APP fraud detection that names the scam, asks the questions for it and keeps every answer for the claim
Scam payments stopped mid-call, with every question and answer kept for the claim.
See one case, screen by screen ↓APP fraud detection means finding the payments a customer is being tricked into sending, authorized push payment scams, and stepping in before the money leaves. APP Fraud Detection gives the fraud prevention colleague seven agents that name the likely scam with its sources, write the questions for that scam, flag coached answers on the call and keep a claim-ready record. The colleague decides to hold, release or refer.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
In an authorized push payment (APP) scam the customer sends the money themselves. A caller posing as the bank's fraud team, a romance or a fake investment talks them into it, so every login and device check passes. The fraud detection engine holds the payment with a score, and the colleague who must call the customer gets a score, not a reason. A generic warning (“Could this be a scam?”) is exactly what the scammer coached the customer to click through.
Since October 7, 2024, UK payment firms must reimburse in-scope APP scam victims up to £85,000 within five business days, the sending and receiving firms sharing the cost. The bank can rely on the consumer standard of caution only if it shows a specific, directed intervention the customer ignored, and free-text call notes rarely show that. A held payment also runs on two clocks: a notice to the customer by the end of D+1 and a decision by the end of D+4.
Estimated split of one scam intervention's working minutes, by hand and with the agents — our estimate, kept modest. The call itself takes about as long either way.
Seven agents name the scam, write the questions for it, listen for coaching and keep the record; the colleague decides and a team leader checks.
At 10:42 on Thursday, October 22, 2026, Corvane Bank UK holds a £14,300.00 Faster Payment from Eileen Marsh, 71, to a new payee. Here is what happens next, screen by screen, in the working solution.
Hannah's start page shows 23 interventions open with 7 calls due within 30 minutes, 4 waiting for a team leader, and one hold that ends today, Margaret Doyle's, already escalated. Since 07:00 the agents have named the likely scam on each held payment: Eileen Marsh, £14,300.00, safe-account impersonation at 91%.
What the agents found: “Gordon Haines: Confirmation of Payee unavailable, treated as unknown.”
All 23 open interventions sit in one list, most urgent first: the payment, the payee check, the likely scam with its confidence, when it was held and the next clock (call within 30 minutes, notice by D+1, decide by D+4). Filters split the scams: five safe-account impersonations, five purchase scams, four investment scams. Bulk actions assign, send approved notices and escalate, but never release a high-risk payment.
Eileen, a customer since 1988, moved £12,000 from her Easy Saver 11 minutes before sending £14,300.00 to a new payee, “E Marsh” at Halvard Bank: 86% of her available balance and her largest payment in 7 years. Confirmation of Payee said no match. The payee account was opened 9 days ago and received 6 payments from 6 different banks in 48 hours. Nine weighted signals, each with a Source button, add up to safe-account impersonation at 91%, against investment scam 4% and purchase scam 3%.
What the agents may not do: hold or release a payment, contact the customer, or name a scam below 0.70 (they say “unclear”).
The strongest signal is Eileen's own call to the card line that morning. Clicking it opens the transcript, reference CC-5520418, line 14: “Someone from your fraud team is helping me.” Telephony records show no call from Corvane to her in 30 days.
“Opened by Hannah Okafor. Every source you open is on the record.”
The script agent builds the call from the approved safe-account script, v3.2: five questions in plain words, not a generic warning. When Eileen answers Q1 with “No, nobody,” the listening agent notes it contradicts her card-line call, and Q2 is rewritten to ask whose name the new account is in. At 03:12, Q3 brings “the man said if the bank asked, I should say it was for a kitchen”, flagged as a coached cover story at confidence 0.96. Q4 and Q5 add two more flags: told not to tell the bank, and a caller who will ring back at eleven.
“The agents propose: hold (H2, coached answers) and refer to the vulnerable customer team. You decide.”
