AI Fraud Detection
A flag is a reason to look, never a conclusion about a person.
What is fraud detection?
Fraud detection means identifying transactions or patterns that warrant investigation, producing cases for people to examine rather than conclusions about whether anybody acted dishonestly.
Every fraud detection system produces two kinds of error. It misses genuine fraud, and it flags people who did nothing wrong. Both are inevitable, and the second is treated far too lightly.
A missed fraud costs money. A false accusation against a member of staff or a customer costs a relationship, sometimes a career, and occasionally a legal claim, and it is frequently never fully repaired even when resolved.
That asymmetry should shape the design. A flag is a reason to look at something, and the language, the process and the people handling it all need to treat it that way.
Who we insist sees a flag
Duara builds detection in Kenya where the output is an investigation case rather than a verdict.
We insist that flags reach trained investigators rather than line managers. A supervisor handed a fraud alert about somebody they work with daily will act on it socially before anybody has established anything, and that damage is not recoverable by a later finding of innocence.
Who this is for
- Losses are suspected and unquantified
- Review capacity is smaller than alert volume
- Previous systems produced unusable alert counts
- You need investigation cases rather than scores
Industries we serve
- Banking and microfinance
- Insurance
- Retail chains
- Telecommunications
- Logistics
- Manufacturing procurement
Problems this solves
These are the conditions where detection helps and where it does harm if handled carelessly.
- Alert volume beyond review capacity. A system producing more flags than anybody can investigate means none are investigated properly.
- False positives treated lightly. The cost of wrongly flagging somebody is measured in relationships and reputations rather than in money, so it does not appear in the business case.
- Flags reaching the wrong people. A supervisor given an alert about a colleague acts on it socially long before anything is established.
- Scores presented as conclusions. A risk figure gets read as an accusation by whoever receives it, whatever the documentation says.
What we deliver
Detection tuned to a volume that can actually be investigated, flags framed as cases rather than conclusions, routing to trained investigators, and measurement that includes the cost of false positives.
Detection tuned to your actual review capacity
Flags framed as investigation cases
Routing to trained investigators rather than managers
False positive rate measured and reported
A record of what triggered each case
Guidance on handling a case that clears somebody
Features
- Tuned to review capacity. A system producing more alerts than you can investigate means none get investigated properly, so volume is set to what you can actually handle.
- Cases, not conclusions. The output is a reason to look at something, and the language used reflects that because whoever receives it will read tone as much as content.
- Routed to investigators. A line manager handed an alert about a colleague acts socially before anything is established, and that damage does not reverse.
- False positives counted. The rate is measured and reported, since a system judged only on catches will drift toward flagging everybody.
- Clearing somebody handled properly. What happens when an investigation finds nothing is designed, because that is the outcome most likely to cause lasting harm.
Benefits
- Losses become quantified. Detection turns a suspicion that something is wrong into a figure you can act on.
- Investigations are actually possible. Alert volume matched to capacity means cases get worked rather than accumulating unreviewed.
- Fewer people wrongly accused. Counting false positives and routing carefully addresses the cost that does not appear in a business case.
- Findings that hold up. A recorded trigger and a proper investigation produce a conclusion that survives challenge.
Technologies we use
- Pattern detection. Identifying transactions and behaviours that differ from established norms.
- Volume tuning. Setting thresholds against the number of cases you can genuinely investigate.
- Case presentation. Framing output as something to examine, with the trigger recorded and visible.
- Routing. Directing cases to trained investigators rather than to line management.
- False positive measurement. Tracking how often flagged cases clear, and reporting it alongside detection figures.
The two error types are not symmetrical and most systems are tuned as though they were. Missing a fraud costs money; wrongly flagging a person costs a relationship that money does not repair.
How the process works, step by step
Detection work usually takes seven to twelve weeks, and how cases will be handled is agreed before any detection is switched on.
-
Step 1
Free loss review
We establish what you suspect you are losing and how many cases you could realistically investigate.
-
Step 2
Handling agreed first
Who receives a case, what they do with it and what happens when it clears, settled before detection runs.
