Fraud case management software that turns every alert about one customer into one case, with a decision memo where every sentence opens its source
Alerts from every engine in one case, each memo sentence tied to its source.
See one case, screen by screen ↓Fraud Case Management is fraud case management software for banks: fraud analysts get the evidence on each alert and a proposed decision to approve or reject. Agents merge alerts from every detection engine into one case per customer, gather the evidence into a binder and draft a decision memo where every sentence opens its source. The investigator decides and the supervisor approves the close and its ledger entries.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Each detection engine raises its own alerts in its own queue. One takeover of a business customer's digital banking arrives as a wire alert, a second alert on the same wire from a velocity rule, an ACH alert and, two days later, a returned-deposit alert from the check engine. Two investigators may work the same fraud, and the loss is counted in pieces. The bank fraud investigation process then runs on copy and paste: transactions from the core, the device and session log from digital banking, the check image, the call transcript and the prior cases, pasted into a narrative.
The supervisor who signs the close cannot see which statement came from which record, so review is a second investigation or a signature on trust. Recalls, Nacha returns and charge-offs sit in spreadsheets, apart from the evidence, and the quarter's loss report is rebuilt by hand. And when a case is referred for a suspicious activity report, that referral must never reach the customer or anyone without a need to know.
Estimated split of an investigator's and a supervisor's working hours on one multi-alert account takeover case, by hand and with the agents. Our estimate, kept modest; the working solution's sample quarter shows a median of 38 minutes from a complete binder to a decision.
Eight agents merge the alerts, gather the evidence, draft a cited memo and challenge it; the investigator decides, the supervisor approves the close.
Ridgeline Auto Body LLC, a business customer of Corvane National Bank in Sandusky, Ohio, since 2017. On October 13 someone resets the owner's digital banking password from a new Android phone, changes the mobile number, deposits a check and sends a $48,600.00 wire to a new payee. Here is the case, screen by screen, in the working solution.
The payments fraud engine raises PF-88231407 on the wire to a new payee, PF-88231409 on the same wire from a velocity rule, and PF-88233952 on a $9,800.00 ACH debit from an originator never seen on the account. Two days later the check and deposit fraud engine raises CD-55104218: check #1182 came back counterfeit. The intake agent joins them into case FC-2026-18342 at confidence 0.97, same customer and same device inside 72 hours, and drops the second wire alert with its reason.
PF-88231409: “The same wire, velocity rule”, dropped as a duplicate and kept visible with Restore.
Marisa opens the binder: nine evidence tabs on the left, each saying in one line what the agent took from it. The device log tab reads: “A new Android phone at 6:44 AM; the number changed at 6:47; a wire payee added at 7:03.” In the center is the drafted decision memo, 17 sentences, 17 cited, confidence 0.93, proposing confirmed third-party fraud and a $22,300.00 reimbursement.
“Marisa Delgado decides · Supervisor approves · up to $50,000.”
The Agents tab shows each step: the intake agent's merge, the redaction agent masking every number to the last four, the evidence agent pulling nine sources, the recovery agent's $38,900.00 recovered, the drafting agent's 17 cited sentences under decision code FD-ATO-2, and the clock agent's due date of Thursday, October 22.
“Agents never close a case, move money, post to the ledger, contact the customer or file a SAR.”
Check #1182 from “Brayfield Insurance Agency”, $2,800.00, deposited from the new phone at 6:52 AM. The check image tab shows the front and back with three callouts: the serial is outside the maker's range of 4410 to 4630, the amount and date font, and no “for mobile deposit only” restriction on the back. Returned unpaid on October 15: counterfeit, refer to maker.
Bank standard OBS-7 holds new payees for 24 hours after a mobile number change. Marisa asks whether the hold was applied, and the answer comes with its passages: release 26.07 attached the hold only to the security settings page, so a change on the profile page did not start it.
A question the binder cannot answer gets “I will not guess”, not an invention.
