Behavioral scoring, trained classifiers, and fraud network graph analysis — active on every transaction.
Caspix runs a multi-layer scoring system in production: concurrent behavioral and network scoring, trained ML classifiers, fraud network graph analysis, six autonomous analysis agents, and a natural language Alert Analysis Copilot — all live today, not on a roadmap.
Three layers of AI, all live in production
Each layer operates independently and feeds the next. Behavioral scoring runs in milliseconds; agents and Copilot run on analyst demand.
Real-Time Scoring Pipeline
Every transaction passes through concurrent behavioral rule signals, trained ML classifiers, behavioral anomaly detection, and fraud network graph analysis — all in parallel, in milliseconds.
Autonomous AI Agents
Six specialist agents run on demand: fraud analysis, rule optimization, insider threat detection, regulatory report drafting, executive intelligence, and alert triage.
Alert Analysis Copilot
A natural language interface that lets analysts query the entire platform — transactions, alerts, cases, account history, and network relationships — in plain English.
Four decision tiers in one unified score
A continuous 0–100 risk score maps to one of four outcome tiers. Every decision includes a full breakdown of which signals contributed and why.
Transaction passes all risk signals. Logged and allowed through with no analyst intervention required.
Elevated signals present. Transaction is allowed but logged with full signal attribution for analyst review.
Multiple risk signals triggered. Transaction is routed into the analyst review queue for disposition.
High-confidence fraud signals. Transaction is blocked automatically before execution with a fraud alert created.
20+ signals across seven intelligence categories
Detection signals span device identity and live telco verification, behavioral baselines, financial crime typologies, network and location intelligence, customer risk, and fraud network relationships — all feeding into the ten-module scoring pipeline.
Device Fingerprint Anomaly
Every device builds a behavioral profile over time. Significant deviations from an established device signature: hardware, software, or configuration changes are flagged for elevated scoring.
Device History Risk
Devices previously linked to compromised sessions or confirmed fraud incidents carry a persistent risk contribution on subsequent transactions.
SIM-Device Mismatch
When a mobile identity appears across multiple device profiles in a compressed window signifying a pattern consistent with SIM swap attacks, a targeted risk signal is applied.
SIM Swap Validation
When a transaction involves a mobile number, Caspix queries the subscriber's SIM swap history directly with the network operator, covering a full 7-day lookback rather than a narrow same-day check. A swap confirmed in the preceding 24 hours scores as critical risk and 24–72 hours as high risk; the window still extends out to 7 days because sophisticated attackers deliberately wait days after porting a victim's number before moving funds, precisely to slip past a shorter detection window. This check fires in the scoring pipeline before the transaction is authorized.
Subscriber Status Verification
The subscriber's current status is verified at the point of transaction. A barred number, suspended account, or confirmed name mismatch against the bank's own customer records generates an independent fraud signal to flag situations where the network operator has already identified a problem the bank has not yet seen.
Network Auto-Detection
The correct operator is identified from the payment gateway's channel metadata — the source that banks' own transaction systems stamp on every mobile money event. If channel metadata is absent, transaction type and subscriber number prefix serve as fallbacks. Only the relevant operator is queried, keeping latency low and eliminating unnecessary API calls.
Off-Hours Activity
Transactions initiated outside normal banking operation windows receive elevated risk contributions based on time-of-day analysis.
Dormant Account Reactivation
Accounts with recent DORMANT status that suddenly initiate transactions receive an elevated risk contribution.
Daily Velocity Spike
Transaction count and cumulative daily amount are tracked per account. Unusual spikes relative to the account's established behavioral baseline trigger scoring contributions.
Interaction Pattern Deviation
Passive analysis of session interactions — timing, rhythm, and navigation sequences — is scored against each account's established behavioral baseline. Deviations consistent with account takeover or automation are flagged.
High-Value Transaction
Large transactions receive score contributions scaled to the amount — larger amounts contribute proportionally more, relative to institution-configured thresholds.
Odd-Amount Structuring
Odd-amount transaction patterns inconsistent with natural payment behavior are flagged as structuring indicators — a recognized financial fraud typology.
Circular Transfer Loop
When funds cycle between two accounts within a short detection window, a circular transfer pattern is detected and scored.
High-Risk Network Indicator
Transactions originating from anonymization infrastructure, known high-risk IP ranges, or networks associated with prior fraud incidents receive elevated scoring.
Geographic Anomaly
When a transaction's physical origin is inconsistent with the account's established location history, a geographic anomaly contribution is applied.
Cross-Border Risk Signal
Transactions crossing national boundaries outside an account's established behavior — or involving jurisdictions with elevated risk profiles — contribute to the composite score.
Customer Risk Tier
Customers flagged as HIGH or MEDIUM risk tier contribute weighted score increments to every transaction they initiate.
