Let the agent protect quickly and make people release carefully. A temporary block on a suspicious payment is reversible and can run at depth 3. Releasing that payment, refunding a fraud claim or closing an account is held for a fraud analyst, with a senior analyst above a set amount. Approval rights expire with the analyst's certificate.
What is different about a fraud team's approver rule, and who owns it?
Most approver rules hold the risky action and allow the safe one. In fraud, the protective action is usually the safe one: pausing a payment or blocking a card can be undone. The risky action is letting money go, because once a scam payment leaves it is often gone. So the rule runs the other way from many teams: the agent may stop things fast; people decide when to let them go.
The head of fraud owns the rule. Operational risk signs it off. The agent owner configures it. Our explainer on what an agent approver is sets out the approver's role, and our guide to AI agent skills by role covers what fraud analysts need to know.
What are the steps?
- Head of fraud: lists the agent's actions by depth. Depth 1: reads transactions, device and session signals, and payee history. Depth 2: drafts customer contact scripts and case notes. Depth 3: pauses a payment, places a temporary card block, sends a verification message to a channel on file. Depth 4: releases a paused payment, refunds a fraud claim, closes a card or account.
- Head of fraud: allows protective actions at depth 3 where certified, with a time limit after which a person must review.
- Head of fraud: assigns releases to analysts below a set amount, after a verified contact with the customer; senior analysts above it.
- Head of fraud: assigns fraud claim refunds to claims analysts, with a second approver above a set amount.
- Head of fraud: ties each role to a current certificate.
- Agent owner: configures and files the rule.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Score activity | Reads signals and history | 1 | Nothing |
| Pause payment | Pauses and notifies | 3 | Review within time limit |
| Verify customer | Messages a channel on file | 3 | Nothing within templates |
| Release payment | Prepares and holds | 4 | Analyst; senior above set amount |
| Refund claim | Prepares and holds | 4 | Claims analyst; second above set amount |
| Close account | Prepares and holds | 4 | Senior analyst |
Why must the release decision follow a verified contact?
The typical scam involves a customer who has been persuaded to pay. When the payment is paused, the customer may call in insisting it is genuine, sometimes coached by the fraudster. The customer's statement is declared, and in a scam it is the least reliable fact in the case.
So the rule asks the analyst to have a real conversation with the customer through a channel on file, ask the right questions, and release only when satisfied. The agent can prepare the questions and the case summary, but it cannot release. Some payments will be released after the customer insists against advice; the record should show the warning given and the analyst's decision.
Reversing a payment that has already settled is a different matter. On some rails that action is withheld at the platform floor for every agent, and a person handles any recall through the normal process.
Which controls make the rule work, and what evidence do they leave?
Protective actions time-limited. Evidence: paused payments with review deadlines and the reviewer's name.
Releases follow verified contact. Evidence: the contact record and channel on each released payment.
Second approver on large refunds. Evidence: two named approvers on each refund above the threshold, in line with the approver authority matrix for the fraud team.
Payee details from sealed or signed sources. A new payee added by email is external. Evidence: provenance stamps on the payment.
Rights lapse with certificates. Evidence: certificate status on each release date.
What should you measure?
- Fraud losses on released payments, as the outcome that matters.
- Genuine payments paused, and how long customers waited.
- Releases without a recorded contact. The target is none.
- Pauses that passed their review deadline.
- Analyst coverage overnight and at weekends, when scams often peak.
Where does it usually go wrong?
Pause limits are too wide. The agent pauses so many genuine payments that analysts release in bulk. Tune the agent through its owner, not by rubber-stamping, and re-certify after any change to its pause rules.
Customer pressure wins. An analyst releases because the customer is angry. Support the analyst with a script and a senior to escalate to, and make clear that a careful hold is never a mark against them.
Support teams release payments. A customer calls the general line and a support adviser lifts the block. Compare the approver rule for the support team: support should hand fraud cases over, not decide them.
Operations and IT rules are copied. Compare the approver rule for the operations team and the approver authority matrix for the IT team; neither deals with time-critical, adversarial cases.
Where the Academy fits
Pryme Intelligence Academy's Operator track trains the analysts who decide on held actions, including human review and when something goes wrong. Module tests are set in the learner's own industry and role. A fraud team can make release rights depend on a current Certified Pryme Operator certificate and see expiry dates in the admin view.
Questions people ask
Should the agent ever release a paused payment?
Not on its own. It can recommend release where the evidence is clear, but a person decides, because a wrong release is usually unrecoverable.
How long can a payment stay paused?
Set a time limit in your rules and staff to it. Long pauses harm genuine customers and may breach your own service commitments.
Who reviews the agent's pause rules?
The head of fraud with the agent owner, using the record of pauses, releases and confirmed frauds. Any change goes through re-certification if it alters depth or bounds.