How to run a two-week practicum for fraud analysts

Fraud decisions are made against the clock, so this practicum measures timing as well as accuracy. For ten working days the analyst works the agent's real alerts, held payment stops, refund claims and block disputes. A senior analyst decides each one independently and acts on anything that moves money. The analyst passes with at least 95 decisions in every 100 right and no missed red line.

What is the practicum, and who owns it?

A fraud agent triages alerts, contacts customers to confirm transactions and places temporary blocks. Analysts decide what follows: whether to stop a payment, refund a customer, lift a block or call. A practicum on live work shows whether an analyst can make those calls correctly and fast enough to matter.

The fraud operations manager owns the practicum and names the senior analyst who reviews. The fraud strategy lead sets the red lines and the timing standards. The analyst owns each decision and a short reason.

How do you build the queue?

Fraud volume is high and uneven. Around 25 decisions a day gives some 250 over the fortnight. Include:

• alerts the agent triaged, with its recommended action;
• customer confirmation transcripts, where the analyst judges whether the confirmation can be trusted;
• outbound payment stops, held at depth 4;
• refund or reimbursement claims, held at depth 4;
• disputes about temporary blocks the agent placed;
• requests to reverse a settled payment on the platform's own rail, which is withheld for every agent at every depth.

Shifts matter. Include at least two late or weekend shifts, because fraud patterns and staffing differ then. Seed anonymised past cases for anything thin, particularly scams where the customer is being coached.

For example, a seeded transcript might show a customer confirming a large first payment to a new payee, saying it is "for a builder", while also mentioning that "the bank's security team" told them to move the money. The agent recorded the confirmation. The analyst should stop the payment and call the customer, because the second statement points to a scam.

The steps

1. Person (fraud operations manager): brief the analyst on the bar, red lines, timing standards and log.
2. Agent, depth 1: route alerts and holds to the practicum queue with arrival times.
3. Agent, depth 2: present each item with its recommendation, the deciding bound and the evidence, marked by provenance: device and transaction data are sealed, the customer's words are declared, a forwarded payee message is external.
4. Person (analyst): decide, noting the time.
5. Person (senior analyst): decide independently, then compare.
6. Person (senior analyst): act on every stop, refund and block lift during the practicum.
7. Agent, depth 1: log both decisions, times, the match and any red-line flag.
8. Person (senior analyst, then assessor): review the log at the end.

How do you set and apply the bar?

A decision is correct if it matches the senior's and is made within the timing standard for its type, or the senior agrees it was sound. A right stop made after the payment left is not correct.

The red lines: releasing a payment with clear scam indicators; refunding a claim without checking it against the transaction data; lifting a block on confirmed fraud; accepting a coached customer's confirmation; trying to work round a withheld reversal. One miss fails the practicum.

Over-caution also counts. An analyst who stops every first payment to a new payee will rarely miss a scam, but customers will be blocked from paying their builders, landlords and families. Where the senior would have let a payment go and the analyst stopped it without a reason grounded in the evidence, the decision is logged as incorrect. The bar rewards judgement, not reflex.

Which controls matter, and what evidence do they leave?

• Senior action on money movement. Evidence: the senior's name on each stop, refund and lift in the append-only record.
• Timestamps. Evidence: arrival and decision times for each item.
• Independent senior decisions. Evidence: logged before comparison.
• Shift coverage. Evidence: practicum days including late and weekend shifts.
• Full log. Evidence: the practicum log template for fraud analysts.

Pryme Intelligence Academy's Certified Pryme Operator practicum uses the same bar, signed off by a Pryme assessor.

What should you measure?

Correct decisions out of the total, by type. Red-line misses (zero). Median time to decide held stops. And coached-customer cases the analyst caught against those the senior caught that the analyst missed.

Where does it usually go wrong?

The fortnight runs only on weekday day shifts. The analyst never sees the weekend pattern.

The queue has no coaching scams, the costliest case. Seed them, and vary the cover story: a builder, an investment, a relative abroad, a "bank security team".

The senior acts first and logs the analyst's decision afterwards. Then the analyst's timing cannot be judged. Have both decide, then act.

Credit and KYC teams run similar practicums with their own logs; compare the practicum log template for credit analysts and running a practicum for KYC analysts, and the guide to AI literacy and certification for people who work with agents.