Fraud detection models block transactions in real time. The challenge is not only detecting fraud: it is avoiding legitimate blocks that create customer friction and reputational cost. When the model blocks, the analyst gets a score—not the context needed to know whether the block is correct or a false positive. AyGLOO adds an agentic layer on top of that model: the agent evaluates model reliability for that specific profile (ISA), the minimal action that resolves the issue (CF), and the expected loss of each possible action—block, verify, or approve—before acting. When it cannot act with guarantees, it routes to the analyst with all context ready to decide in seconds.
1
The agent blocks, verifies, or approves automatically based on what reliability guarantees. The analyst intervenes only when there is real uncertainty.
2
ISA detects segments with systematically high false positives; what-if isolates the signal sustaining the block; and CF shows the minimal action that resolves it—together they let the agent choose the right action for each case.
3
Network analysis detects coordinated fraud patterns across linked accounts, devices, or beneficiaries—patterns that are invisible transaction by transaction.
4
The economic decision function computes the expected loss of each action in real time—hard block, OTP verification, or approval—and the agent picks the one that minimizes net cost, not just risk.
Today: what a fraud analyst typically receives
With AyGLOO. Same decision, fully enriched
XAI Decision explanation
Twin Reliability-level rules
ISA False-positive assessment
CF Minimal change that unblocks
What-if Signal sensitivity
Graph Network analysis
Econ Economic decision function
Action Agent decision
PDF Regulatory traceability
1. Why this transaction was blocked. Twin model (depth 7 · fidelity 96.1%)
100%IF speed_3min ≥ 3 AND unusual_merchant_category = true AND billing_address_mismatch = true → Block. Full confidence: act without manual review.
79%IF device_not_seen_180d = true AND speed_3min ≥ 2 → Likely access from a new device. Consider additional verification before a definitive block.
58%IF unusual_merchant_category = true with no other factors → Weak signal in isolation. Do not block based on this rule alone.
A full-confidence rule would trigger a hard block. But the agent does not act on score alone: it checks ISA before executing. If the profile has a high false-positive rate, it recalibrates the action. If reliability is lower, it routes to the analyst with full context.
XAITwin
2. Segment double-check. False-positive assessment (ISA)
Micro-segment: "card-not-present, new device, night" · Historical false-positive rate: 22% · Similar speed patterns confirmed as legitimate in 61% of cases with this profile · False-positive risk: HIGH.
ISA is the agent’s double-check before execution. It reveals that this type of transaction is incorrectly blocked more often than expected in this specific segment — and that changes the action.
ISA
3. Linked network analysis
The device involved triggered 4 blocked transactions across 3 other accounts in the last 6 hours · 2 accounts share the same beneficiary at a high-risk merchant · Pattern consistent with organised card fraud
Analysed in isolation this looks like an individual case. Network analysis reveals it is part of a broader pattern, which changes both priority and the agent’s action.
Graph
4. CF. Minimal actionable change that unblocks the transaction
If the customer completes SMS verification (OTP): transaction approved · Additional authentication resolves the device anomaly and normalises the speed pattern · No manual analyst intervention required
Counterfactual is not sensitivity: it is the concrete minimal action that flips the decision. It turns a block into a quick verification, reducing customer friction without compromising security.
CF
5. What-if. Which signal sustains the block
Remove speed signal: score drops to Medium (0.58) · Remove device anomaly only: remains High (0.79) · The speed signal is what sustains the block; the rest is secondary.
What-if changes one variable while holding the rest constant. It confirms which signal is determinant and which are secondary before the agent chooses the response action.
What-if
6. Economic decision function. Expected loss by action
Hard block
€0
€425 CLV at risk
p_churn = 0.23 · CLV €1,848
OTP verification ✓
€0 if completed
€63 friction cost
OTP success: 81% in this segment
Approve
€1,681 expected
€1,847 × p_fraud 0.91
€0
→ The agent chooses OTP: lowest expected net loss (€63 vs €425 vs €1,681)
The agent’s decision is not based on risk score alone: it compares the expected loss of each possible action. That turns blocking into an optimisable economic function rather than a fixed threshold. Auditable and defensible for business in any review.
Econ
7. Agent decision
A full-confidence rule would trigger a hard block, but ISA detects a 22% false-positive rate for this profile and CF confirms OTP resolves the device anomaly · The agent triggers a soft verification (SMS OTP) automatically · Customer message generated: "We detected unusual activity on your account. Please verify to continue." · In parallel: the coordinated fraud pattern detected by network analysis (4 accounts, 6h) is escalated automatically to the organised fraud team · Traceability exportable for GDPR Art. 22 and EBA
or, if reliability is lower or ISA flags an ambiguous context
→ The agent routes to the analyst: score, ISA false-positive rate, CF verification that would resolve the case, network pattern, and exportable traceability · The analyst decides in seconds whether to block, verify, or approve
The agent does not choose between block or no block: it chooses the lowest expected-cost action for each specific case. The ISA + CF + economic function combination enables more precise decisions than a fixed threshold, escalating to a human only when there is real uncertainty.
ActionPDF
Illustrative example. Each deployment is adapted to each institution’s models, data, and operating procedures.