Explainable LLM fraud investigations, on a separate path
The Fraud Investigation Agent turns blocked transactions into plain-language case files a human analyst can act on. It runs a self-hosted language model on its own Kafka path, so it never touches — and never slows — the authorization flow.
Investigations only on declines
FIA consumes transactions.blocked — declines only. By design it never sees the bulk of legitimate traffic, which keeps the LLM workload small and focused on the cases that actually warrant investigation. Latency here is measured in seconds, and it is entirely off the authorization path.
The model is a self-hosted Phi-3-mini-4k-instruct instance. Because it runs under your own roof, transaction details and PII never leave your network to reach a hosted LLM provider — which matters for data-residency obligations under regimes like NDPR, CBN, and GDPR.
Structured reports analysts can trust
For each blocked transaction, FIA writes a structured report: a verdict, a recommended action, the key indicators that drove the decision, and a narrative that explains the case in ordinary language. Reports link back to their audit row, so an analyst can trace every claim to the underlying decision data.
Because of the roughly 7.6 GB of model weights, FIA is opt-in via docker compose --profile fia. Run it when you want automated investigation summaries; leave it off and the rest of the platform is unaffected.
- Consumes
transactions.blocked— DECLINE only. - Self-hosted Phi-3-mini-4k-instruct.
- Writes structured reports: verdict, recommended action, key indicators, narrative.
- Seconds latency; never touches the authorization path.
- Opt-in via
docker compose --profile fiabecause of ~7.6 GB weights.