#107
FRAUDFORWARD
#108Más allá del botón: investigando el fraude en la era de los pagos agénticos
12 min
¿Qué tal, luchadores contra el fraude? ¡Bienvenidos de nuevo a Fraud Forward!
En los últimos meses he tenido más conversaciones sobre pagos agénticos que sobre casi cualquier otro tema. En conferencias, en seminarios web y en conversaciones con algunas de las personas más brillantes en pagos, cumplimiento y fraude, una cosa se me ha hecho evidente: creo que estamos haciendo la pregunta equivocada.
La mayoría de la gente quiere saber si la IA empezará a mover dinero.
La pregunta a la que vuelvo una y otra vez es esta: ¿cómo investigan las transacciones los equipos de fraude cuando el software empieza a tomar decisiones?
En este episodio en solitario, reúno ideas de conversaciones recientes con Matt Vega, Mary Ann Miller y Matt Janiga para explorar qué significa realmente el comercio agéntico para las investigaciones de fraude, los reportes SAR y el futuro de las investigaciones de delitos financieros. Hablamos de por qué los modelos tradicionales de fraude siempre han asumido que un humano iniciaba el pago, por qué esa suposición ya no se sostiene y qué necesitarán entender los investigadores cuando los agentes de IA comiencen a tomar decisiones en nombre de los clientes.
La tecnología puede estar cambiando, pero los principios de una buena prevención del fraude no. La documentación, los registros de auditoría, la gestión de autorizaciones, la explicabilidad y una sólida monitorización de transacciones serán aún más importantes a medida que los pagos agénticos pasen de la teoría a la realidad.
Lo que escucharás en este episodio:
- Por qué los pagos agénticos son fundamentalmente diferentes de la automatización de pagos tradicional.
- Cómo el comercio agéntico cambia la forma en que los equipos de fraude investigan el fraude en los pagos.
- Por qué los registros de auditoría, la atribución y la explicabilidad se volverán esenciales durante las investigaciones de fraude.
- Cómo podrían evolucionar los reportes de SAR y las investigaciones de AML a medida que la IA se convierta en parte del proceso de toma de decisiones de pago.
- Por qué los reguladores se centran en permitir la innovación de forma segura en lugar de frenarla.
- Las tres preguntas que todo investigador de fraudes debería empezar a hacerse hoy para prepararse para el futuro.
Deberías escuchar este episodio si:
- Trabajas en prevención de fraude, cumplimiento de AML, investigaciones o delitos financieros.
- Presentar informes de actividad sospechosa o realizar reportes SAR.
- Dirigir operaciones de fraude, monitoreo de transacciones o investigaciones de pagos.
- Están evaluando cómo la IA y el comercio agéntico afectarán a su institución.
- Quieren pasos prácticos que su equipo pueda empezar a implementar hoy mismo en lugar de esperar a que el reglamento se ponga al día.
Notas del episodio
Los pagos agénticos requieren un nuevo marco de investigación
Durante décadas, las investigaciones de fraude han partido de una suposición: una persona inició el pago. Reconstruimos quién inició sesión, qué dispositivo utilizó, cómo se autenticó y qué acciones llevó a cabo.
Los pagos agénticos cuestionan ese modelo.
Cuando el software comienza a tomar decisiones en nombre de un cliente, los investigadores deben entender no solo quién es el titular de la cuenta, sino también quién autorizó al agente de IA, qué permisos recibió, si se mantuvo dentro de esos permisos y qué información influyó en su decisión.
Eso representa un marco de investigación completamente nuevo para los equipos de fraude.
Los registros de auditoría serán tan importantes como el historial de transacciones
Las investigaciones del futuro podrían depender tanto del historial del software como del historial de transacciones.
Los investigadores necesitarán cada vez más:
- Registros de actividad de los agentes
- Historial de permisos
- Historial de decisiones
- Cambios de autoridad
- Entradas de datos
- Registros de revisión humana
Estos registros de auditoría ayudarán a los investigadores a reconstruir por qué un agente de IA tomó una decisión de pago determinada y respaldarán tanto las revisiones internas como los exámenes regulatorios.
Los informes de SAR seguirán evolucionando
Los informes SAR actuales se diseñaron en torno a actores humanos. A medida que el comercio agente se vuelva más común, es probable que los reportes de actividades sospechosas incluyan narrativas más detalladas que describan actividades de pago iniciadas por IA, autoridad delegada, rutas de decisión, evidencia revisada y limitaciones conocidas.
En lugar de reemplazar los procesos de ROS existentes, los pagos agénticos ampliarán la forma en que los investigadores documentan investigaciones complejas de delitos financieros y respaldan el cumplimiento de la normativa ALD.
Conclusiones clave
- Una buena gobernanza sigue siendo una buena prevención del fraude. Una documentación sólida, una gestión adecuada de las autoridades, controles antifraude, monitoreo de transacciones y una buena gobernanza siguen siendo la base de una prevención eficaz del fraude.
- No necesitamos tener todas las respuestas antes de empezar a prepararnos. Comencemos con tres: ¿Quién autorizó la acción? ¿Qué autoridad se le concedió? ¿La actividad se mantuvo dentro de esos límites?
