Fraud Alert Triage Agent

Fraud teams face hundreds of alerts a day, and real attacks can sit in the queue behind false alarms. Each hour this agent works through new alerts. For each one it pulls account history, device and location data, recent changes such as new payees or password resets, and linked accounts. It compares the activity to the customer's normal pattern and known fraud patterns, then gives each alert a priority and a short reason. Low-risk alerts with a clear normal explanation are proposed for closing. High-risk ones go to the top with a suggested action such as a temporary hold. Analysts approve every hold and closure. Each week it samples its closed proposals against analyst decisions and tightens its rules if agreement drops below 90%. Edge case: a customer logs in from a new country where their card was also just used, so the risk drops.