Fraud moves faster than 90 days, so the analyst's readiness cannot wait for the certificate date. Use each recertification to reset what the agent may block, contact and refund, and to brief analysts on the patterns that drove the change. Between cycles, analysts feed new patterns back so the next replay tests what criminals are doing now.
What changes for fraud analysts at recertification?
A fraud agent usually triages alerts at depth 1, reading the transaction, device data and account history. It contacts the customer through a secure channel to confirm a transaction at depth 3. It places temporary blocks on cards at depth 3, because a temporary block is easily lifted. Stopping an outbound payment, refunding a customer or closing an account are depth 4 actions, held for a named person.
Recertification re-runs the agent's cases on recent alerts. The stable gate matters more here than almost anywhere, because the replay must include the patterns analysts saw in the last weeks, not only older ones. Typical changes: a new confirmation script, a narrower set of transactions the agent may block without a person, or a new escalation for signs that a customer is being coached by a scammer.
For example, analysts might log a run of cases where customers were persuaded to move money to a "safe account". If those cases go into the replay and the agent confirms such payments without escalating, the agent drops a depth. From then on, its confirmations come to an analyst, who calls the customer.
Some actions never change. Reversing a payment that has settled on the platform's own rail is withheld: refused at the platform floor for every agent at every depth, whatever the certificate says. Analysts should know this so they do not look for a workaround during an urgent case. The mechanics of a cycle are in what recertification is.
Who owns the cycle?
The fraud operations manager owns analyst readiness and the rota. The builder owns recertification. The fraud strategy lead owns the business's own limits, such as the value above which any stop is held. Analysts own the pattern log that feeds the next cycle.
Steps for each cycle
- Person (analysts): keep a pattern log throughout the cycle: new scams, false positives, confirmations that went wrong.
- Agent, depth 1: report the cycle. Alerts triaged, customers contacted, blocks placed and lifted, holds, refusals and escalations, with the deciding bound for each.
- Person (fraud strategy lead): select replay cases from the pattern log so recertification tests current fraud.
- Person (builder): recertify.
- Person (manager and builder): write the change note: block rights, confirmation scripts, held thresholds and new escalation triggers.
- Agent, depth 2: draft practice alerts for each new pattern, checked by the strategy lead.
- Person (manager): brief analysts by shift; each analyst works the practice alerts.
- Person (senior analyst): review held stops and refunds in the first two weeks.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Alert triage | Reads transaction, device and history | 1 | Judging context |
| Customer confirmation | Contacts via secure channel | 3 | Calls with vulnerable customers |
| Temporary card block | Places and records | 3 | Lifting disputed blocks |
| Outbound payment stop | Prepares and holds | 4, held | Approving |
| Refund | Prepares and holds | 4, held | Approving |
| Settled-payment reversal | Withheld at the platform floor | withheld | Recovery through other routes |
What should analysts retrain on?
New patterns. Two or three worked alerts per pattern beat a written description. Analysts should see what the agent saw and what it missed.
Coaching signs. Customers being coached by a scammer often confirm a payment the agent queries. If recertification added an escalation for this, analysts must know to call rather than accept the confirmation.
Provenance in the case. Device and transaction data from the bank's own systems are sealed. What the customer says in the confirmation is declared. A message the customer forwards from the payee is external and proves nothing about the payee.
Held refunds. Read the deciding bound first, check the claim against the transaction data, and record the reason.
Controls and the evidence they leave
- Pattern log feeding replay cases. Evidence: the log and the case list used.
- Change note. Evidence: dated note, agreed by the strategy lead.
- Shift briefings. Evidence: attendance per shift.
- Held stops and refunds approved by named, certified analysts. Evidence: approvals in the append-only record.
- Practicum for new analysts. Evidence: the practicum log template for fraud analysts.
What to measure
False positive blocks per thousand alerts, before and after the cycle. Time from alert to customer contact. Losses on cases where the agent's confirmation was accepted and the payment proved fraudulent. And the time held stops waited for a person, because a stop that waits too long is no stop at all.
Where does readiness slip?
The replay uses old fraud. If the pattern log is not used, the agent passes recertification on yesterday's scams and analysts meet today's unaided.
Analysts rely on the agent's confirmation. A customer saying "yes, that was me" while being coached is the case that costs most. The analyst still owns the judgement, as are fraud analysts accountable for an AI agent's mistakes explains.
Night shifts miss the briefing. Fraud does not keep office hours. Related teams run similar cycles; compare keeping KYC analysts ready and keeping credit analysts ready.
Where the Academy fits
Pryme Intelligence Academy's Operator track includes modules on keeping knowledge current and when something goes wrong, which match the pattern log and held stops. The Certified Pryme Operator practicum is two weeks of real review decisions, at least 95 in every 100 correct with no missed red line, signed off by a Pryme assessor. More in the guide to AI literacy and certification for people who work with agents.
Questions people ask
Can the agent recertify more often than every 90 days?
A business can recertify whenever it chooses; 90 days is when the certificate lapses. After a major new scam pattern, an early replay is sensible.
What happens to temporary blocks if the agent drops to depth 1?
Existing blocks stay. The agent stops placing new ones, and analysts place them by hand until the next successful certification.
Should analysts see the agent's confirmation transcript?
Yes, in full. Tone and hesitation in a customer's reply are often the strongest signal.