- Esas tres preguntas serán importantes tanto si estás llevando a cabo investigaciones de fraude, revisando fraudes de pago, presentando reportes de actividad sospechosa, apoyando investigaciones de AML o simplemente tratando de entender qué ocurrió.
Conclusión final
Los pagos agénticos no están reemplazando a los investigadores de fraude. Están cambiando lo que investigamos.
La identidad sigue siendo importante. Las relaciones con los clientes siguen siendo importantes. Pero a medida que el software empieza a participar en las decisiones financieras, las instituciones que inviertan en una mejor documentación, registros de auditoría más sólidos, una gobernanza reflexiva y controles de fraude modernos estarán mejor preparadas que aquellas que esperan a que las regulaciones las alcancen.
La innovación siempre ha avanzado más rápido que el reglamento. Nuestro trabajo como luchadores contra el fraude no es predecir todas las respuestas, sino empezar a hacer mejores preguntas.
Recursos y enlaces del episodio:
Conéctate con Hailey Windham, CFCS | LinkedIn
Anfitrión del pódcast Fraud Forward
Líder de la Comunidad Bancaria en Sardine
Especialista Certificado en Delitos Financieros (CFCS)
Rockstar de la cooperativa de crédito 2023, revista CU Magazine
Premio a la Mejora Continua, SAFE Federal Credit Union, 2023
Top 20 Profesionales Menores de 40, The Sumter Item, 2022
Episode transcript
Hailey Windham
00:05
What's up, Fraud Fighters? Welcome back to Fraud Forward. I will first address the elephant in the room. Yes, I am not in my normal podcast studio, am I? No, this week I am in Austin, Texas with Marketing Team with Sardine. So we are just having a great week of strategizing and having great conversations for what's to come. Very exciting time there. But obviously, it's still important to bring you an episode. So I'm very excited to have this conversation alone with myself in a room I'm not familiar with. But glad you guys are here. So thank you so much for showing up. Okay, over the last few months, I've probably said the words agentic payments more than any other topic. You know, talk about them in conferences. I've spoken about them on webinars. I've debated them with some of the smartest people in payments and compliance. And I recently had the opportunity to sit down with Matt Vega during an ACAMS webinar alongside Mary Ann Miller to discuss what agentic commerce means for fraud investigations and SAR reporting. Then I had one of my all-time favorite conversations ever on Fraud Forward with Matt Janiga from Modern Treasury. We started talking about, you know, the payment infrastructure, but somehow ended up talking about where payment or fraud operations are headed over the next decade. And here's what I've realized from that, right? Most conversations about agentic payments, I think, are asking the wrong questions. You know, everyone wants to know, will AI be moving the money? I think the more important question is, how do fraud teams investigate transactions when software starts making decisions? Because that's the world that we're headed towards. And frankly, I don't think we're as far away from that as many people believe. So for decades, we built fraud programs around one very simple assumption that a human initiates the payment. You know, someone logged in, someone clicked submit, someone approved the wire, someone entered the the routing number.
Hailey Windham
02:08
You know, everything from fraud monitoring to dispute investigations to SAR reporting starts from that assumption. Even our investigations reflected, right? We reconstruct what the customer did, what device they used, where they logged in from, whether they authenticated, whether they changed information beforehand. But agentic commerce challenges that entire investigative model. Because now the customer may not be the one clicking anything. Instead, they've authorized software to act on their behalf, which is a completely different world. So one thing that Matt Vega emphasized during our webinar was something, I think, that gets confused all the time. And it's that automation isn't new. So we've had those reoccurring ACH payments. Autopay, schedule of wires, payroll, you know, the standing instructions. Those aren't agentic. Those are automated. The customer made the decision once. The system repeats it. Agentic systems are different. So they're making decisions. They are comparing prices, negotiating purchases, choosing the merchants, determining timing, moving funds based on goals instead of fixed instructions. That's a massive shift. Because now the software isn't just executing instructions. It's exercising judgment. So the investigation changes. And again, this is the part that fascinates me. Today, if I investigate fraud, I'm asking who logged in? Who clicked the button? Was the customer manipulated? Was the device compromised? Tomorrow, though, my investigation looks different. Now I'm asking who authorized the agent? What permissions did it have? What information was available when it made that decision? Did it stay within its authority? Has its behavior changed? Notice anything? Like, did something change, right? I'm no longer just investigating a customer. I'm investigating the customer and the software acting on their behalf. That's a completely different investigative framework. And one concern, though, that I hear constantly is, so who's responsible? Honestly, identity doesn't disappear. The customer still owns the account. The customer still granted authority. But attribution gets much harder. Marry Ann Miller framed this perfectly during our webinar when she said that, you know, the challenge isn't proving who owns the account. It's reconstructing the decision path. That's why auditability becomes incredibly important. Investigators may soon need, you know, agent logs, permission history, decision history, data endpoints, input, excuse me, authority changes. Think about it. You know, today's investigators rely heavily on that transaction history. But tomorrow's investigations may rely just as much on software history. [Ad Break (5:03): Finally, I'm so happy to share with you all that the Saturday Fraud Strategist is now a podcast. What? Yeah. On top of my weekly newsletter, you could now listen to and watch me talk about my, and hopefully your, favorite topic, fraud strategy. And from time to time, I'll be hosting operators and founders to discuss where the industry is headed and what we, fraud fighters, should pay attention to. I must say, I'm super excited. And if I'm being honest, a bit nervous about all of this. I've been debating with myself whether to start a podcast for ages, but kept putting it off. But now, this teaser is out, so I guess there's no turning back. So, if you want to join me for the ride, head over to Sardinia's website and subscribe now. Are you ready? Am I ready? We'll find out next Saturday.]
