Fraud analysts at Spanish payment institutions should learn to supervise AI agents that triage alerts on instant and mobile payments, warn payers about payee mismatches and link scam cases, and to log their decisions during a supervised practicum. Blocks and refunds stay with people. Banco de España, the AEPD, PSD2, the Instant Payments Regulation and DORA set the frame.
What does a payments fraud analyst in Spain handle?
Smishing and vishing lead the caseload. Fraudsters send SMS messages that appear in the same thread as genuine messages from the customer's bank, then call from a spoofed number to "help" the customer cancel a supposed fraudulent payment, which in fact authorises one. Because the customer authenticates the payment, strong authentication does not stop it.
Mobile instant payments between bank customers are popular for everyday transfers, and fraudsters use them in second-hand marketplace scams and fake rental deposits. Analysts at payment institutions and banks review alerts, contact customers, handle refund requests and recall requests from other institutions, and trace mule accounts. Card fraud at acquired merchants and card-not-present fraud for issuers continue alongside, with heavy international card volume from tourism.
What changes when AI agents work the fraud queue?
- Alert triage (depth 2). The agent gathers account, device, beneficiary and recent call or SMS indicators and drafts a recommendation.
- Payee mismatch warnings (depth 3). Where a payee name check fails, the agent warns the payer in approved wording and pauses the transfer for confirmation.
- Spoofing indicators (depth 2). The agent flags payments made shortly after an inbound call that matches known spoofing patterns.
- Recall packs (depth 2). The agent assembles evidence for recall requests to and from other institutions.
- Account blocks and fund releases (depth 4, held). The agent prepares; a named analyst decides.
A settled payment on the firm's own rail cannot be reversed by any agent: that action is withheld at the platform floor. Analysts should know a recall is the route. The full map is in AI agent skills by role, and our ranking of which AI agent skills matter most for fraud analysts shows where to start.
What must analysts learn, and what stays with them?
Supervised practice. New analysts and those moving to agent review should spend a fortnight deciding real held items under supervision, logging each decision and its reason. The practicum log template for fraud analysts gives the fields.
Who may approve. Release rights should be tied to role and certification, enforced in the system. Our guide on how to set an approver rule for the fraud team explains how.
Evidence classes. A payee name check is sealed. A customer's description of the call is declared. A screenshot of an SMS is external. A release should never rest on external evidence.
Verdicts and lapses. Each verdict names the bound that decided it. The agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day, so triage may return to people with no notice.
What stays with analysts: blocks, releases, refunds to scam victims, mule account actions and suspicious transaction reporting. The job changes shape; our piece on whether AI agents will replace fraud analysts explains why it remains, and why fraud analysts are the real control sets out the principle.
Which rules shape oversight and literacy in Spain?
Banco de España licenses and supervises Spanish banks, payment institutions and e-money issuers. Under PSD2, most electronic payments need strong customer authentication; under the EU Instant Payments Regulation, the sending provider must check the payee's name before an instant transfer goes. DORA has applied since 17 January 2025 and brings ICT risk, incident reporting, testing and third-party oversight to any agent wired into payment systems. Anti-money-laundering duties track the FATF Recommendations, and the EU AML Authority is being set up in Frankfurt.
GDPR governs customer data, and the AEPD is the supervisory authority. Article 22 restricts solely automated decisions with significant effects, which covers automatic blocks. The EU AI Act applies directly: Article 4 requires AI literacy among staff, Article 50 requires people to be told when they interact with an AI system, and fraud detection is carved out of the credit-scoring high-risk category. Spain has set up a national agency to supervise AI. Card businesses must meet PCI DSS v4.0.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day training plan look like?
Weeks 1 to 4. Every analyst completes foundations training, recorded as Article 4 evidence. The agent triages alerts in shadow, with smishing cases tagged so the team can see how well it spots them.
Weeks 5 to 8. Certify payee mismatch warnings at depth 3. New and moving analysts complete a logged two-week practicum on held items. Set the approver rule.
Weeks 9 to 13. Senior analysts complete operator-level certification and become the only people who release held funds. Pryme Intelligence Academy's Operator practicum follows the same shape, two weeks of real review decisions signed off by a Pryme assessor, so internal and external evidence align.
Questions people ask
Can the agent tell a customer their bank did not call them?
It can state what the bank's records show and give approved guidance. A live conversation with a customer who may be under a fraudster's influence stays with a person.
How long should a supervised practicum run?
Two weeks of real decisions gives enough variety to judge an analyst's consistency. Log every decision with its reason.
What happens to held payments if the agent's certificate lapses?
Holds already raised stay with analysts. New triage drops back to people until the agent recertifies.