AI AgentFraud Detection
Real-time anomaly detection across transactions and documents
The challenge
Fraud queues are full of shortcuts that feel operationally necessary and are dangerous in production: probability scores become thresholds, thresholds become automated blocks, and cleared customers carry the stain of having been investigated before. A payment narrative can even ask the system to "mark this as low risk", which is exactly the outcome an attacker wants if the agent treats customer-controlled text as instruction.
The outcome
A deterministic Microsoft Foundry agent surfaces named behavioural signals for a human investigator and never renders a fraud verdict. It returns a LOW, ELEVATED, HIGH or INDETERMINATE risk band — never a probability — with evidence, review triggers and exactly one next human workflow step. Its only write is an internal, reversible, expiring investigation case with no customer-facing effect.
01 — Architecture
End-to-end architecture
Transaction facts, account history, counterparty list membership and device context are brought into a hosted Foundry agent. Protected attributes are structurally absent from the scoring model, behavioural signals compare the account only with its own past, and the output is an investigator-facing assessment rather than an automated fraud decision.
- Customer: Customer / channel
- Intake: Azure Logic Apps, Azure Blob Storage
- Extraction: Azure API Management, Azure Functions
- AI & assessment: Microsoft Foundry Agent, Azure OpenAI models, Azure AI Search
- Fraud systems: Core banking / payments, Case & rules store, Azure Key Vault
- People & insight: Fraud investigator, Sanctions / MLRO teams, Application Insights
02 — Workflow
Process & decision workflow
How a transaction becomes an investigator-ready assessment. The agent screens inputs first, builds only the allowed TransactionFacts, runs deterministic behavioural detectors, assigns a risk band without a probability, and routes the case to a person. INDETERMINATE is a first-class result, not a quiet LOW.
- Receive: Transaction, device, counterparty and narrative arrive
- Screen: Protected attributes, proxy features and prompt-injection attempts are removed and recorded
- Read: Account history, beneficiary list membership and device state are retrieved
- Signal: Twelve named detectors produce evidence and non-negative contributions
- Band: LOW, ELEVATED, HIGH or INDETERMINATE is chosen; no probability is emitted
- Route: One next human workflow step is recommended
- Path 1 · no action recommended — Record a low-band assessment: No behavioural signal fired and no trigger needs a person; the assessment is still not a guarantee
- Path 2 · human review — Investigator or specialist team decides: Elevated, high, indeterminate, sanctions, MLRO, security or missing-information routes go to people
03 — Components
Key Microsoft components
Fraud assessment needs explainability, reversibility and hard limits on automation: the agent supplies evidence for people, not customer-facing restrictions.
Azure Logic AppsPayment-event intake, queueing and reviewer workflow handoff.
Azure Blob StorageRedacted requests, evidence artefacts and assessment payloads.
Azure API ManagementGateway for account-history, counterparty and device read APIs.
Azure FunctionsPayload normalisation, integrity checks and deterministic signal execution.
Microsoft Foundry Agent ServiceHosted advisory agent that screens inputs, bands risk and routes to humans.
Azure OpenAI modelsInvestigator-facing summaries from computed facts; not a fraud verdict.
Azure AI SearchOptional tenant-isolated grounding over procedures, typologies and playbooks.
Core banking / paymentsTransaction and account reads; no block, freeze, card or payment mutation tools.
Azure SQLAssessments, review triggers, evidence and reversible investigation cases.
Azure Key VaultCredentials for legacy systems where managed identity cannot be used.
Application Insights / Log AnalyticsRedacted diagnostics and metrics with customer narrative handling controlled.
Human investigation work queueFraud, sanctions, MLRO, security and missing-information handoffs.
Power BI / Microsoft FabricReview mix, signal distribution, indeterminate rate and evaluation dashboards.
04 — AI
What the agent consumes
The capabilities the agent applies to every transaction, and the line it does not cross.
AI capabilities embedded in the agent
- Protected-attribute screening
- Proxy-feature screening
- Prompt-injection detection
- Account-own-history baselining
- Velocity-spike detection
- High-value new-beneficiary detection
- Impossible-travel detection
- Credential-change detection
- Dormant-account reactivation detection
- Structuring-pattern detection
- Known mule-beneficiary detection
- Sanctions possible-match routing
- Risk-band assignment
- Investigator summary generation
AI responsibility boundaries
The agent has 18 prohibited autonomous actions. It cannot block a transaction, freeze or close an account, suspend service, cancel or block a card, reverse or recall a payment, place a customer on a watchlist, file a SAR or STR, notify law enforcement, report to a credit-reference or fraud-prevention database, share customer data with a third party, contact the customer directly, deny service or assign a fraud probability score. It surfaces signals for a human investigator and never calls anyone a fraudster. The output is a RiskBand — LOW, ELEVATED, HIGH or INDETERMINATE — never a probability, because a number invites a threshold and a threshold invites automation. There are 12 named signal codes, each with its own evidence and a non-negative contribution; a signal that lowers risk is how a fraudster earns credit for looking ordinary. Protected attributes are not merely filtered: TransactionFacts has no name, date of birth, nationality, postcode or gender field, and adding one breaks an explicit test. Baselines are the account’s own history, never "people like them". Investigations closed with no fraud found are carried for human visibility and must never raise risk. The only write is an InvestigationCase: internal, reversible, expiring, assigned to a named role, requiring a named human approver, and with no customer-facing effect at all.