Hannah holds the payment until the end of Wednesday, October 28 (D+4), with the delay notice due by the end of Friday, October 23 (D+1), under reason code H2: customer answers match a coached cover story. In the same step she refers Eileen to the vulnerable customer team and proposes a 7-day block on new payees in the app, which needs a team leader's approval.
Note for the record: “Coached cover story (Q3), told not to tell the bank (Q4), caller to ring back at 11:00 (Q5). Warning W-SA-1 read and acknowledged.”
Daniel's checker queue holds five requests: Eileen's new-payee block, a £3,900.00 release to Northgate Motors Ltd, a £1,250.00 release, a free-text notice and another block. Each shows what it rests on; for Eileen, the caller expects to ring back at 11:00 and may ask her to try again. He approves the block. A release of a payment scored 800 or more always comes to a team leader, and the person who requested it can never approve it.
“Account protection measures need a team leader.”
Ruth calls Eileen back. The vulnerability agent shows what it saw, by the FCA's drivers of vulnerability: a bereavement in April, living alone, pressure from a caller who coached her answers. Ruth records it only after Eileen agrees, adds her daughter Claire Marsh as a trusted contact and books a visit to the Kingsbridge branch on Friday, October 23, at 10:30. The payment stays held until then.
Consent: “Eileen agreed that we record this and use it to support her.”
The notice agent drafts the letter at 11:26: the payment is paused, why, what the bank needs and the latest date, the end of Wednesday, October 28, 2026. It names the branch visit and says her daughter Claire is welcome. Its checks pass (reading age 8, no internal referral or report mentioned, no request for security details), Daniel checks it, and it goes by app message and large-print letter at 11:31.
From the notice: “Corvane will never ask you to do that.”
Every step by people and agents is on an append-only record with its evidence. The record agent maps the intervention to the consumer standard of caution (the warning read and acknowledged, five of five requests for information answered, consent to a police report asked at the branch visit) and shows the Consumer Duty outcome: payment held before it left, notice at reading age 8, branch visit booked. Eileen keeps her £14,300.00.
A confidential financial crime referral is visible only to the fraud team, the financial crime team and audit, never on a customer view.
The same held payment, seen by the five people who carry it: what their day looked like, and what it looks like now.
Seven agents name the scam, write the questions for it, listen for coaching and keep the record; the colleague decides and a team leader checks.
Reads the held payment and gathers the signals: the Confirmation of Payee result, the payee account's behavior, the app session, the account history and the customer's own contacts with the bank.
Names the likely scam type with a confidence and the alternatives, each signal cited.
Writes the questions for the named scam from the approved script library, in plain words, and adapts the next question to the last answer.
Follows the recorded call or typed answers and flags coached answers, secrecy, urgency, a caller who will ring back and contradictions with the bank's records, each tied to the second of the call.
Spots possible vulnerability (life events, health, resilience, capability) and proposes a referral to the vulnerable customer team.
Drafts the D+1 delay notice and the visit letter, and checks the required content and that no internal referral is mentioned.
Builds the intervention record as the call happens, maps it to the consumer standard of caution and Consumer Duty, and prepares the claims hand-off and the export.
Decide, check, support. The agents propose; a named person decides.
During the intervention the colleague can ask about the case in plain words. Every answer cites its source: the card-line call, the payee check, the rule.
Why safe-account impersonation?
Three signals point to it together: she told the card line “someone from your fraud team is helping me”, Corvane has not called her in 30 days, and the payee name does not match the account. The payee account is 9 days old and pays money on within minutes.
What if she insists?
You can hold the payment until the end of Wed 28 Oct and must tell her why by the end of Fri 23 Oct. The score is 912, so a release would need Daniel Whitcombe. If she later claims, the record shows the warning you gave.
Is she vulnerable?
Possibly: a bereavement was noted in May with her consent, she lives alone and she is under pressure from a caller. Only a specialist records vulnerability, with her consent. I propose a referral to Ruth Calloway.
12 screens from the working solution, on its sample data. Pick one to see it large.
