--- title: Leveraging AI for Fraud Investigations: Why Investigators Are the Next Builders source_page: https://www.sardine.ai/media/fraud-forward/episodes/leveraging-ai-for-fraud-investigations canonical: https://www.sardine.ai/media/fraud-forward/episodes/leveraging-ai-for-fraud-investigations format: text/markdown date: 2026-10-28T01:01:00.000Z description: Leveraging AI for fraud investigations works best when investigators lead. How to build trusted AI tools and keep institutional knowledge… --- **Quick links:** [Human page](https://www.sardine.ai/media/fraud-forward/episodes/leveraging-ai-for-fraud-investigations) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo) --- # Leveraging AI for Fraud Investigations: Why Investigators Are the Next Builders **Published:** 2026-10-28T01:01:00.000Z Leveraging AI for fraud investigations works best when investigators lead. How to build trusted AI tools and keep institutional knowledge… What’s up fraud fighters, and welcome back to Fraud Forward! I first came across Assaf Kipnis through his work online, and more recently he shared a post about realizing he was more than an investigator. Assaf has spent 13 years in security, trust and safety, and fraud, with investigation roles at LinkedIn, Facebook, Google, and ElevenLabs. Today he runs his own consultancy focused on investigations, AI builds, and threat intelligence. In our conversation, he raises a question I hadn’t considered. While we as an industry are debating whether AI will replace fraud investigators, the people committing fraud are using AI to experiment, innovate, and improve their operations. What happens if we remove the very people who help us stay ahead? We talk about leveraging AI for fraud investigations in a way investigators can actually trust. That includes the AI fraud investigation tools that are being built, why context matters more than hallucinations, what human in the loop really means, and how a fraud knowledge base can keep institutional knowledge from walking out the door. Let’s get into it. What you’ll hear in this episode: Why modern fraud operations run like companies, with goals, leaders, and recruiting, and why taking down a thousand accounts doesn’t slow them Why replacing fraud investigators with AI could become a competitive disadvantage for fraud teams How Assaf built an open source investigation tool that connects OSINT sources and saves evidence to disk Why hallucinations are less of a risk than AI making decisions with incomplete or outdated context What human in the loop and human on the loop mean in practice, and why reviewing every AI decision doesn’t scale Why most of an AI build should be deterministic code, and where a language model earns its place How an investigator’s adversarial mindset helps when building with AI, including treating the model like a threat actor How a fraud knowledge base captures what experienced investigators know and keeps it after they leave What fraud leaders should do instead of bolting AI onto existing processes You should listen to this episode if you: Wonder whether AI will replace fraud investigators, or have been asked to automate investigations Lead a fraud team and want a practical path for an AI transformation that keeps your expertise Are an investigator or analyst who feels capped by not writing code and want to see what changes with AI Want to learn how to build AI fraud investigation tools with guardrails and traceable evidence Worry about what happens to your team’s knowledge when experienced people leave ### Episode notes Fraud operations run like businesses Assaf has spent years at some of the largest platforms, and he told me the picture of a lone fraudster has been out of date since about 2020. Today’s scam operations have a corporate structure. There are people doing the grunt work, leaders, and teams that handle recruiting and infrastructure. He doesn’t think taking down a thousand accounts does much damage to an operation like that. Attackers also have it easier than we do. They don’t worry about false positives or growth. They only need to find one way in, and fraud is their whole business. I mentioned that at a community bank or credit union, we’re often just trying to stop the one. His point was that we can’t defend well against something until we understand how big it really is. Why cutting investigators could cost us the race I asked Assaf about the push to use AI to cut headcount and automate investigations. He sees real risk there. Building an AI tool is a software development project, and a model doesn’t know the details of your organization. Take away the people who know how to fight fraud, and you end up with automated decisions you aren’t prepared for. He also reminded me that agents don’t remember yesterday the way a person does, and they don’t come up with new ideas on their own. Meanwhile, the people committing fraud aren’t cutting their teams. They’re putting people to work building with AI and trying new things. A bank executive once told me these tools are too agreeable to make good decisions. Without people in the picture, we end up busy and no further along. The tool Assaf built, and why evidence matters Open source investigations take a lot of patience. Assaf built a tool to handle the legwork. It connects to several OSINT sources and APIs, including VirusTotal and Spamhaus, and it follows the investigative method he has learned over the years. When he opens a case, it creates the evidence folders and sends out a swarm of agents to find links, affiliates, and related activity. Everything is saved to disk, and nothing stays in the model’s context because he doesn’t trust that. He stays involved the whole way. He questions what the tool finds and points it in a new direction when needed. When it finishes, it produces a document with screenshots and sources he can trace back to