Your Fraud Engine Can Now Talk to AI Agents. Here Is Where We Draw the Line
Imagine you hire the fastest junior analyst in the world. It reads every case in seconds, works all night and never asks for a raise. It is also, now and then, completely and confidently wrong.
Would you let it approve payments? We would not. But we would give it a desk tomorrow morning.
That is how we think about the MCP Server in IBM Safer Payments. IBM showed it as a preview in March. With version 6.10 it became an official, supported part of the product, and since Safer Payments is the decision core of Legatus Core, the capability is now there for Legatus too.
The Model Context Protocol is an open standard, a common way for AI systems to call other systems. So the agent connects to the engine through a governed interface, and it can be any MCP-compatible platform. The LLM, the prompts and the rules around them stay your choice. That matters more than it sounds, in a market where the favorite model changes every few months.
What does the new hire actually do?
IBM describes agents that pull live risk data, correlate behavioral signals and prioritize cases. In daily work, we expect the first useful jobs to be much less glamorous:
- Draft the narrative summary when an investigator opens a case.
- Explain in plain language why a transaction scored the way it did.
- Answer an operational question without someone having to build a query for it.
None of this makes a decision. All of it removes legwork, and the arithmetic of legwork is brutal.
Take a team working 500 alerts a day at 15 minutes each. That is 7,500 minutes, or 125 hours, or about 16 analysts on an eight-hour shift. Now suppose a third of that time goes to collecting context rather than judging it. That is more than five analysts’ worth of work spent on assembling the file.
These are round numbers for illustration, not a benchmark. Put your own in. Whatever comes out is the real business case for an agent, and it has nothing to do with replacing anybody’s judgment.
Why not let it decide?
Start with the clock. Legatus is built around a latency budget under 10 milliseconds. LLM inference, as we wrote in our white paper in March, takes hundreds of milliseconds. Even at 300 milliseconds, one call costs thirty times the entire budget.
But speed is the weak argument. Models get faster. If latency were the only problem, we would just wait.
The strong argument is older than any of this technology, and banks already own it: the four-eyes principle. The person who prepares a payment is not the person who approves it. Nobody considers this an insult to the person preparing it. It is simply how you build a process in which one mistake does not become a loss.
An AI agent is one more actor in that old control. A deterministic engine gives the same answer to the same input and can show exactly which rule or model produced it. That is what you need when a cardholder disputes a decline and when an auditor asks why. A language model produces a very good text about why. It is not the same thing!
So the engine decides, the agent prepares and the analyst signs. Nothing about MCP changes that order. It only makes the preparation much faster.
How much rope, then?
We see four rungs, and we would climb them one at a time:
- Read. The agent looks up risk data and case history for an analyst who asked.
- Draft. It writes the summary or the explanation. A person reads it and owns it.
- Recommend. It proposes a priority or an escalation. A person accepts or rejects, and you measure how often it was right.
- Act. It takes a step on its own.
IBM’s own announcement talks about agents triggering defensive actions, and in the long run we do not doubt it. But the fourth rung needs orchestration beyond the MCP Server itself, and above all it needs evidence. The third rung is where you collect that evidence. Skip it and you are not innovating, you are guessing with somebody else’s money.
What should you ask before you connect one?
Four questions, before any pilot:
Who is the agent, in your systems? It needs its own identity and its own narrow role, like any employee. If it borrows an analyst’s access, your audit trail no longer tells you who did what.
Where does the data go? A case summary means card numbers, names and behavior passing through a model. Whether that model runs inside your perimeter or outside it is a PCI and GDPR question first, and an AI question second.
Who signs when the summary is wrong? It will be wrong sometimes. Decide now whose name is on the case, because after the first incident is too late.
What can the fraudster write into the prompt? This is the one we find most interesting, and it gets asked least. A payment reference, a beneficiary name, a free-text field: the criminal controls all of them, and now they land in front of a system that follows instructions written in plain language. Until now that field was just data. In an agent’s context, it can become a message addressed to your analyst’s assistant. Treat everything that comes from a transaction as untrusted input, the same way you already treat it everywhere else.
So where do you start?
Start with the case summary. Let the analyst sign it. Keep the log, read it after three months, and let the numbers decide about the next rung.
If you run Legatus Core or Safer Payments and want to map this to your own alert volumes and controls, talk to one of our experts.