-
Step 3
Silent running
Detection runs without alerting so volume and false positive rate can be judged before anybody is named.
-
Step 4
Thresholds tuned
Volume is set against your actual investigation capacity rather than against theoretical sensitivity.
-
Step 5
Live with measurement
Cases go to investigators, with false positive rates reported alongside detections.
Quality assurance and how we work
The commitments attached to systems that can cause somebody to be accused.
- A flag is never a conclusion. The output is a reason to look at something, and we design the language and process so nobody reads it as an accusation.
- Cases go to investigators, not line managers. A supervisor given an alert about somebody they work with acts socially before anything is established, and that does not reverse.
- We run silently before naming anybody. Volume and false positive rates are judged before a single person is flagged to a human.
- False positives are counted and reported. A system judged only on catches drifts toward flagging everybody, and the people it flags carry that cost.
- We design what happens when somebody is cleared. That is the outcome most likely to cause lasting harm, and leaving it undesigned is the common failure.
Frequently asked questions about fraud detection
Does it identify fraudsters?
No. It flags patterns worth investigating. Concluding that somebody acted dishonestly is a human judgement with consequences we will not automate.
Why is that distinction so important?
Because a missed fraud costs money and a false accusation costs a relationship, sometimes a career, and occasionally is never fully repaired.
Are the two errors not equally bad?
They are not symmetrical and most systems are tuned as though they were. That asymmetry should shape the whole design.
Who should receive a flag?
A trained investigator. A line manager given an alert about somebody they work with daily acts socially before anything is established.
How many alerts will we get?
As many as you can genuinely investigate. A system producing more means none are investigated properly.
Why run detection without alerting at first?
So volume and false positive rates can be judged before a single person is named to anybody. Naming somebody is not reversible.
Do you measure false positives?
Yes, and report them alongside detections. A system judged only on catches drifts toward flagging everybody.
What happens when an investigation clears somebody?
It is designed in advance, because that outcome is the one most likely to cause lasting harm and it is usually left undesigned.
Can it score employees for risk?
We do not build persistent risk scores on people. A score follows somebody around and is read as an accusation regardless of documentation.
How long does it take to deploy?
Seven to twelve weeks, with case handling agreed before any detection is switched on.
Will it catch everything?
No, and a supplier claiming otherwise is overselling. Detection reduces losses rather than eliminating them.
Can it work on procurement fraud?
Yes, and supplier and purchasing patterns are frequently more tractable than transaction fraud because the volumes are lower.
Does it work for retail shrinkage?
Partly. Stock loss has many causes including error and damage, and treating all of it as fraud produces wrong conclusions.
What about customer fraud in insurance?
Yes, with the same framing. A claimant flagged and cleared has still been treated as suspect, and that needs handling.
Can findings be used in disciplinary proceedings?
The investigation can. The flag itself is not evidence of anything and should not be presented as though it were.
Will staff know they are monitored?
That is your decision and we would recommend transparency. Covert monitoring discovered later damages trust more than the monitoring gained.
Does it need historical fraud examples?
It helps considerably. Where you have none, detection works on unusual patterns rather than known fraud shapes, which is less precise.
Can it explain why something was flagged?
Yes, and the trigger is recorded and visible, since an unexplained flag cannot be investigated properly.
Who can see flagged cases?
Only your investigators. Case records are sensitive about people and should be tightly restricted.
What does detection work cost?
Transaction volume and investigation capacity determine it, quoted after the loss review.
Glossary of terms
Detection terms in plain language.
- False positive
- A flag on somebody or something legitimate, which costs relationships rather than money.
- Case
- Something warranting investigation, as distinct from a finding that anything wrong occurred.
- Silent running
- Detection operating without alerting, so volume can be judged before anybody is named.
- Threshold
- The sensitivity setting, which should follow investigation capacity rather than theoretical accuracy.
- Investigator
- Somebody trained to examine a case, as distinct from the subject line manager.
- Clearance
- An investigation finding nothing wrong, which needs a defined process of its own.
Related services in AI Solutions
Talk to us about fraud detection
Ask how many fraud cases you could genuinely investigate properly in a month. That number should set the detection threshold.
Start your project