KYC Verification Status
Customers with PENDING KYC status — unverified identity — add a score contribution regardless of transaction amount.
New Beneficiary Large Amount
Significant amounts sent to a first-time beneficiary are flagged for social engineering, drugging, ATO and mule account exposure.
Fraud Ring Connectivity
Accounts with verified network-level connections to confirmed fraud actors — even through several intermediary hops — receive a direct risk contribution independent of behavioral signals.
Mule Account Pattern
Accounts exhibiting structural money-mule characteristics — receiving funds from multiple sources and immediately forwarding them — are identified through relationship pattern analysis.
Shared Infrastructure Signals
Multiple accounts sharing device, network, or contact attributes in patterns inconsistent with legitimate relationships are flagged for network-level risk.
Three models, one five-model ensemble, live in production today
Rule signals combine with three trained ML models — combined into a five-model weighted ensemble — running in parallel on every transaction scored.
XGBoost Fraud Classifier
A gradient-boosted classifier trained on analyst-labeled case outcomes and served via ONNX runtime. It produces a calibrated fraud probability that carries the largest single weight in the composite ensemble — retrainable as new labeled data accumulates, with Platt calibration parameters written back to the model registry automatically.
- Trained on labeled outcomes from the case management system
- Served via ONNX runtime for CPU-efficient inference
- Platt calibration fitted in the retraining pipeline and stored in the model registry
- Falls back to a heuristic classifier if no trained model is loaded
Behavioral Anomaly Detector
A per-account unsupervised model that maintains a behavioral baseline for every account and scores each new transaction against it — surfacing statistically unusual behavior independently of any defined rule. Baselines update automatically after every transaction and adapt to legitimate behavioral change over time.
- Per-account baselines built and updated after every transaction scored
- Detects anomalies the rule engine has no explicit signal for
- Baseline adapts to legitimate behavioral change over time
- Model drift monitoring alerts when scoring behavior shifts from its own baseline
Five-Model Weighted Ensemble
The three scored models — XGBoost classifier, fraud classifier, and anomaly detector — combine with an isolation score and a graph score into a single five-model weighted ensemble. Weights are stored in the model registry, not in source code, and can be rebalanced by an authorized MRM officer as relative model performance changes over time.
- Five inputs: XGBoost, fraud classifier, anomaly detector, isolation score, and graph score
- Weights stored in the model registry and adjustable without a code deployment
- Champion/challenger evaluation compares challengers to the live champion before promotion
- Human approval gate required before any model advances to champion status
Network graph analysis running on every transaction
Behavioral signals alone miss coordinated fraud. Caspix runs a live network graph analysis in parallel with behavioral scoring — mapping relationships between accounts, devices, and actors to detect patterns invisible in individual account data.
- Fraud ring membership — direct network connections to confirmed fraud actors
- Mule account patterns — fund aggregation and immediate forwarding structures
- Insider-account linkages — staff-to-customer relationship flags for analyst follow-up
- Multi-hop fund tracing — laundering paths identified across account chains
- SIM swap chains — mobile identity appearing across multiple device histories
- Shared infrastructure clustering — accounts grouped by shared device or network attributes
Why graph detection matters
Behavioral signals miss coordination
A mule account with no prior fraud history scores low on every behavioral signal. Its fraud ring membership — visible only in relationship data — is what flags it.
Independent weight — not averaged away
Graph intelligence contributes directly to the composite score. Relational evidence is weighted independently so it cannot be diluted by clean behavioral signals.
Fails safe — no impact on SLA
Graph analysis degrades gracefully when unavailable. All other scoring modules continue unaffected, maintaining ingest throughput and response time commitments.
Transparent decisions. Auditable at every step.
All intelligence modules run concurrently per transaction. Every score is accompanied by a full breakdown of which signals contributed, at what weight, and why — visible to analysts and written to the audit log in structured form for SIEM ingestion.
- All intelligence modules run concurrently — no signal waits for another
- Each module returns a named contribution, a score delta, and a human-readable reason
- Composite score capped at 100 with configurable per-tier thresholds
- Full attribution in every fraud evaluation response — analyst-visible and SIEM-logged
- LIME-style feature attribution identifies the dominant contributors to each outcome
- Recommended analyst actions generated per decision — severity-appropriate and actionable
- Model drift monitoring and shadow scoring run continuously post-evaluation
Every decision is explained
Each fraud evaluation returns the composite score, the signals that contributed, and a human-readable narrative — visible to analysts and written to the audit log.
Structured SIEM output
Scoring results are logged as structured events for ingestion into your SIEM pipeline — with risk level, action taken, and contributing signal identifiers.
Self-monitoring ML
Shadow scoring and model drift monitoring run automatically after every transaction. If the scoring model's behavior shifts, an alert surfaces before it impacts detection quality.
