Fast, but not on the agent's word alone. A fraud analyst handling a held action reads the signals that made the agent stop, confirms them in the firm's own systems, verifies the customer through a channel on file, and weighs whether they are being manipulated. Only then do they release, amend or block, with a reason.
What does a fraud agent hold?
Fraud agents in payments and e-commerce typically score transactions and sessions at depth 1, draft cases and customer messages at depth 2, and may block clearly fraudulent card transactions at depth 3. The decisions that need a person are held:
- Releasing a held payment that scored as risky.
- Confirming fraud and closing a card or account.
- Unblocking after a customer says a transaction was genuine.
- Refunding a customer who reports unauthorised activity.
- Contacting the customer in a way that discloses the concern.
- Linking accounts into a fraud ring for wider action.
Time matters in a way it does not for most holds. A held payment may be a customer paying rent; a released one may be money leaving to a scammer. Both kinds of error hurt.
What should the analyst check?
The signals and their source. Device changes, new payees, unusual amounts, location mismatches and session behaviour come from the firm's own systems and are sealed. A merchant's or counterparty's information may be signed. A customer's explanation is declared. A tip from an email is external.
The customer, through a known channel. Call the number on file or use in-app verification. Never use contact details supplied in the session that triggered the hold.
Scam indicators. A customer who confirms "yes, that was me" may still be under the instruction of a scammer, especially for push payments to new payees. Questions about why they are paying, who asked, and whether anyone told them to mislead the bank matter more than a simple confirmation.
The agent's limits. The record names the deciding bound. A hold on the firm's own limits for new payees above an amount is a policy hold. A hold because a device-intelligence source was unavailable means the agent lacked data; the analyst should not assume the transaction is clean.
How should the analyst decide?
| Held action | Release or approve when | Amend when | Block or decline when |
|---|---|---|---|
| Risky payment | Customer verified through known channel, no scam indicators | Reduce the amount or delay pending checks | Scam indicators present or verification fails |
| Confirm fraud | Signals are consistent and customer denies the activity | Scope the block to one card, not all accounts | Evidence is weak; keep monitoring |
| Unblock | Verification passes and signals are explained | Unblock with tighter limits for a period | The explanation does not fit the signals |
| Refund | Claim fits the evidence and policy | Partial refund on evidence | Evidence contradicts the claim |
Every decision carries a reason naming the signal and the verification.
An example: a confirmed payment that was a scam
Take a payments firm. The agent holds a large transfer to a new payee described as "investment". The customer is verified in-app and confirms the payment is genuine. On the record, the analyst sees that the customer added the payee 20 minutes earlier during a long call on their registered number, and the app shows screen-sharing was active.
The analyst calls the customer on the number on file and asks who suggested the investment. The customer mentions someone they met online who "helped set up the account". The analyst declines the release with the reason "Indicators of an authorised push payment scam; customer under third-party instruction", and offers support. Verification alone would have released it. Local practice is in AI agent training for fraud analysts in payments in Ireland.
Which controls keep fraud decisions sound?
- Releases above set amounts are held for a person.
- Verification always uses channels already on file.
- Scam questions are part of the release script for new payees.
- Analysts' releases are sampled daily.
- Approval rights depend on current training.
The concept of a held action is defined separately. Neighbouring roles handle holds differently; see how KYC analysts handle an action an AI agent has held and how credit analysts do. The role map is in AI agent skills by role.
Where the Academy fits
Pryme Intelligence Academy's Operator track trains fraud analysts on the real product to read the decision chain, judge provenance and decline with a reason. Module tests are set in the learner's own industry and role. The practicum is two weeks of real review decisions in which a single missed red line, such as releasing a payment with clear scam indicators, fails the candidate.
Questions people ask
How quickly should analysts clear held payments?
Fast enough that genuine customers are not harmed, and no faster than checks allow. Set time standards by payment type and staff the queue to meet them.
Can the agent block cards on its own?
Many firms allow it at depth 3 for high-confidence fraud, because blocking is easy to reverse. Releasing money is held because it is not.
What if a customer insists after a declined release?
Explain the concern, offer time and support, and escalate within policy. Record the conversation and the final decision.