Spanish online retailers should train fraud analysts to supervise AI agents that screen card and mobile-payment orders, contain account takeover and prepare dispute evidence, and to agree as a team who may approve what. Account blocks, contested refunds and police reports stay with people. GDPR with the AEPD, the EU AI Act and PSD2 authentication frame the training.
What does an e-commerce fraud analyst in Spain work on?
Spanish shoppers pay mostly by card, with a growing share through the banks' mobile instant payment service and digital wallets. Card-not-present fraud remains the main load: stolen cards tested in small purchases, then used for electronics, fashion and travel. Strong customer authentication has cut some of it, so fraudsters increasingly use social engineering, persuading victims by SMS or phone to approve a payment themselves.
That shift matters for analysts. A payment authenticated by the genuine cardholder can still be fraud if the cardholder was deceived, and those cases surface later as complaints and disputes. Analysts also handle account takeover, false non-delivery claims, return fraud around sale seasons, and delivery to collection points that fraudsters use to stay anonymous. Spain's tourism economy brings a heavy flow of international cards, which complicates scoring.
Where do AI agents fit?
- Order risk packs (depth 2). The agent gathers card, device, account and delivery evidence and drafts a recommendation for each flagged order.
- Exemption decisions (depth 3). Within the retailer's limits, the agent decides when to request an exemption from strong authentication for low-risk orders and when to require it.
- Social engineering indicators (depth 2). The agent flags authenticated orders that still show signs of a deceived cardholder, such as a first-time high-value purchase shipped to a new collection point.
- Dispute packs (depth 2). The agent compiles evidence for card disputes; the analyst submits.
- Account blocks and contested refunds (held). The agent prepares the case; a named analyst decides.
For the wider skill set across roles, see AI agent skills by role; for the order in which fraud skills pay off, see our ranking of which AI agent skills matter most for fraud analysts.
What must analysts learn, and what stays with them?
Who approves what. Agree which analysts can release which held actions, and enforce it in the system rather than by habit. Our guide on how to set an approver rule for the fraud team explains how.
Shared standards. Social engineering cases are judgement calls, and analysts disagree. Regular calibration sessions for fraud analysts align decisions and give the agent consistent corrections.
Verdicts and provenance. Authentication results are sealed; a customer's account of a phone call is declared; an SMS forwarded as proof is external. Analysts should read the verdict, the bound that decided it, and the class of each fact before agreeing.
Lapses. The agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. Analysts should expect exemption decisions to return to them if that happens.
Log each analyst's progress on social engineering cases on the AI agent competency matrix for the fraud team.
What stays with analysts: blocking accounts, refusing contested refunds, deciding whether a customer was deceived, reports to police, and responses to customers who object to automated decisions. Agents reshape the job rather than replacing it, as our piece on whether AI agents will replace fraud analysts explains.
Which rules shape oversight and literacy in Spain?
GDPR governs shoppers' personal data, and the AEPD is the Spanish supervisory authority, active on data protection enforcement. Article 22 limits decisions based solely on automated processing with significant effects, and Article 35 impact assessments are expected for large-scale fraud profiling.
The EU AI Act applies directly. Article 4 requires deployers to ensure AI literacy among staff; Article 50 requires that people know when they are dealing with an AI system. Fraud detection is carved out of the Act's credit-scoring high-risk category, so most fraud agents will not be high-risk, but the literacy duty applies regardless. Spain has set up a national agency to supervise AI. PSD2 strong customer authentication applies to online payments, and its exemptions are where agents add value and where analysts must understand the limits. Banco de España supervises payment institutions. Card merchants must meet PCI DSS v4.0.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day training plan look like?
Days 1 to 30. Every analyst completes foundations training, with attendance kept for Article 4. The agent drafts order risk packs in shadow during a normal trading month, before the sales season.
Days 31 to 60. Certify exemption decisions at depth 3 within conservative limits. Begin fortnightly calibration on social engineering cases. Set the approver rule.
Days 61 to 90. Senior analysts complete operator certification; only they may block accounts or refuse a contested refund, and the approver rule enforces it.
Where the Academy fits
Pryme Intelligence Academy offers a free Foundations track for every analyst and the Operator track for those who release held actions. A business can make approval rights depend on a current certificate, depth by depth, which fits the approver rule. Operator certificates are valid 12 months and checkable through VerifyDoc.ai.
Questions people ask
Can the agent decide on authentication exemptions?
Within your limits and once certified on your own cases, yes. The record shows each exemption decision and the evidence behind it.
How do we handle a customer who approved a payment under deception?
The agent can flag the indicators. Whether the customer was deceived, and what follows, is a decision for an analyst.
Do calibration sessions need the whole team?
Ideally, yes. Rotating smaller groups works if every analyst attends regularly and results are shared.