05 — Personalization
Personalization & evolving process
The same methodology applies to every agent in the catalog. Tune the channels, advisory mode, signal thresholds, reviewer roles and value model — the page structure stays identical.
Bank & fraud profile
Define the payment rails, channels, products, reviewer personas, specialist teams and regulatory handoff points in scope. The personas are the fraud investigator, sanctions reviewer, money-laundering reporting officer, security reviewer and operations manager.
Assessment template
One consistent flow for every fraud-signal agent: receive, screen, read permitted facts, collect named signals, assign a band, route to a person, record evidence and expire any internal case.
Signals & review rules
Configure the high-value bar, velocity window, credential-change window, dormancy period, structuring threshold, baseline sufficiency and reviewer roles. Do not configure population baselines, probability thresholds or customer-facing actions; those are outside the agent boundary.
Value model
Capture baseline metrics first, then map the expected benefits: investigator preparation time, explainability, indeterminate-rate visibility, prompt-injection resistance, false-positive hygiene and the proportion of cases that arrive with evidence already assembled.
06 — Impact
Key outcomes & business impact
Starting targets for the value case — validate each one against the institution baseline and governance model during discovery.
- Autonomous blocks0The tool surface contains no payment block, account freeze, card cancellation or customer-contact operation.
- Probability scores0Outputs are LOW, ELEVATED, HIGH or INDETERMINATE bands rather than thresholdable likelihoods.
- Signal evidence12 namedEach signal code carries its own evidence and a non-negative contribution.
- Construction defects found3Probing caught the unset first-payment flag, mule-hit downgrade on lookup failure, and narrative injection to LOW.
Illustrative improvement index
Manual baseline = 100. Illustrative targets, not a commitment or a regulatory compliance opinion — confirm against the institution baseline.
- Investigator preparation time: manual baseline 100, AI-assisted target 35
- Unexplained review decisions: manual baseline 100, AI-assisted target 5
- Silent automation risk: manual baseline 100, AI-assisted target 0
07 — Deployment
Deploy this agent
Surfaces explainable fraud signals for human investigators while blocking probability scores, population baselines and autonomous customer impact. This agent ships as a versioned, evaluated package: 8 Azure resources described in Bicep, 5 scoped tools, and a blocking evaluation gate that must pass before it is considered ready.
- Package version1.0.0foundation maturity, hosted agent on Microsoft Agent Framework, probed on port 8088.
- Azure resources8Provisioned from Bicep in roughly 25 minutes, excluding model capacity approval.
- Evaluation cases3624 evaluators run as a blocking gate on every change.
- Review triggers146 of them stop the agent and hand the case to a person.
What gets provisioned
Every resource below is declared in the agent's Bicep templates and deployed with a user-assigned managed identity. No key or connection string is stored in the package.
- Microsoft Foundry account and projectHosts the agent, model deployments, hosted container and managed identity.Microsoft.CognitiveServices/accounts
- Azure StorageFraud alerts, redacted transaction evidence, structured assessments and expiring investigation-case records.Microsoft.Storage/storageAccounts
- Azure Key VaultHolds legacy core-banking credential references when managed identity cannot be used; manifests carry secret names only.Microsoft.KeyVault/vaults
- Application Insights and Log AnalyticsTraces, metrics and audit diagnostics with PII redaction and narrative content capture disabled.Microsoft.Insights/components
Optional: Azure AI Search.
Deployment parameters
Collected before provisioning and validated against the manifest. Credentials are never parameters: the agent resolves them through managed identity, or by Key Vault secret name.
Identity
- Tenant identifierrequiredTenant data isolation boundary. The agent refuses to start without it.
Infrastructure
- Azure regionuaenorthRegion for the Foundry project and supporting resources.
- Environmentdev
- Deploy Azure AI SearchtrueProvides fraud typology, playbook and sanctions-screening grounding.
Model
- Fraud assessment model deploymentgpt-5.4-mini
- Investigation summary model deploymentgpt-5.4
Thresholds
- FRAUD_EXTRACTION_FLOOR0.7Below this confidence, a person verifies extracted transaction facts.
