Financial crime
Fraud and APP-scam rules that had to hold up in banking and payments
Fast, high-volume fraud and scam decisions that now have to be evidenced to a regulator or the Ombudsman after the fact.
Illustrative · anonymised and reconstructed from real work
The scenario
Where the decision had to hold under scrutiny
Fraud and scam rules operated across banking and payment environments, where decisions had to be made quickly and in volume. With mandatory APP-fraud reimbursement, the question was no longer only whether a rule blocked the right payments, but whether each rule’s logic, thresholds, and rationale could be evidenced to a regulator or the Financial Ombudsman after the fact. Illustrative work focuses on documenting why each rule exists, recording its calibration, and making decision outcomes traceable. This turns a rule set into one that can be defended on the record rather than merely explained afterwards.
What the scenario turns up
The issues
Finding 01
APP-scam reimbursement made every payment-block decision reviewable after the fact, but a rule set of this kind can grow into hundreds of overlapping thresholds no one can fully explain. A blocked genuine payment — or a missed scam — could not be justified on the record if the Ombudsman asked.
Finding 02
Aggressive rules were blocking legitimate payments, harming genuine customers and generating complaints the firm could not justify — while loosening them risked letting real scams through.
What the work does about each one
The response
Response 01
Rebuilds the rules around a documented rationale: each rule tied to the risk it targets, thresholds calibrated against measured false-positive and false-negative impact, and every firing logged with its reason and inputs — so any single decision can be reconstructed and defended months later.
Response 02
Recalibrates thresholds against measured customer impact and documents the trade-off behind each rule, so a blocked payment can be explained and the balance between protection and friction is a recorded decision rather than an accident.
How the work is done
The same five steps, applied to this decision
Every piece of work runs the same path. For this one, the weight falls on Discovery, Deploy & test, Assure & hand over — the steps where a decision of this kind is most often challenged.
Discovery
Map where the decision is made, who could challenge it, and the regime that binds it — before any logic is written.
Design
Set the logic out in the open so it can be read and questioned: the same inputs always give the same decision, and nothing is a black box.
Build
Build it with the checks in: coverage and oversight are confirmed before anything ships, and nothing unassessed is waved through as safe.
Deploy & test
Run it against real cases behind a human checkpoint, and keep a dated record of exactly what was decided and on what basis — one that cannot be edited afterwards.
Assure & hand over
Hand over the decision log and a plain-language write-up, so your team owns the record the moment someone says prove it.
Built for this problem
These automations can be shown to you running
What this kind of work once did by hand is now an automation that runs. It is shown by invitation rather than published, because every example in it is constructed and a synthetic case read out of context reads as a real one. Ask, and you will be walked through it deciding — including the cases where it refuses to conclude.
PSR mandatory reimbursement
APP Reimbursement Adjudication
The reimbursement decision itself, taken claim by claim — with the basis recorded as it is made, rather than reconstructed for the Ombudsman months later.
SYSC 6.3 · SS1/23
Fraud Rule Change Defensibility
The rule change evidenced at the moment it is made — what changed, against which risk, on whose authority — so the record exists before anyone asks for it.
DISP 1.3.3R
Complaint Root Cause and Response
The complaint a blocked payment produces, answered with the actual reason the rule fired and the root cause behind it.
Related cases
The same standard, holding elsewhere
Discuss your situation
A decision like this can be made correctly, and shown to be correct, on the record
A short discussion is usually enough to locate where the risk sits — in the logic, the controls, the evidence, or a combination — and where it is made to hold.