AI agents that investigate so analysts don't start from zero
Six specialist AI agents run on demand, each focused on a specific analysis or operational task. All are live in production.
Fraud Analysis Agent
Assigned to any alert, it pulls transaction history, device history, graph signals, and prior alert records for the account and every linked entity, traces the attack sequence, and returns a structured analysis narrative with recommended next actions — in seconds rather than hours.
Rule Optimization Agent
Analyzes false positive and false negative patterns across the live detection engine and surfaces concrete tuning recommendations — identifying which rules are generating noise, which thresholds are too permissive, and where new rule coverage would improve signal accuracy.
Insider Threat Agent
Detects collusion between internal staff and customer accounts by running behavioral and relationship-level analysis across the twelve built-in insider threat rule categories — dormant reactivation chains, GL manipulation patterns, same-staff initiate-and-approve sequences, and multi-staff exception clusters — without relying on manual reporting.
SAR Drafting Agent
Drafts Suspicious Activity Reports for qualifying cases — those with confirmed fraud exposure at or above KES 500,000 — pre-populated with case evidence, transaction timeline, account summary, and a regulatory narrative aligned to CBK and FRC requirements. Analysts review and approve before any submission; the agent never submits directly.
Executive Intelligence Agent
Generates daily institutional fraud posture summaries covering 24-hour alert volumes by severity and channel, top fraud rule vectors, estimated financial exposure, seven-day trend analysis (improving, stable, or deteriorating), and emerging threat patterns — automatically refreshed and cached for fast dashboard reads without rerunning queries on demand.
Alert Triage Agent
Automatically prioritizes and routes incoming alerts based on risk score, account fraud history, and analyst queue depth. A minimum five-percent sample of auto-suppressed alerts is routed to a human review queue, and every suppression decision is written to the audit trail with the threshold values and score used — satisfying FATF guidance on automated AML monitoring controls.
Query your entire fraud platform in plain English
The Alert Analysis Copilot is a natural language analysis interface built for fraud analysts. Instead of building queries or navigating dashboards, analysts describe what they need — and the Copilot assembles an analyst-grade response from live platform data.
- Query transactions, alerts, cases, account history, and network relationships in plain English
- Live data retrieval — responses are grounded in current platform data, not static reports
- Streamed responses for long analysis sessions — results arrive as they are assembled
- East African fraud typology context built in: SIM swap, mobile money, agent banking, insider collusion
- Every response cites specific data points — account IDs, amounts, dates, signal attributions
- No SQL or technical skills required — designed for frontline fraud analysts
Example Copilot queries
“Show me all accounts and recent alerts linked to 0712 345 678.”
“Why was this transaction blocked? Explain each contributing signal.”
“Are there any mule account patterns in accounts opened in the last 30 days?”
“Which active cases involve the same device as this alert?”
“Summarise the fraud exposure on all HIGH-risk accounts opened this quarter.”
“What is the SIM swap history on the account from that last alert?”
Where we are, and where we are going
The full detection and analysis stack is live today. The roadmap builds deeper learning on top of it.
Full Detection and Analysis Stack
Ten concurrent intelligence modules feeding a five-model weighted ensemble, live telco verification from Safaricom and Airtel Kenya, a Neo4j fraud network graph, six autonomous investigation agents, and the Alert Analysis Copilot — all live in production. MLOps governance controls are also live: champion/challenger evaluation, shadow scoring, drift detection, fairness testing wired as a promotion gate, and human approval required before any model reaches production. The XGBoost retraining pipeline accepts a bank's existing historical fraud records at onboarding — the model is calibrated and operational from day one, without waiting for data to accumulate on the platform. Federated learning (FedAvg with differential privacy) is live, enabling consortium-wide feature importance sharing without any institution exposing raw transaction data.
Deep Learning Signal Models
Sequence and temporal fraud detection is already live as a heuristic module (SequenceIntel). Next phase replaces its pattern scoring with LSTM models trained on labeled transaction sequences — improving detection of slow-burn account takeover and multi-step fraud patterns that resist rule-based approaches. Graph neural networks will similarly replace the heuristic Neo4j community detection with learned entity embeddings; this requires graph-structured relational training data — node and edge labels from closed investigation records — rather than transaction-level labels alone.
Iterative Agentic Analysis Loops
Current agents are one-shot: given a case or alert, they assemble context from the platform and return a structured output in a single pass. Future agentic loops will iteratively pull additional data mid-analysis — forming hypotheses, querying further context, and refining conclusions across multiple autonomous reasoning steps — without analyst prompting at each turn.
See the full AI stack against your fraud scenarios
We run structured demos against real-world East African fraud typologies — mobile money fraud, internal fraud, account takeover, and coordinated fraud rings.