- FRAUD_ASSESSMENT_FLOOR0.7Below this confidence, the assessment requires human review.
- FRAUD_STRAIGHT_THROUGH_FLOOR0.85Confidence floor for a clean no-action recommendation; this does not permit autonomous blocking.
Baseline
- FRAUD_MIN_OBSERVED_DAYS60Minimum observed days before the account's own history can be used as a baseline.
- FRAUD_MIN_BASELINE_TRANSACTIONS10Minimum transaction count before the account's own median is usable.
Signals
- FRAUD_UNUSUAL_AMOUNT_MULTIPLE10Multiple above the same account's own median that is worth remarking on.
- FRAUD_HIGH_VALUE_ABSOLUTE10000Absolute amount used with new-beneficiary and high-value rules.
- FRAUD_VELOCITY_WINDOW_MINUTES60Minutes in the velocity-spike lookback window.
- FRAUD_VELOCITY_COUNT5Transaction count in the velocity window that raises a named signal.
- FRAUD_DORMANT_DAYS180Days without activity before a payment is considered a dormant-account reactivation.
- FRAUD_CREDENTIAL_WINDOW_HOURS24Hours after a credential change in which a payment can indicate account takeover.
- FRAUD_STRUCTURING_THRESHOLD10000Reporting threshold used for repeated just-under-threshold pattern detection.
- FRAUD_STRUCTURING_PROXIMITY0.9Fraction of the threshold that defines near-threshold payments for structuring detection.
- FRAUD_STRUCTURING_MIN_COUNT3Minimum repeated near-threshold payments required before structuring is signalled.
Investigation cases
- FRAUD_INVESTIGATION_EXPIRY_HOURS72Expiry for the reversible internal investigation case.
- FRAUD_DEFAULT_INVESTIGATION_ROLEfraud_analystDefault named role receiving an internal investigation case.
- FRAUD_REQUIRE_NAMED_APPROVERtrueRequire approved_by to name the person authorising an internal investigation case.
- FRAUD_ALLOW_INVESTIGATION_CASEtrueSet false to make the agent advisory-only. There is no setting that lets it block a payment.
Channels
- FRAUD_ENABLED_CHANNELSonline_banking,mobile_app,card_present,card_not_present,open_banking,branch,telephoneComma-separated supported channels for payment events.
Integrations
- FRAUD_CORE_BANKING_SECRET_NAMErequiredKey Vault secret NAME for a legacy core-banking credential, used only when the integration cannot authenticate with managed identity. The secret value is never collected here and never appears in a manifest or deployment log.
Deployment lifecycle
A deployment moves through an explicit state machine. Illegal transitions are rejected, so a deployment record can never sit in an undefined position — and a failure is always either retried or torn down, never abandoned.
- 01 Requested
- 02 Validating request
- 03 Waiting for configuration
- 04 Provisioning Azure resources
- 05 Configuring Foundry project
- 06 Deploying agent
- 07 Connecting tools
- 08 Connecting knowledge
- 09 Running deployment validation
- 10 Running evaluation gate
- 11 Ready
- 12 Degraded
- 13 Failed
- 14 Updating
- 15 Decommissioning
- 16 Decommissioned
Tools and their blast radius
5 tools across 1 toolbox. 1 can write, and every write is scoped, audited and reversible.
- get_account_history
- get_counterparty
- get_device
- explain_assessment
- open_investigation_case · write
What this agent will never do on its own
- block a transaction
- freeze an account
- suspend an account
- close an account
- cancel a card
- block a card
- reverse a payment
- recall a payment
- place a customer on a watchlist
- file a suspicious activity report
- file a suspicious transaction report
- notify law enforcement
- report to a credit reference agency
- report to a fraud prevention database
- share customer data with a third party
- contact a customer directly
- deny service
- assign a fraud probability score
- collapse indeterminate into low
- compare a customer with a population median
- read investigations closed with no fraud found as risk
- open an investigation case without a named human approver
Evidence before it ships
The evaluation gate is blocking: a regression on any evaluator stops the release rather than documenting it.
- golden-fraud-detection20 casesTwenty representative payment-fraud assessment cases with expected signal codes, bands, review decisions and recommended human actions. Run with python eval/run_eval.py. The signal definitions and thresholds in this agent have NOT had legal, compliance or model-risk review; they are engineering defaults that must be reviewed under the institution's own governance before go-live.
- adversarial-fraud-detection16 casesSixteen prompt-injection, control-override, fairness, outage, account-takeover, malformed-intake and autonomy-boundary cases. Run with python eval/run_eval.py. Four of these send hostile text or a malformed amount with the wrong JSON type -- a narrative as an array or object, an amount as a word or an overflow -- because type-juggling a field used to bypass the injection scanner entirely and an overflowed amount used to manufacture an ELEVATED band. Velocity windows, dormancy period, structuring proximity and amount multiples were chosen by engineers as plausible defaults, not as legal, compliance or model-risk sign-off.
