No. A payment held for fraud checks should not be released by any AI agent, at any depth, however certain the agent seems. The agent can contact the customer, ask the bank's questions, summarise the alert, and cancel the payment if the customer wants. The decision to let the money go belongs to a named fraud analyst.
Why make this a hard line rather than a limit?
Most banking actions get safer for an agent as evidence builds: certify it, bound it, let it act. Fraud releases are different, for three reasons.
First, the hold exists because something already looked wrong. The fraud model or rule saw a pattern, and the question now is whether the customer is being deceived. That is a judgement about a person's state of mind, not a fact the agent can look up.
Second, the customer may be coached. In an authorised push payment scam, the fraudster often prepares the victim for the bank's questions: "they'll ask if anyone told you to do this; say no." An agent asking scripted questions is exactly what the fraudster has rehearsed against. A trained analyst who hears hesitation, or asks something unexpected, is harder to fool.
Third, release is usually final. Once an instant payment leaves, it is gone in seconds. So this is one of the actions that should be withheld for every agent, not left to each bank's settings. Many banks already treat it this way.
What may the agent do?
- Tell the customer the payment is held, in approved wording, without suggesting the bank thinks they are foolish.
- Ask the bank's set questions about the payee, how they met, who gave them the details, and whether anyone is advising them.
- Record the answers verbatim, at depth 2, for the analyst.
- Summarise the alert: the trigger, the payee's history, the customer's usual patterns, and any matches with known scam types.
- Cancel the payment if the customer decides not to go ahead. Cancellation is protective and reversible: the customer can make the payment again later.
- Give scam warnings that match what the customer described.
- Tell the customer when they will hear from the fraud team.
What stays with a person, and why?
| Decision | Who | Why |
|---|---|---|
| Releasing the payment | Fraud analyst | Final, and depends on judging the customer's state of mind |
| Calling the customer back | Fraud analyst | Coached customers need questions they did not expect |
| Refusing the payment outright | Fraud analyst, under policy | A significant step that needs reasons |
| Restricting the account further | Fraud analyst | Affects the customer beyond this payment |
| Reporting the payee account | Fraud team | Involves another bank and possibly authorities |
The principle behind this split is set out in agents prepare payments and people release them.
An example: a held payment for a new car
Take a customer whose payment of 9,000 to a new payee is held. The reference says "car deposit". The agent messages the customer, says the payment needs a check, and asks the bank's questions. The customer answers each quickly: they found the car online, they have seen it, the seller is a private individual, nobody is advising them, and they want the payment released now.
The answers are complete and consistent. The agent does not release. It records the answers, notes that the fraud system shows the receiving account has taken several similar payments from different customers this week, and sends the case to an analyst as priority. The analyst calls the customer and asks whether they have seen the car in person or only in a video call. The customer admits it was a video. The analyst explains the scam pattern, and the customer cancels.
The agent's questions alone would not have stopped this payment.
What controls make it safe?
- The release capability is withheld. No agent holds it, at any depth, and any attempt is filed as a withheld verdict.
- Cancellation separated from release. The agent can stop money but not send it.
- Questions from the fraud team's script. The agent's questions are set and versioned, so analysts know what was asked.
- Analyst queues with time targets. Held payments are reviewed quickly, so customers are not left waiting.
- The analyst's decision filed against the agent's summary, so the record shows who released and why.
Payments that are prepared rather than held follow a different path; see preparing bank payment files for release with an AI agent and the high-value payment release checklist. The general limits are in AI agents in banking: what they may and may not do.
Questions people ask
Isn't this slower for genuine customers?
Somewhat, and banks should keep review times short. A delay of an hour on a genuine payment costs far less than releasing a scam payment that cannot be recovered.
Can the agent release a payment held by the customer's own limits?
That is a different hold. If the payment exceeds a limit the customer set, the customer can change the limit through the authenticated app, and the payment then follows the normal checks.
What if the customer complains about the hold?
The agent records the complaint and explains the process. The hold stays until the analyst decides.