Every change is proposed by the administrator, approved by the Head of Fraud Strategy, versioned and on the record. Detection thresholds also need the model risk approver.
| Setting | Default | Choose from |
|---|---|---|
| Intervention score | 700 | Up or down in steps of 10; payments at or above it are held for an intervention |
| Release needs a team leader | Score of 800 or more | Up or down in steps of 10 |
| Typology confidence floor | 0.70 | Steps of 0.05; below it the agent says “unclear” and the general script is used |
| Listening flag | 0.80 | Steps of 0.05: the confidence needed to flag an answer as coached |
| Call the customer within | 30 minutes of the hold | Steps of 5 minutes |
| Escalate before D+4 ends | 4 hours | Steps of 1 hour |
| Delay notice and maximum hold | Notice by the end of D+1, decision by the end of D+4 | Fixed by rule (SI 2024/1013) |
| Reason codes | H1–H4 hold · R1–R3 release · V1–V2 refer · O1 override | Required on every decision and override |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “typical” = published figures (UK Finance Annual Fraud Report 2025: £450.7 million lost to APP scams in the UK in 2024, about 186,000 cases; PSR Specific Direction 19: reimbursement up to £85,000 within five business days, cost shared 50:50; FTC, top scams of 2024: $2.09 billion reported lost by bank transfer or payment) · “estimated” = our estimate · Delay limits: The Payment Services (Amendment) Regulations 2024 (SI 2024/1013) and FCA FG24/6 · Vulnerability: FCA FG21/1 · Consumer standard of caution: PSR guidance, December 2023. Corvane Bank UK, its customers, payees and the people named on this page are fictional — characters and sample data in the working solution.
APP fraud detection means finding the payments a customer is being tricked into sending, authorized push payment scams, and stepping in before the money leaves. APP Fraud Detection gives the fraud prevention colleague seven agents that name the likely scam with its sources, write the questions for that scam, flag coached answers on the call and keep a claim-ready record. The colleague decides to hold, release or refer.
It looks at the context, not the login. The payment signals agent gathers the Confirmation of Payee result, the payee account's behavior, the app session, the account history and the customer's own contacts with the bank. On the sample case, nine signals, including her card-line call that morning and no call from the bank in 30 days, point to safe-account impersonation at 91%, each opening its source.
Coached answers, secrecy, urgency, a caller who will ring back and contradictions with the bank's records, each tied to the second of the call it came from. It flags; it never decides. If the telephony feed is down, the colleague types the answers and the agent works on the typed text.
Every question, answer, warning and decision goes on an append-only record mapped to the parts of the consumer standard of caution and to the Consumer Duty outcome. A claims handler then decides on what was said, not on a free-text note. When a released payment later turns out to be a scam, the case is handed to the APP reimbursement claims team with the full record.
A person holds it, never an agent. The colleague holds the payment no later than the end of D+4, and the notice agent drafts the delay notice due by the end of D+1, as SI 2024/1013 sets out. A hold nearing the end of D+4 is escalated to a team leader, 4 hours before by default.
Yes. The agents never hold, release or contact the customer. Releasing a payment scored 800 or more, account protection measures and free-text notices need a team leader, and the person who requested a check can never approve it. Thresholds, scripts and models are versioned, and changes need a second approver.
The vulnerability agent spots possible indicators by the FCA's drivers (life events, health, resilience, capability) and proposes a referral. Only a vulnerable customer specialist records them, with the customer's consent, and can add a trusted contact and book a branch visit while the payment stays held.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your intervention scripts, reason codes and a sample of past held payments, and it goes live once every quality gate has passed. We will walk you through it on your own cases first.
Every concern about an older member acted on the same day, with each step on the record.
1-min demoWire Fraud PreventionFraudulent wires stopped before they leave; good wires released on time, with two names.
1-min demoACH Fraud MonitoringEvery flagged entry decided before the money moves, with the rule it answers beside it.
1-min demoWe'll run APP Fraud Detection on a sample of your own held payments and intervention scripts.