Staff the fraud rota for when fraud happens, which is often evenings, weekends and holidays. Held outgoing payments need a decision in minutes, so every hour the payment channels run needs a trained analyst on duty and a senior on call. Include analysts trained in scam conversations, because a customer may confirm a payment the fraudster told them to make.
What does a fraud rota cover?
A fraud agent scores payments, logins and account changes as they happen. Within its bounds it lets low-risk activity through and blocks the obvious. It holds the uncertain middle: a payment to a new payee that does not fit the customer's pattern, a login from a new device followed by a change of phone number, a card used in two countries an hour apart. Each hold leaves a customer waiting, and every minute matters to them and to the money.
The head of fraud owns the rota. The guide to AI agent skills by role covers what analysts need, what a reviewer rota is explains the basic idea, and what an AI agent reviewer is sets out what the reviewer answers for.
What are the steps?
- Agent, depth 1: reports holds by hour, day and channel. Fraud patterns shift; refresh the analysis monthly.
- Person (head of fraud): sets response targets. Held outgoing payments within minutes; account takeover signals within minutes; card holds within the time customers will tolerate at a till.
- Person (head of fraud): staffs every hour the channels run. Analysts on shift, plus a senior on call who can approve blocks and releases above analysts' authority.
- Agent, depth 2: drafts the case for each hold. Why it scored high, the pattern it broke, the provenance of each signal.
- Agent, depth 3: contacts the customer through a known channel. To confirm or deny, within approved scripts.
- Person (analyst): decides each hold. Release, block, or call the customer for a fuller conversation.
- Person (scam-trained analyst): handles suspected scams. When a customer confirms a payment but the pattern suggests coaching, a trained person talks to them.
- Person (head of fraud): reviews the rota weekly. Against targets, losses and false positives.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Scoring | Scores and passes low-risk activity | 3 | Tuning thresholds through change control |
| Obvious fraud | Blocks within bounds | 3 | Reviewing blocks in sample |
| Uncertain holds | Holds and drafts the case | 2 | Release or block decision |
| Customer contact | Contacts via known channel | 3 | Fuller conversations |
| Suspected scams | Holds even after confirmation | 2 | Scam conversation and decision |
| Release | Releases after a named decision | 4 | The decision that permits it |
Why do scams need their own line?
In most fraud, the customer did not make the payment, and a confirmation call settles it. In a scam, the customer did make it, believing a fraudster's story. They will confirm. Some will have been told to expect the call and what to say. An analyst who releases on confirmation alone loses the customer's money with the customer's consent.
So the rota names analysts trained to have that conversation, on every shift where payments run. The agent can hold a payment despite confirmation when the pattern fits a known scam, and the verdict records why. The decision to release stays with the trained analyst. The AI agent competency matrix for the fraud team shows who has that skill.
Which controls matter, and what evidence do they leave?
- Every hour is staffed. Evidence: the rota against payment channel hours.
- Customer contact uses known channels. A phone number given in the payment instruction is external evidence. Evidence: the channel used, recorded on the case.
- Releases name the analyst. Evidence: the release verdict with name and reason.
- Scam holds are decided by trained people. Evidence: the analyst's training record matched to scam case decisions.
- Blocks are sampled. Evidence: weekly review of a sample of blocks for false positives.
What should be measured?
- Response time on held payments by hour of day; the night hours tell you most.
- Fraud losses on released holds, by analyst and hour.
- False positives: genuine activity blocked or held.
- Scam payments released after confirmation and later reported as scams.
- Senior call-outs and time to answer.
Where does it usually go wrong?
Office hours only. Fraudsters know when banks are short-staffed. A rota built for nine to five leaves the worst hours uncovered.
Confirmation is treated as proof. Already covered; it is the single most expensive habit in a fraud team.
Tuning by the rota. When holds outrun staff, teams lower thresholds to cut volume. That is a change to the agent's bounds and needs evidence, not a staffing decision.
Compliance and IT teams run similar always-on queues; compare the rotas for the compliance team and the IT team.
Where the Academy fits
Fraud analysts deciding an agent's holds are the reviewers the Academy's Operator track is built for. Its practicum asks for two weeks of real review decisions with no missed red line, and releasing a coached scam payment is the clearest red line in fraud. Tests are set in the learner's industry and role, and the certificate is valid for 12 months.
Questions people ask
Should fraud and compliance share an overnight rota?
They can share people if each person is trained for both queues. Keep the lines separate on the rota, because response targets and escalation routes differ.
How should a held payment be handled if the customer cannot be reached?
It stays held until they can, unless policy sets a different course. Tell the customer, through a known channel, how to reach the team.
Can the agent call customers at night?
Within the contact rules the organisation sets. If it does, the rota must have someone ready to take the conversation when the customer calls back.