FRAUD & RISK

9:00minutes per caseAn investigator opens 12 screens across 8 systems by hand.

THE ENGINE

4:00minutes per caseThe engine reads 8 systems and the investigator signs.

129 signals, one signature.

Under review

A payments company sat under regulatory review, having paid regulators nine figures in 2025 for incomplete fraud investigations. Every fraud decision had to be complete, timely, documented and defensible, 660,000 times a month. The next penalty would be larger. An investigator rebuilt each case from 12 screens across 8 systems by hand. The denylist check ran at a 33% error rate, and the customer stayed locked out.

The engine

An agentic orchestration system assembles the record. An orchestrator and 3 sub-agents read the 8 systems, and a gradient-boosted model scores the risk. Rules decide where policy is written down, and models decide where it is not. Name and card changes close by written policy, and every other queue waits for a person.

The signature

100% of regulated decisions pass through a person, by law. A case takes 9:00 to 4:00 minutes. The engine is fast on the assembly, and the decision waits for a person.

The customer

The engagement started to reduce risk and fraud penalties and to fix the customer’s experience. Every signal is sourced and every override is logged. Refunds go out on time, nobody stays locked longer than the review needs, and a person is reachable.

RUN · THE ENGINE

Every decision complete, documented and defensible.

Minutes per case

4:00from 9:00

The same 16 steps run. 12 finish before the case is opened, and the investigator reads one record.

30–35%of handle time gone

12 → 1screens a person opens

660Kcases a month

43%of volume closes by policy

Queues that close themselves

2 of 8

Card signature reviews and legal name changes close by written policy.

Denylist error

0from 33%

7 parameters were read off a PDF. The engine reads them, with a version number.

Signals per case

129 → 1

The engine assembles them across 8 systems and about 150 data points, none of them retyped.

Through a person

100%

of regulated decisions, by law. The signature is on the record.

Onshore review

The engine drafts the report and a person files it, with every actor and source named.

The investigator opens one screen and reads one record. Onshore review receives a report the engine drafted and a person filed. The customer whose account was locked gets an answer in minutes.

DECIDE · RULES AND MODELS

Rules carry written policy, and models score the rest.

7 parameters from the SOP resolve to yes or no, with a version number. 3 models score what no rule names, and both are logged the same way.

Rules

7 SOP parameters resolve to yes or no, with a version number.

Models

3 models each return a score with a confidence. The score is evidence, and the investigator decides.

Combined

One score lands in tiers 1 to 4. It informs the person who signs and never decides for them.

Rules · SOP v124 of 7

Joined ≤ 6 monthsp1 · v12

Signal on aliasesp2 · v12

Manual compliance modelp3 · v12

Prior denylist hitp4 · v12

Device count ≥ 3p5 · v12

Account merge attemptp6 · v12

ZIP mismatch on new sourcep7 · v12

Models · scored with confidence

Device driftv3.2

3 devices · 2 new in 24 h · 0.78

Geo-velocityv2.7

Chicago → Seattle → Miami · 20 h · 0.84

Behavior vs baselinev1.9

$3,000 in 60 s against a $40 median · 0.62

Combined · tier 368

GOVERN · THE GATE

2 queues close themselves and 6 reach a person.

Card signature reviews and legal name changes are approved by written policy and never wait for a person.

{{ pfPctAuto }}%

closed by policy

{{ pfPctInv }}%

investigated by a person

policy gate · auto-approve

investigation channel

BUILD · ONE RECORD

The engine opens 8 systems and returns one record.

It keeps the evidence for every field it reads, about 150 data points in all.

{{ saClock }} Minutes per case

{{ t.n }} {{ t.m }}

Case 4471 · 129 signals8 systems read

Account takeover. Confidence 0.94. Hold and refund.

Deviceunseen

Velocity10×

Data points~150

The investigator signs→

The engine map It draws all 8 systems at once, and the gate where the investigator signs. →

Fraud desk · 660,000 cases a month

Case 4471

minutes per case

8 systems · ~150 data points
Every regulated decision signed
9:00 → 4:00

Checklist{{ checkCount }}/12

Case 4471 · account takeover suspected129 signals · 12/12 checks · 3:50 minutes

129 signals

{{ g.k }}{{ g.n }}

The engine reads 8 systems, and nobody logs into any of them.

Outbound · new beneficiary · new device 3d

$4,200.00

Recommendation

Hold and refund

Score

0.94

−3 dSIM change on the registered numberDevice

−3 dFirst session from an unseen phone, trust 0.21Device

−11 minBeneficiary J. Adeyemi created, then $4,200 sentTxn

+5 minBeneficiary shared by 3 accounts, matches 212 prior ATO casesGraph

Sign the hold decision→

Investigator only · by law

Checks12/12

{{ c.label }}✓

AML & sanctions The regulated stream keeps a person on the decision. Policy gate 02

Scroll ↓

Fraud desk · 660,000 cases a month

Case 4471

3:50

minutes per case

8 systems · ~150 data points
Every regulated decision signed
9:00 → 4:00

Case 4471. The clock starts at the lock.

Assembling it by hand takes 9 minutes.

Beneficiary history gets skipped again.

Checklist12/12

The engine holds all 129 signals in one view.

AML & sanctions The regulated stream keeps a person on the decision.

Case 4471 · account takeover suspected

129 signals · 12/12 checks · 3:50 minutes

129 signals

{{ g.k }}{{ g.n }}

The engine reads 8 systems, and nobody logs into any of them.

Outbound · new beneficiary · new device 3d

$4,200.00

Recommendation

Hold and refund

Score

0.94

−3 dSIM change on the registered number Device

−3 dFirst session from an unseen phone, trust 0.21 Device

−11 minBeneficiary J. Adeyemi created, then $4,200 sent Txn

+5 minBeneficiary shared by 3 accounts, matches 212 prior ATO cases Graph

Sign the hold decision→

Investigator only · by law

Checks12/12

{{ c.label }}✓

The investigator signs. By law, a person decides.

Only a name change and a card change close themselves.

RUN · ONE CASE

The engine assembles 129 signals. The investigator signs.

One case record carries every signal with its source. The decision is the analyst's, by law. Name changes and card replacements close themselves. Everything else waits for a person.

THE INVESTIGATOR SIGNS

CASE ATO-4471

signals collected129

systems queried8

data points~150

risk scoreconfirmed ATO

decisionanalyst required

recommendationlock + refund

EVERY REGULATED DECISION SIGNED

4:00

MINUTES PER CASE

FRAUD ENGINE MAP →

RUN · 16 STEPS

TimeDeviceEventZoneResult

{{ e.t }}{{ e.d }}{{ e.ev }}{{ e.z }}{{ e.r }}

Findings · {{ ldFindN }} of 6 rules fired

{{ f.id }}{{ f.h }}

Recommendation · confidence 0.94

Takeover confirmed, 16 March 18:52. Hold and refund. The decision is reserved for the investigator, by law.

Step {{ ldStepN }} of 16

{{ ldStepLabel }} {{ ldStepSys }}

{{ l.n }}{{ l.m }}

{{ r.n }} · {{ r.sys }}{{ r.aht }}

Minutes per case

{{ ldPerson }}steps by a person

{{ ldEngine }}steps by the engine

100%of regulated decisions through a person

{{ tkNext }} →

← Home Utilities → ap.applyy@gmail.com linkedin.com/in/azharpathan Resume →

PRESS . FOR THE NEXT PAGE