Scam reports come in three kinds, and the first job is telling them apart. A scam in progress goes to a specialist at once. A customer who has already lost money or shared details gets protective steps and a specialist. A suspicious message with no harm done is explained and passed to fraud intelligence. The agent never decides reimbursement.
What is the process, and who owns it?
Customers contact firms about scams in very different states. Some are forwarding a suspicious text. Some have just realised they were tricked into paying or sharing a code. Some are still on the phone with a fraudster, being told to move money "to keep it safe". Each needs a different response, and the cost of getting the order wrong is measured in money that leaves an account while the customer waits.
The fraud team owns the response to scams, including account protection, investigation and any reimbursement decision. Fraud intelligence owns patterns and impersonation reports. Support owns first contact. The agent's job is fast, calm triage and protective steps it is certified for, consistent with our guide to the AI support agent that knows when to say no. Whether it can take a full victim report is weighed in can an AI agent handle a scam victim's report?
What are the steps, and at what depth?
- Agent, depth 1: triages in the first exchange. Is anything happening now? Has money moved or have details been shared? Or is this a suspicious message?
- Agent, depth 3: for a scam in progress, says stop. Approved wording: do not move any money, end the other call, and a specialist is joining now. Then it hands over immediately.
- Person, fraud specialist: takes in-progress cases at once, ahead of any queue.
- Agent, depth 3: for losses or shared details, takes protective steps it is certified for, such as freezing a card or signing out other devices, through your existing protective functions. These are cautious and reversible.
- Agent, depth 1: records the facts: what happened, when, amounts and payees as the customer describes them, marked as declared.
- Agent, depth 2: drafts the fraud case for a specialist, who contacts the customer, investigates and decides on recovery attempts and reimbursement.
- Agent, depth 3: for suspicious messages, explains and collects. Whether the message matches known scam patterns, what the firm never asks for, and how to report it. The method is in helping customers check whether a message is a scam. The message is stored as external content.
- Agent, depth 2: groups reports for fraud intelligence, such as a wave of texts impersonating the firm.
- Person, fraud team: decides reimbursement and any account action beyond protection.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Triage | Sorts by urgency | 1 | Nothing |
| In progress | Tells customer to stop, hands over | 3 | Specialist intervenes |
| Protect | Freezes card, signs out devices | 3 | Anything beyond protection |
| Record | Takes the customer's account | 1 | Nothing |
| Case | Drafts fraud case | 2 | Investigation |
| Message check | Explains and stores message | 3 | Nothing |
| Patterns | Groups reports | 2 | Intelligence work |
| Reimburse | Nothing | none | Fraud team decides |
Which controls matter, and what evidence does each leave?
Triage first, details later. Evidence: time from first message to handover for in-progress cases.
Protective steps only. The agent may restrict an account to protect it, not change payees, move money or reverse payments. Evidence: the protective actions taken and refused verdicts for anything else.
No credentials requested. The agent never asks for full passwords, PINs or one-time codes, even to "verify" a victim. Evidence: transcript scans.
Customer accounts are declared. The victim's description is recorded faithfully but not treated as established fact. Evidence: provenance marks on the case.
Reimbursement is a person's decision. Evidence: decisions attributed to named fraud staff.
What should you measure?
- Time to specialist for in-progress scams.
- Protective steps taken and how quickly after first contact.
- Reports by type and channel.
- Impersonation waves detected from grouped reports, and how quickly customers were warned.
- Repeat victims, who may need extra protection and support.
Where does it usually go wrong?
The agent asks too many questions first. Collecting details while money is leaving is the wrong order. Stop, protect, then record.
Victims are made to feel foolish. Shame stops people reporting. Wording should be calm and plain: scams are designed to be convincing.
Angry victims are treated as abusive. Someone who has just lost savings may shout. That is distress, not abuse; handling abusive customers with an AI agent covers the difference.
Customers doubt the agent itself. After a scam, people distrust anyone claiming to be the firm. An agent that clearly says what it is, and never asks for codes, is easier to trust; see customers trust agents that say what they are.
Protective steps are not explained. A frozen card stops the customer paying for shopping that evening. The agent should say what the step does, how long it lasts and how the customer can pay in the meantime, so a protective action does not become a new problem.
Patterns stay in the queue. Individual reports are handled, but nobody sees the wave. Group them, and include trends in management reporting, which can an AI agent produce board reports? touches on.
Questions people ask
Can the agent tell the customer whether they will get their money back?
No. It explains that a specialist will investigate and what the process involves. Reimbursement depends on the facts and the rules that apply, and is decided by the fraud team.
Should the agent block payments to the scammer's account?
It records the payee details for the fraud team, which may contact the receiving bank. Blocking or recalling a payment is a specialist action.
What if the customer is still being coached by the fraudster in the chat?
Signs of coaching, such as the customer insisting the payment is fine or that a "bank investigator" told them to proceed, are themselves a reason to hand over to a specialist at once.