Loss $61,200.00: the wire, the ACH debit and the counterfeit deposit. Recovered $38,900.00: $29,100.00 returned on the wire recall and $9,800.00 on the R29 return. Outstanding $22,300.00. The recovery agent drafts two general ledger entries to fraud losses, JE-1 for $19,500.00 and JE-2 for $2,800.00, which Marisa proposes; nothing posts yet.
When Marisa sends the case, the quality agent reads every sentence against its source. Sentence 4, “The owner clicked a phishing link in an email on October 12”, rests only on the owner's own belief in the call transcript; no mail header or provider record is in the binder. Support 0.58, under the 0.70 threshold. The amounts tie and the decision code fits.
Suggested: “The owner believes she typed her password on a fake mailbox page on October 12; how the mailbox was compromised is not confirmed.”
Curtis accepts the suggested wording, which is marked as his edit, then approves the close, the reimbursement and both ledger entries in one step. Net loss $22,300.00 is inside his $50,000 limit. Marisa made them, Curtis checks them, and neither can do both.
“Maker: Marisa Delgado · checker: Curtis Ambrose · net loss $22,300.00, inside your $50,000 limit.”
The total of $61,200.00 is over the $25,000 threshold, so on October 15 the referral agent sent referral RF-26-0913 to the restricted BSA space. The fraud case keeps only the reference. Whether a report is filed, and the BSA officer's notes, never appear in the case, a customer letter, a customer view or a fraud export.
The trail shows who did what, when, why and on what evidence, people and agents alike: the challenge, the accepted wording, the approval and the posting. An examiner pack for the OCC on Q3 2026 account takeover cases is built in one step: 61 cases and 1,412 pages, masked to the last four, with referral material excluded.
The same case, seen by five of the people who carry it: what their week looked like, and what it looks like now.
Eight agents merge the alerts, gather the evidence, draft a cited memo and challenge it; the investigator decides, the supervisor approves the close.
Merges alerts from every engine into one case per customer when the customer, device or payee match inside 72 hours, and drops duplicates with the reason shown.
Pulls each source into the binder (core transactions, device log, check image, call transcript, prior cases, recovery, bank standard) and writes the one-line takeaway on each tab.
Writes the decision memo one cited sentence at a time, proposes the decision code, and computes loss, recovered and outstanding.
Follows wire recalls, Nacha returns and warranty claims, and drafts the general ledger entries for the close.
Reads every memo before approval, scores each sentence for support, checks that the amounts tie and the decision code fits, and samples 6% of closed cases for the QA analyst.
Checks SAR thresholds, drafts the referral and moves it to the restricted BSA space, and checks customer letters for any wording that would reveal a referral.
Runs the triage, decision and referral clocks, reminds a business day before a deadline and escalates on a breach.
Masks account, routing, card and device numbers to the last four in memos, letters and exports.
Approves every close, reimbursement and ledger entry; the Chief Fraud Officer above $50,000. The agents propose; a named person decides.
Answers come only from this case's sources, with the tab and passage they rest on.
When did the phone number change?
At 6:47 AM on October 13, on the profile page, from a number ending 2210 to one ending 0937, three minutes after the login from the new phone.
Was the payee hold applied?
No. OBS-7 § 3.2 requires a 24-hour hold on new payees after a number change, but release 26.07 attached the hold only to the security settings page, so the change on the profile page did not start it.
Is this device on other cases?
Yes, one. DV-8F21 logged in to Lakeshore Tile & Stone's profile on October 12 (FC-2026-18317), and both customers paid Halvern Supply Co. The cases stay separate and linked.
13 screens from the working solution, on its sample data. Pick one to see it large.
