Most fraud teams can do it in five to six weeks. Fraud analysts need about 18 hours of learning, two weeks of supervised decisions on the live alert queue and an exam. Alert volume is high, so feedback comes fast. The slower part is unlearning speed: analysts must learn to stop on the drafts that look most convincing.
What makes fraud review its own skill
Fraud alerts arrive fast and need answers in minutes. An agent can read the alert, pull transaction history and device signals, and draft a recommendation: release, block, or contact the customer. The analyst's work moves from building the case to testing it under time pressure.
Two things make that hard. Fraudsters design their behaviour to look normal, so a well-reasoned draft can be wrong. And fraud work rewards throughput, which tempts analysts to approve drafts on sight. Training has to build the habit of checking the one or two facts that decide each case.
Credit analysts face the opposite problem, slow decisions with lots of detail; compare how long it takes to train credit analysts.
How the time breaks down
- Week 1: foundations. About four hours: governance, the decision chain, depth and certification.
- Weeks 1 to 3: operator learning. About 14 hours: how a governed agent decides, human review, teaching the agent, when something goes wrong.
- Weeks 3 to 5: supervised alert review. Real decisions on held alerts, each checked by a senior analyst within the shift.
- Week 5 or 6: exam and sign-off.
Fraud teams often work shifts, so schedule study across the rota rather than in one block.
What the agent does and what stays with the analyst
| The agent may | Stays with the analyst |
|---|---|
| Read alerts, history, device and location signals (depth 1) | Deciding that activity is fraudulent |
| Draft a case note and recommended action (depth 2) | Blocking a card or closing an account |
| Release low-value holds on a pattern it is certified for (depth 3, where earned) | Contacting a customer on a sensitive case |
| Hold anything above the business's limit | Reports to authorities |
Provenance is the core skill. A customer's reply saying "that was me" is declared. The card network's authorisation data is sealed. A merchant's emailed receipt is external. An analyst who knows which of these carries a draft can tell in seconds whether it should be trusted.
Note that reversing a settled payment on the firm's own rail is withheld at the platform floor for every agent. Analysts should know that it is not a setting the business can change.
An illustrative example
Take a card issuer's fraud team of twenty analysts across three shifts. Foundations runs in week one across shifts. Operator learning takes two to three weeks at five to six hours a week, protected on the rota.
In weeks three and four, each analyst reviews held alerts under supervision. Calibration on the same set of alerts, using the method in calibration sessions for fraud analysts, shows several analysts releasing purchases after a text reply from the cardholder, without checking whether the phone number on file had changed in the past week. The agent's draft mentioned the change; the analysts had not read that far. The fix: a written rule and a coaching session, then the exam in week five.
Fraudsters also target analysts directly, with urgent calls or messages planted in documents the agent reads. See training fraud analysts to spot prompt injection and pressure.
What keeps the timeline honest
- One missed red line, such as releasing a purchase to a known compromised device, means no sign-off.
- Night shifts get the same supervision as day shifts.
- If the agent moves to depth 3 for any release pattern, retrain on sampling the record before the move.
KYC analysts follow a similar timeline with different sources; see the KYC analyst timeline. The full programme is in training teams for AI agents.
Questions people ask
Should fraud analysts be measured on speed during training?
No. Measure correct decisions and the quality of decline reasons. Speed returns once judgement is in place.
What if the agent's certificate lapses during a fraud spike?
A run that clears no depth drops it to depth 1, so every alert it would have released comes back to analysts. Plan cover for that, and know the expiry date.
Can analysts learn on historic alerts instead of live ones?
Historic alerts are good practice for calibration. Sign-off should rest on live decisions, because that is where time pressure applies.