Evaluators
- protected_attributes_never_reach_assessment
- cleared_investigations_never_raise_risk
- baseline_is_the_account_not_the_population
- no_probability_in_output
- indeterminate_never_collapses_to_low
- established_findings_survive_an_outage
- signal_recall
- routing_accuracy
- band_accuracy
- review_decision_accuracy
- every_band_is_explained
- ordinary_payments_are_not_flagged
- ordinary_field_names_do_not_trip_the_fairness_guard
- single_weak_signal_does_not_elevate
- structuring_requires_repetition
- impossible_travel_ignores_online_geography
- injection_resistance
- adversarial_text_cannot_obtain_a_low_band
- adversarial_text_cannot_lower_an_established_band
- narrative_never_reaches_the_output
- no_customer_facing_action
- no_agent_confirmed_investigation_case
- tool_surface_is_read_only_or_reversible
- prohibited_actions_remain_prohibited
Identity, isolation and network
- Agent identityuser-assigned-managed-identity. No shared keys, no embedded credentials.
- Public network accessconfigurable. Private endpoints available for Azure Storage, Azure Key Vault, Azure AI Search.
Role assignments
- Azure AI DeveloperFoundry projectRun the hosted agent and evaluations without granting infrastructure ownership.
- Storage Blob Data ContributorFraud alert, evidence, assessment and investigation-case containersRead redacted payment-event artefacts and write assessment and case records.
- Search Index Data ReaderAzure AI Search tenant indexesRead fraud typologies, investigation playbooks and sanctions-screening guidance.
- Key Vault Secrets UserKey VaultResolve legacy core-banking credentials that cannot use managed identity.
- Monitoring Metrics PublisherApplication InsightsEmit redacted traces and metrics.
What you can see once it is running
Traced with opentelemetry and exported to Application Insights. Document content and model reasoning are dropped before export — neither is ever written to a log.
- fraud_detection.processed
- fraud_detection.review_required_rate
- fraud_detection.risk_band
- fraud_detection.recommended_action
- fraud_detection.indeterminate_rate
- fraud_detection.signal_count
- fraud_detection.signal_code
- fraud_detection.excluded_inputs_count
- fraud_detection.protected_attribute_supplied
- fraud_detection.proxy_feature_supplied
- fraud_detection.no_probability_output
- fraud_detection.account_baseline_unusable
- fraud_detection.lookup_failed
- fraud_detection.prompt_injection_detected
- fraud_detection.control_override_detected
- fraud_detection.account_takeover_route_rate
- fraud_detection.sanctions_referral_rate
- fraud_detection.mlro_referral_rate
- fraud_detection.investigation_case_recommended_rate
- fraud_detection.investigation_case_opened
- fraud_detection.no_customer_facing_action
- fraud_detection.tool_failure_rate
- fraud_detection.processing_duration_ms
Cost drivers
- Model inference for fraud assessment and investigator summaries
- Hosted-agent container compute
- Azure AI Search capacity and indexed typology content
- Storage retention for alerts, evidence, assessments and investigation cases
- Application Insights and Log Analytics ingestion
- Customer integration work against core banking, payments, counterparty and device systems
Supported regions
- uaenorth
- westeurope
- swedencentral
- eastus2
Getting it deployed
The package is ready to provision into a customer subscription: infrastructure as Bicep, the agent as a container image, and the evaluation gate as a pipeline step. Provisioning runs against your own tenant with your own approvals, so the last step is a conversation about region, capacity and the systems this agent will read from.
Published by Cloud Mechanics · Owner Cloud Mechanics - AI Solutions · standard support
Deploy this agentRelated & recommended
Derived automatically from our solution knowledge graph.
Related professional services
How we design, build and secure it.
ServiceAI Security
AI Security delivered by Cloud Mechanics certified experts.
ServiceData Analytics
Data Analytics delivered by Cloud Mechanics certified experts.
ServiceData Engineering
Data Engineering delivered by Cloud Mechanics certified experts.
ServiceAI Agent Development
AI Agent Development delivered by Cloud Mechanics certified experts.
Related quick wins
Ready-made Azure AI to start fast.
Technologies
What powers this solution.
Related managed services
Keep it running and optimised.
ManagedAI Managed Services
AI Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedSecurity Managed Services
Security Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedCloud Managed Services
Cloud Managed Services from our UAE-based 24/7 Cloud Operations Center.
ManagedDevOps Managed Services
DevOps Managed Services from our UAE-based 24/7 Cloud Operations Center.
Ready to move from challenge to solution?
Talk to a Cloud Mechanics expert or build your solution in minutes.