Clocks, merge rules, limits and agent thresholds are settings. The administrator proposes a change, the Chief Fraud Officer approves it, and it is on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Merge window | 72 hours · same customer, device or payee | Change proposed by the administrator; a move to 96 hours was replayed on 300 closed cases before approval |
| Merge confidence | Auto-merge at 0.90 · suggest from 0.75 | Below 0.90 a person chooses Accept or Keep apart |
| Decision clock | 10 business days · 5 above $25,000 | Triage 24 hours from the alert · referral to BSA 5 business days after fraud is confirmed |
| Escalation | To the supervisor on breach; to the Chief Fraud Officer after 3 business days | Reminder 1 business day before |
| Supervisor approval limit | Up to $50,000 net loss or reimbursement per case | Above it, the Chief Fraud Officer approves |
| Always maker-checker | Freeze, unfreeze, reimbursement, charge-off, ledger entry, customer letter, referral | Self-approval: never, locked · bulk approval only for closes with no loss and no customer letter |
| Agent versions and thresholds | Quality agent challenges below support 0.70 · drafting agent proposes no decision below 0.80 | A new version replays a golden set of 300 closed cases before the Chief Fraud Officer approves it |
| Records and privacy | Case records kept 5 years from close · numbers masked to the last four | Masking and the exclusion of referral material from exports cannot be switched off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, not a published figure · “typical” = published figures (Datos Insights, Datos Matrix: Fraud and AML Case Management, July 2025, from FinCEN data: 1,545,110 fraud SARs filed in 2024, 58.9% more than in 2021, and check fraud SARs up 109% from 2021 to 2024; Federal Reserve Financial Services, 2026 Risk Officer Survey: 63% of institutions reported check fraud attempts). Rules named: 31 CFR 1020.320 (suspicious activity reports and their confidentiality), 31 CFR 1010.430 (five-year records), Nacha return reason R29. Corvane National Bank and the people, customers, cases, accounts, devices and references named on this page are fictional — characters and sample data in the working solution.
Fraud Case Management is fraud case management software for banks: fraud analysts get the evidence on each alert and a proposed decision to approve or reject. Agents merge alerts from every detection engine into one case per customer, gather the evidence into a binder and draft a decision memo where every sentence opens its source. The investigator decides and the supervisor approves the close and its ledger entries.
The intake agent joins alerts that share a customer, device or payee inside a 72-hour window into one case, and drops an alert that repeats the same transaction, showing which alert it duplicates. Merges below 0.90 confidence wait for a person, and an investigator can split any alert back out with a reason code.
The drafting agent writes the decision memo one sentence at a time and writes no sentence it cannot cite to a tab and a passage. Clicking a sentence opens its source, highlighted. A sentence a person types is marked as their words, and the agent's wording is kept in history.
The recovery agent follows wire recalls, Nacha returns and warranty claims and computes loss, recovered and outstanding from the evidence. The close carries its general ledger entries, proposed by the investigator and posted only when the supervisor approves, so the quarter's loss report is the closed cases added up.
Yes. When a threshold is met, the referral agent drafts the referral and moves it to a restricted BSA space; the fraud case keeps only the reference. Customer letters, customer views, contact center scripts and fraud exports are checked so that nothing reveals a referral, and the agents never file a SAR.
Yes. Agents never close a case, move money, post to the ledger, contact a customer or file a SAR. The investigator decides, the supervisor approves or returns with a reason code, the Chief Fraud Officer approves losses above $50,000, and nobody approves their own case. Overriding an agent's proposal needs a reason code.
Yes. Triage and decision clocks, escalations, the merge window and confidence, approval limits, reason codes, agent thresholds and retention are settings. The administrator proposes a change, the Chief Fraud Officer approves it, and a new agent version replays a golden set of closed cases first.
The Agentic Solution Engine builds and deploys it from your requirements and documents (your fraud policies, bank standards, reason codes and a sample of past alerts and closed cases) and it goes live once every quality gate has passed. We will walk you through it on your own cases first.
Bad checks stopped before the money leaves; good deposits released the same day.
1-min demoNew Account Fraud DetectionBad accounts restricted before the first big deposit clears, with partners told on time.
1-min demoMoney Mule DetectionMule accounts frozen while the money is still there, and every victim's bank told.
1-min demoWe'll run Fraud Case Management on a sample of your own past alerts and closed cases.