AI in Fraud Detection and Operations

Artificial intelligence is already embedded in payment fraud detection, and its role is growing. Machine learning models score transactions in real time, looking at hundreds of features, from the device and the location to the customer's spending history and the network of accounts involved. Newer approaches use graph analytics to find fraud rings, where a group of accounts passes money between each other in a pattern that no single transaction reveals. Generative AI is being used to help analysts, by summarising a case, drafting a suspicious activity report narrative, or searching through transaction histories in response to a question in plain language. These tools make analysts faster, but they do not replace the analyst's judgement, because the decision to file a report or to close an account carries legal consequences that a model cannot own. AI is also changing payment operations beyond fraud. It is used to predict payment failures before they happen, by identifying patterns in rejected payments, and to automate exception handling, by suggesting the right repair for a payment that failed validation. In customer service, AI assistants answer common questions about payment status and cut off times, freeing human agents for complex cases. In reconciliation, machine learning improves matching rates by learning from past manual matches, so that fewer breaks need human attention. The common thread is that AI is best at the high volume, repetitive parts of the work, and at surfacing patterns a human would miss, while humans remain responsible for the decisions that matter. The governance of AI in payments is now a serious topic in its own right. Regulators are asking banks to explain how their models work, to prove that models do not discriminate against particular customer groups, and to show that model performance is monitored over time. A model that was accurate when it was trained can drift as behaviour changes, and a model that performs well on average can perform badly for a minority of customers. A BA working with AI systems should ask for the model's purpose, its training data, its performance metrics, its explainability, its monitoring plan, and its fallback when the model is unavailable. The most useful question is often the simplest. When this system makes a mistake, who notices, and what happens next? A system with a good answer to that question is ready for production. AI governance in payments starts with the EU AI Act, Regulation (EU) 2024/1689, which entered into force on 1 August 2024. The Act classifies AI systems by risk: unacceptable, high, limited, and minimal. A credit scoring system is high risk, and must undergo a conformity assessment, must have a risk management system, must be documented, and must be subject to human oversight. A fraud detection system is not automatically high risk, but it becomes high risk if it makes decisions that affect access to a financial service. A chatbot that answers customer questions is limited risk, and must disclose that it is a machine. The classification determines the obligations, and the business analyst must classify each AI use case before it is built. Model risk management is the bank's internal control for AI, and it follows the same principles as the Basel guidance on model risk. The model must be documented, with the purpose, the data, the methodology, the assumptions, and the limitations. It must be validated by a team that did not build it, using data the model has not seen. It must be monitored in production, with the performance measured against a threshold, and must be retrained or retired when it degrades. A model that is not validated, not monitored, and not documented is a model the bank cannot defend, and the regulator will find it. The fairness test is the control that prevents discriminatory AI. A fraud model trained on historical data will learn the patterns in that data, including any bias. If the historical data shows that payments from a particular country were more likely to be flagged, the model will flag payments from that country more often, even if the flagging was itself biased. The fairness test measures the model's decisions by protected characteristic, such as nationality, gender, or age, and requires the differences to be justified by a legitimate reason. A model that fails the fairness test must be retrained or retired, however accurate it is.