where each finding came from. I love that detail. An investigator can trust a tool when every finding comes with its evidence. Context is a bigger risk than hallucination Assaf was careful here. He doesn’t want anyone to leave thinking hallucinations don’t matter, because they do happen, mostly when he works outside his own system. What worries him more is a model making a judgment with incomplete or wrong context. He compared it to an analyst who reads a ten year old report and builds a whole decision on it. The model isn’t lying. It just grabbed the wrong data. He also doesn’t rely on what a model learned in training. Instead, he asks it to research the topic first and then uses that research to make the call. I compared it to asking an investigator to look into something without telling them what type of fraud it is. Nobody would expect good results. The same goes for AI. A decision is only as good as the context behind it. Human-in-the-loop is more than a checkbox Assaf thinks “human-in-the-loop” has turned into a buzzword. If it means someone reviews every AI output, the work slows to a crawl. He described two kinds of loops. In development, he wants the AI to tell him when something breaks or when it reaches a decision it isn’t allowed to make. In fraud and safety, the loop is more about false positives and review at the end. To keep oversight manageable, he builds most of a tool with regular code and uses the model only in specific places. He won’t ask a model to read a stack of logs. He has it write a script that parses them, then asks the model to reason about the patterns. A yes, a no, or a number should come from code. What I took from this is that the real work is deciding where AI gets to make a decision and where it doesn’t. Investigators are the next builders For years, Assaf hit the same ceiling. He had ideas, but without coding skills he had to rely on engineers who needed time to understand what he meant. AI removed that ceiling. He can now be the kind of analyst builder he always wanted to hire. He says his adversarial mindset gives him an advantage when he builds. He treats the model like a threat actor. It isn’t malicious, but it will eventually do something he didn’t expect, and he plans for that moment. When a build goes wrong, he stops and runs a root cause analysis, and he turned that process into a skill. Investigators ask good questions and see problems early, and he thinks that makes them the next wave of builders. I loved hearing that. It tells me investigators have more to offer than we give them credit for. Turning what people know into infrastructure I asked Assaf how we capture the gut feeling an experienced investigator gets when a file looks off. His answer was a knowledge base. Every report and finding goes in. People talk with the model as they work, and it learns from their questions. When someone leaves, or just forgets what they did last month, the team can ask what happened the last time something similar came up. It also takes care of the “did you read the wiki?” problem. The answer comes from knowledge that was added while people worked. Assaf was honest that this is hard to build at scale and hard to do after the fact, and that people are still needed. Someone has to make mistakes and learn from them. For leaders, his advice was to sit down with each investigator, break the work apart, and rebuild it with AI. Bolting AI onto current processes is tempting because it’s fast and cheap. He hopes that in five years the small tasks will be automated well enough for investigators to focus on bigger decisions. That’s a future I’d like to see. ### Key takeaways Fraud operations run like organized businesses, and taking down individual accounts rarely slows them. Replacing fraud investigators with AI removes the expertise needed to build and guide AI tools. AI doesn’t know your organization, doesn’t remember what it learned, and can’t innovate without people. Traceable evidence is what makes an AI investigation tool trustworthy. Save findings outside the model’s context. Context is a bigger risk than hallucination, because a model that finds the wrong data will make the wrong decision. Human-in-the-loop means deciding where AI may make decisions and when it must ask for help, and not reviewing every output. Most of an AI build should be deterministic code, with the model used in specific, gated places. An investigator’s adversarial mindset helps when building with AI, and root cause analysis turns failures into lessons. A fraud knowledge base keeps institutional knowledge when people leave, and people are still needed to feed and correct it. Fraud leaders should rebuild processes with their investigators and avoid bolting AI onto what already exists. ### Final takeaway We spend a lot of time talking about what technology can do. Assaf’s reminder is that it works best when it strengthens the people who understand the problem. Your team already holds knowledge that may never have been written down, from the pattern that feels off to the story behind a decision made years ago. Before you decide where AI fits, ask how you can capture that expertise and put it to work, and how your investigators can help design what comes next. The need for investigators isn’t going anywhere. Episode resources & links Want more fraud fighting in your inbox? Subscribe to The Monday Fraud Fix. My weekly newsletter with the trends, stories, and takeaways I’m paying attention to. Subscribe here. Connect with Assaf Kipnis | LinkedIn Owner and Head Consultant at ASK Consulting Connect with Hailey Windham, CFCS | LinkedIn Host of the Fraud Forward Podcast Banking Community Lead at Sardine Certified Financial Crimes Specialist (CFCS) 2023 Credit Union Rockstar, CU Magazine Continuous Improvement Award, SAFE Federal Credit Union, 2023 Top 20 Professionals Under 40, The Sumter Item, 2022