Claims fraud using AI: the agent places each payment, a person decides

Using AI on claims fraud at a bank means using it to investigate the claims customers file when a payment leaves their account: reading what the customer said, pulling the device, passcode and payment records, and proposing whether each payment was unauthorized, and so repayable under Regulation E, or authorized but induced by a scammer. AI can do that gathering faster and more completely than a specialist copying between four systems. It should not be the one that decides, because the Electronic Fund Transfer Act puts the burden of proving a disputed payment was authorized on the bank, and a bank carries that burden through people it can name. P2P Fraud Claims, Botminds' software for dispute teams that resolve P2P fraud and scam claims, is built on exactly that split: seven agents place each payment with the record that puts it there; a specialist confirms, and a supervisor approves.

This guide is for the head of disputes weighing AI for the P2P desk, and for the model risk and compliance colleagues who will ask what the agents may do on their own. It sets out what the law asks of whoever decides, where AI helps, where it must stop, and what to ask any vendor, including us.

Can AI decide a fraud claim?

AI can propose a decision on a fraud claim, and in clear cases its proposal will usually be right, but the decision is the bank's, and the bank should take it through a person who can show the evidence. Nothing in Regulation E forbids software in an investigation. What the law fixes is who must prove what. Under the Electronic Fund Transfer Act, in any action over a consumer's liability for an unauthorized transfer, the bank must prove the transfer was authorized, as Reg E denial reasons sets out. A model score is not proof. The device record, the passcode log and the call transcript that the score rests on are.

That is why the useful question for a P2P desk is not whether AI can decide but which steps it can carry so that a person's decision rests on more evidence than a specialist working alone would gather. The answer, on most claims, is nearly all of the gathering and most of the drafting.

What the law asks of whoever decides

Whoever decides a P2P fraud claim, person or machine, has to meet four requirements that are written down. The bank must investigate promptly and decide within 10 business days, or provisionally credit and take up to 45 days. Its investigation must be reasonable, and it may not stop at the payment instructions when its own records could help. If it finds no error, it must explain why in writing and tell the customer she can ask for the documents it relied on, under 12 CFR 1005.11(d). And if it gets the answer wrong knowingly, the cost rises: the Act provides treble damages where a bank concluded there was no error when that conclusion could not reasonably have been drawn from the evidence it had (15 U.S.C. 1693f(e)).

Each of those requirements is about evidence and explanation. An AI system that cannot show, for each payment, the record it relied on and the rule it applied cannot help a bank meet them, however accurate its scores. One that can show both makes the human decision faster and the file stronger.

What can AI do in a fraud claims investigation?

On a P2P claim, AI can do the four jobs that consume a specialist's time before any judgement is made: turning a call or form into a list of payments, pulling each payment's device and authentication history, laying the events on one timeline, and drafting the letter and the recovery request. None of those is a decision. All of them are where errors creep in by hand: a payment missed in a long call, a device record copied from the wrong session, a letter that says "no error" without saying why.

The shape of that estimate is the argument. The largest single block of time by hand is reading logs, and it is the block where AI is strongest: matching a passcode event to a device to a payment is exact work over structured records. The row that shrinks least is the decision, by design. A desk that buys AI and finds its decision time falling to zero should ask who is deciding.

Can AI tell fraud from a scam?

AI can tell fraud from a scam on most P2P payments, because the distinction turns on records it can read: whether the payment came from the customer's own device and session, or from a device added minutes earlier with a code a caller talked her out of. The hard cases are hard for people too. The Senate staff who examined the three largest owner banks put it plainly: "Determining whether a transaction is authorized or unauthorized can be challenging in cases of coercion and manipulation."

Two design choices keep a system honest about that difficulty. First, it should place each payment separately, because a single bank-impersonation call often produces both kinds. Second, it should carry a confidence and stop below a threshold, so the ambiguous payments reach a person instead of a default. In the solution, the agents place nothing below 0.85; the specialist decides with a reason code.

One claim, two kinds of payment, each placed with the record that puts it there

Is it legal for AI to deny a Reg E claim?

No law names the tool a bank may use, but a denial is the bank's finding that no error occurred, and the bank must be able to defend it with a reasonable investigation, a written explanation and the documents it relied on. An automated denial with none of those is not a technology question; it is a Regulation E violation that happened to be automated. The CFPB's 2025 order against Block, the company behind Cash App, recorded refunds denied on the strength of a "known device" alone. A model that learns from past denials can learn that habit.

