Can an AI agent run a fraud investigation?

It can run the groundwork, not the conclusion. An AI agent can build the timeline, pull device and session data, trace where money went, check payees for mule indicators and draft the case. Deciding whether fraud occurred, who bears the loss, what happens to accounts and whether to involve the police stay with a fraud investigator.

What does a fraud investigation have to answer?

A fraud case usually starts with a customer reporting a payment they did not make, or a payment they made because they were deceived. The investigation must answer three questions. What happened? Was the customer the victim, a participant or careless? And who bears the loss?

Each answer has consequences. Reimbursement rules in many markets depend on whether a payment was authorised and whether the customer acted with gross negligence. Getting the finding wrong means either refusing a genuine victim or paying out to someone who staged the fraud. The decision therefore needs a person who can weigh the evidence and stand behind the outcome.

What may the agent prepare?

The agent may:

• Take the customer's account of what happened, if they reported through a channel the agent handles; see can an AI agent take a fraud report from a customer?
• Build the timeline: logins, device changes, payee additions, authentication events, payments and contacts with the bank.
• Compare the session data with the customer's normal pattern: device, location, typing behaviour, time of day.
• Check the receiving accounts: whether they are known mule accounts, newly opened, or linked to other reports.
• Request recall of funds from receiving institutions under the scheme's process, where that is routine and time-critical.
• Pull earlier warnings shown to the customer, and what the customer did.
• Draft the case in your investigation template, with evidence for and against each possible finding. The payment investigation case template is a good model.

The investigator decides:

• Whether the payment was authorised.
• Whether the customer was a victim, and of what kind of fraud.
• Reimbursement, partial reimbursement or refusal, applying the rules that apply.
• Restrictions on the customer's account or on payee accounts held at the bank.
• Referral to the police and reporting.

What does an investigation look like?

Take a retail bank. A customer reports three payments totalling 9,000 to a "safe account", after a call from someone claiming to be from the bank's fraud team.

The agent builds the timeline. The payments were made from the customer's usual phone, at home, after a successful login, so they were authorised by the customer. A new payee was added minutes before the first payment, and the bank's confirmation-of-payee check returned "no match", which the customer overrode. The bank displayed a scam warning, which the customer dismissed. The receiving account was opened at another bank a week earlier and has been named in four other reports. The agent requested recall of funds within minutes of the report; the receiving bank recovered 2,000.

The draft sets out both sides: the customer authorised the payments and overrode warnings, but was manipulated by a convincing impersonation that used the bank's real number. The investigator finds the customer was a victim of authorised push payment fraud, considers the warnings against the impersonation's sophistication, and decides on reimbursement under the bank's policy. The agent records the decision and notifies the customer using the approved letter.

Which controls make agent investigation safe?

• Time-critical steps are pre-approved. Recall requests and protective holds can be certified as routine because they protect the customer and are reversible.
• Findings are a person's. No reimbursement decision or refusal is made by the agent.
• Both readings in every draft. The agent lays out evidence for and against.
• The agent's own record is exportable. If the case goes to an ombudsman, a court or the police, the investigator can produce exactly what the agent found and did; see how to export an AI agent's verdict record for an investigation.
• Business fraud has its own patterns. Payments diverted by fake supplier bank details follow a different path; see what invoice fraud is.

The general principle is in our guide to AI compliance agents.

Where Pryme fits

In Pryme, requesting a recall can be certified at routine depth because it protects the customer; reimbursement, refusal and account restrictions are held for a named investigator. The payee's details arrive with their provenance, so the case shows which facts came from the bank's own ledger and which came from the customer's account of events.