Use casesFinancial institutions & fintech
Fraud alert investigation
Most alerts are false, and each one still takes an analyst real time to rule out.
- Kinds of AI
- ModelsAgentic AI
- Who decides
- Fraud analyst
- Where it runs
- Your servers, banking data kept in Türkiye
Model · fraud score
Agent · parallel checks
- DeviceNew device, first seen 2 hours beforedevice log
- BeneficiaryMerchant linked to 3 confirmed-fraud casesnetwork
- Customer patternNo prior purchase in this categoryhistory
- Model
- Agent
Why a person decidesRouted to an analyst: not a listed false-positive pattern.
DecidesFraud analyst
1. The desk
Today
- AlertThe rules and score raise far more alerts than there is fraud; the queue grows every week.
- GatherAn analyst opens transactions, device logs, and past alerts in separate screens for each one.
- ClearKnown false-positive patterns (a customer's regular foreign merchant) are cleared by hand again and again.
- DecideThe fraud analyst decides every alert from the same growing queue, real fraud and false alarms alike.
With the system
- AlertThe fraud score gives each alert a calibrated probability and reason codes.Model
- GatherThe agent runs the evidence checks at once through read-only systems and writes one case note, each fact citing its system.Agentic AI
- ClearOnly a known false-positive pattern your written alert policy lists closes, with its explanation recorded; a set share is re-reviewed by a person.Your rule
- DecideThe fraud analyst decides every other alert from one note, as before; a sanctions or watch-list hit and any report to MASAK (the financial intelligence unit) stay with a person.Person decides
What lands on the desk
The analyst opens one note instead of five screens: every check has already run, each fact names the system it came from, and the route says why this alert reached a person. The note also shows whether the reporting clock has started.
Model · fraud score
Agent · parallel checks
- DeviceNew device, first seen 2 hours beforedevice log
- BeneficiaryMerchant linked to 3 confirmed-fraud casesnetwork
- Customer patternNo prior purchase in this categoryhistory
- False-positive patternNo match to a known pattern
- ScreeningNo sanctions or watch-list hitscreening
Status
- MASAK clock (no AML suspicion recorded)not started
- Customer contact about this alert by the agentnot allowed
- Model
- Agent
Why a person decidesRouted to an analyst: not a listed false-positive pattern.
DecidesFraud analyst
2. The system
For your technical team — skip it if you like.
How it works
In
- Transaction, device, and session data
- Beneficiary and network (graph) links
- Customer history
Model · estimates
Fraud score
Gradient-boosted or logistic, chosen on out-of-time evidence
Reads
- Everything under In
Out
- Calibrated fraud probability per alert
- Reason codes
Agent · prepares
Evidence-check agent
Parallel checks
Reads
- The alert and its score
Out
- Transactions in the window
- Device and IP history, beneficiary links
- Prior alerts, known false-positive match
- Sanctions and watch-list screening result
Agent · prepares
Case-note writer
The same agent
Reads
- The evidence
Out
- A case note, every fact cited to its system
Decision
Alert policy, then fraud analyst
Reads
- The case note
Out
- A known false-positive pattern the bank's written policy lists closes, its explanation recorded
- Those closures enter the quality-assurance (QA) sample
- Everything else goes to an analyst, who decides
- If suspicion of money laundering or terrorist financing forms, a person files with MASAK
How the agent's work is arrangedParallel
Parallel
The evidence sources are independent and each alert needs all of them, so they run at once and merge into one case note.
How the models are trained and tested
Your expert writes the test first. A step the test does not need is skipped, and we say why.
Show the training steps
Fraud detection score
Target
Confirmed fraud per alert (analyst outcome, chargeback, customer confirmation), with delayed-label handling.
Data
12–24 months of alerts with outcomes; device and network features; graph features on beneficiaries.
Method and challenger
A logistic champion against a gradient-boosted challenger; the better one on out-of-time tests is deployed. Graph features stay only if they add stable lift out of time.
Validation evidence
Precision at the analyst capacity line, recall on confirmed fraud, false-positive rate by pattern, and out-of-time stability.
Monitoring
Weekly drift; monthly QA-sample results; the pattern list reviewed by the fraud policy owner.
Where the agentic system stops
The analyst decides every alert the written policy does not list.
Show its tools, limits, and record
- Tools and access
- Read-only transaction, device, case-management, and screening systems; writes the case note and, only for patterns the written alert policy lists, the closure record with its rule version, a set share of which a person re-reviews.
- May not
- Close a sanctions or watch-list match, file or decide a suspicious-transaction report, or contact the customer about the alert (tipping-off is an offense).
- Who decides and the written limit
- Fraud analystThe analyst decides every alert the written policy does not list. Only where that policy allows, alerts matching a known false-positive pattern close with the explanation recorded and a sample reviewed. A sanctions or watch-list match never closes automatically. Suspicious-transaction reporting to MASAK is always a person's, within 10 business days of suspicion forming; the case file carries that timestamp and the deadline.
- Stops when
- Any sanctions or watch-list hit, any anti-money-laundering (AML) indicator, any pattern not on the list, or missing data: the alert goes to an analyst.
- Record
- Every check, the score, the rule version, the closure reason, and the time suspicion was flagged.
3. Value and conditions
Where the time goes, and what your institution will measure.
Where the value comes from
- Analyst time per alert.
- Faster handling of real fraud.
- Consistent closures, each with a record.
What your institution measures
- Alerts per analyst per day
- Share of alerts closed by listed patterns
- QA-sample error rate
- Confirmed fraud caught per alert reviewed
- Time from alert to decision
- Fraud losses
Payment fraud reported by industry across the European Economic Area (EEA) amounted to EUR 4.2 billion in 2024.
Measured in the Decision Blueprint
Analyst minutes per alert and the false-positive share by pattern set the baseline; your institution sets the target.
Conditions
The rules, the data, and the known error, with its guard.
- Systems used mainly to detect financial fraud are carved out of the EU AI Act's high-risk list (Annex III); AML systems are not.
- MASAK: report within 10 business days, and no tipping-off.
- The EU Anti-Money Laundering Regulation (AMLR) applies from 10 July 2027.
- On premises; customer data stays in Türkiye.
Start here
We replay a recent month of alerts with your analysts, time each check, and find which false-positive patterns your written policy could list.
Similar desks
- ModelsAgentic AI
Behavioral score and limit management
TodayLimits are set once at application; good customers outgrow them and quietly deteriorating ones keep full, undrawn lines.
With the systemLimit actions queued with their evidence, inside the committee's matrix.
Underwriter decides
- ModelsSLMsAgentic AI
Early warning on the loan book
TodayThe borrower is current; other banks are already cutting its limits, and you see its quarter only at renewal.
With the systemA file, not a spreadsheet: signals checked in parallel and gathered in one place.
Watch-list committee decides
Equalize the gap.
Bring one decision. Leave knowing the first step.
A short description of the decision is enough; no confidential records.
https://eqlx.ai/use-cases/fraud-alerts · Printed copy; the website is the current version.