Hailey Windham
06:02
One of my favorite parts of the ACAM's discussion was talking about SARS. You know, current SAR guidance assumes human actors. So, what happens when software becomes part of the story? I don't necessarily think that we, you know, need brand new SAR forms, but I do think that the narratives will evolve. So, imagine writing a SAR that includes an AI agent initiated payment activity, authority granted, scope of permissions, decision path, human review performed, evidence reviewed, known limitations. There's a much richer story there for law enforcement. And honestly, it becomes, you know, it may become necessary because another question emerges then is, who's the suspect? Who's the customer, the fraudster, the person that's manipulating the customer? Or did the agent simply operate exactly as instructed? Those aren't theoretical questions anymore. They are operational questions. So, I will say, though, that Matt Janiga changed the way I think about this. When he came on to Fraud Forward, we actually weren't planning to spend much time talking about AI. We, you know, we started talking about payment infrastructure, modern treasury, APIs, cloud-native banking. Then he said something that I just truly, I can't stop thinking about.
Hailey Windham
07:17
He reminded me that, you know, Dodd-Frank was written in a world of fax machines, corded telephones and human-staffed call centers. Think about that. You know, our regulatory frameworks, our investigative assumptions, our operational playbooks were built for an entirely different payments ecosystem. Today, money moves instantly. Infrastructure lives in the cloud. Fraud happens in milliseconds. And increasingly, software participates in financial decisions. The infrastructure changed. Now investigations have to also. There's one thing that I appreciated hearing from both Matt Vega and Matt Janiga, the two Matts, and it's that regulators aren't asking, how do we stop innovation? Increasingly, you know, they're asking, how do we enable it safely? Which is encouraging because fraud teams shouldn't wait for that perfect guidance. We already know what good governance looks like. You know, it's documentation, it's explainability, audit trails, authority, management, monitoring. Those principles don't change, right? Only the technology does. So, for those of you that are taking away anything from this or would want to know, like, where to start, I'd begin with three questions. Who authorized the action? What authority was granted? And did the activity remain within those boundaries? Those three questions will matter, whether you're filing a SAR, investigating fraud, answering an examiner, or simply just trying to understand what happened. I honestly think that those three questions become the foundation of fraud investigations over the next decade. So, in closing, right, for this short episode, solo episode, where I just kind of reiterate what I've learned over the last couple of weeks with agentic payments, is that agentic payments aren't replacing, you know, the fraud investigators and how we do things. They're changing what fraud investigators investigate. It's a very important distinction. The customer relationships still exist. Identity still matters. Fraudsters aren't disappearing, but the story behind every transaction is becoming more complex. And institutions that prepare now by, you know, improving documentation, thinking about attribution, and building those stronger audit trails, these are going to be the ones that are in a much better position than the ones waiting for regulators to hand them a playbook of, show me how to do it. And, you know, that's because if there's one thing that we've learned throughout the history of payments, innovation always arrives before the rulebook. Our job isn't to predict every answer. It's to start asking better questions. So, that's it in a nutshell for this week and my thoughts on that. I really just, I felt like it was an important conversation that if I was a newbie fraud person and you started talking to me about agentic payments, I would look at you and say, that's not going to happen anytime soon. But it is. We need to be ready for it and we need to make sure that our institutions are as well. So, that's my food for thought. I am again, sorry for my boring background. Don't worry, we'll get back to our regularly scheduled episodes, right, where I'm in the office. And actually, next week I will be at the ACFE Boston. So, if you're hearing this on Wednesday, come find me and love to have a conversation with you, love to get a picture, love to, you know, just have a nice chit-chat. Excited for that opportunity again for my first ever time at the ACFE Global Conference. I've attended virtually before but never in person. So, this is a real treat for me. Super, super thankful for starting, for setting this up. So, that's it for today. Thanks for joining me for another riveting episode of Fraud Forward. Oh, and please, if you love me, why don't you hit that subscribe button, like the video, do all the things on YouTube that all the podcasters normally say that I'm supposed to say. So, hit that subscribe button because you want to and you want to support me and the show and the efforts. So, anyways, stay vigilant, stay informed, keep moving Fraud Forward. Thanks for listening to Fraud Forward.
Hailey Windham
11:51
Remember, every conversation, every connection and every insight moves our industry one step closer to stronger fraud defenses. If today's episode sparked an idea, share it with your team or tag me on LinkedIn. I love hearing how you're moving Fraud Forward in your own organization. Until next time, stay curious, stay resilient, keep moving Fraud Forward.
View full transcript