The safer pattern, and the one P2P Fraud Claims follows, is that no agent denies anything. The classification agent can place a payment on the authorized side, where it may end in a denial, but the denial itself is drafted for a specialist to confirm and a supervisor to approve, and the letter agent will not let a draft go forward if it blames the customer or omits the right to the documents.

Does model risk guidance cover AI agents?

Not the current federal guidance. The revised interagency model risk management guidance that the OCC, the Federal Reserve and the FDIC issued in April 2026 puts them outside its scope in so many words, as new and still changing quickly; what that means for a bank's own controls is examined in whether a customer risk rating model is a model. The agencies said they plan to issue a request for information on banks' use of AI, including generative and agentic AI. The Federal Reserve issued the same guidance as SR 26-2.

Outside the guidance is not outside governance. It means a bank deploying agents on claims has to write its own controls, and the controls that matter are the ones the law already implies: every placement traceable to its records, every rule versioned, a confidence below which nothing is placed, a person who approves, and a trail an examiner can read. A vendor that cannot show those is asking the bank to govern a black box.

The dispute a chatbot never hears

The first AI risk on a P2P desk is not a wrong placement; it is a claim that never starts. The CFPB warned in 2023 that "Chatbots and highly scripted representatives can introduce a level of inflexibility, whereby only specific words or syntax may trigger the recognition of a dispute and begin the process of dispute resolution." A customer who types "a man from your fraud team took my money" has given notice of an error, whether or not she used the word dispute, and the 10-business-day clock is already running.

An AI system on the intake side should be judged on what it recognises, not only on what it resolves. In the solution, the intake agent reads the contact-center transcript or claim form for the payments the customer describes and starts the clock from the date she first told the bank, by any channel. The examples a desk should test it on are the ones customers actually say, not the ones a script expects.

Who is accountable for an AI claims decision?

The bank is, through the people it assigns: the specialist who confirmed each placement and the supervisor who approved the outcome. Accountability only works if the system makes those roles separate and visible. In the solution, the sign-off lists every payment, its side, its rule and its amount, the recovery request and the hand-off to the fraud team, and then what the agents will do in order once someone approves. The specialist who confirmed the claim is told, on the screen, that she cannot approve it.

The specialist who confirmed the claim cannot approve it

Questions to ask before buying AI for P2P fraud claims

Ask what the system can show, not what it can score. The questions below separate a tool that strengthens a bank's Regulation E file from one that only speeds it up. They apply to every vendor in this market, including Botminds. A fuller evaluation list for claims software is in claims software programs for fraud detection.

Where P2P Fraud Claims fits, and where it does not: it works the claim after the customer reports it, on P2P payments, against Regulation E, the network's imposter rule and the bank's own claims policy. It does not stop fraud before the payment leaves, which is a detection system's job, and it does not decide card chargebacks, which have their own rules and their own guide to AI on card disputes. It goes live on the bank's own systems and policy, and the first test is a sample of the bank's own past claims. The sample claims on this page can be followed screen by screen from P2P Fraud Claims.

Questions people ask

What is human in the loop for fraud claims?

It means a named person makes every decision that changes the customer's money or rights, using the evidence the system gathered. On a P2P claim that is at least two people: a specialist who confirms each payment's placement and a supervisor who did not work the claim and approves the outcome. A loop where the person only clicks through scores is not one.

Can AI agents start the Regulation E clock?

They can record it, but the clock starts when the customer gives notice, oral or written, not when software notices. Regulation E counts 10 business days from the bank's receipt of the notice, so an agent's job is to find the true notice date in the call or chat and count from it.

Does the CFPB allow AI in dispute handling?

No CFPB rule bans it, but the CFPB's 2023 report on chatbots warned that scripted systems may fail to recognise a dispute, and Regulation E's requirements for a prompt, reasonable investigation and a written explanation apply whatever tools a bank uses. The test is whether the outcome and the file meet the rule.

What is the difference between fraud detection AI and claims AI?

Detection AI scores a payment before it leaves, to stop or delay it. Claims AI works after the customer reports a loss, gathering evidence to decide whether the bank must repay. The two share data but answer to different rules, and a bank needs both.

How accurate does AI need to be on P2P fraud claims?

Accurate enough that a person confirming its placements disagrees rarely, and honest enough to place nothing when it is unsure. In P2P Fraud Claims the design target is that every placement cites the record behind it and is checked against similar decided claims; the threshold sends the rest to the specialist.