Retail

AI‑Powered Fraud Investigation

From alert triage to case resolution — Lumi progressively collects evidence across internal and external systems, builds scenario-specific workspaces, and publishes writebacks to downstream platforms. Human-in-the-loop at every decision point.

Launch Interactive Demo See How It Works
Fraud Investigation Queue
Live
2
Immediate
3
Investigate
0
Resolved
FRD-2026-0471
Chargeback — $4,500 "never delivered" despite GPS proof
High
FRD-2026-0473
Account Takeover — SIM swap, 3 txns in 35 min
High
FRD-2026-0470
Return Abuse — 7 returns in 60 days, wardrobing
Review
FRD-2026-0472
Loyalty Fraud — 47K points, insider promo exploit
Review
FRD-2026-0469
Synthetic ID / BNPL — SSN age mismatch, bust-out
Review
7 Systems Connected
Lumi Active
5
Fraud Scenarios
7+
Systems Queried
3
Evidence Waves
100%
Human-in-the-loop
5 Unique Scenarios

Every case runs a different
investigation playbook.

Each fraud type has its own workspace, evidence sources, and resolution path. The system collects evidence progressively in 3 waves — internal signals, external signals, then deep analysis — so you see the investigation happen live.

5
Distinct playbook workspaces
Chargeback — Representment Builder
$4,500 dispute with GPS delivery proof, Instagram social evidence, and cross-merchant dispute history. Builds a complete representment narrative with win likelihood.
Evidence: OMS · Logistics · Social · Disputes
Account Takeover — Recovery Controls
SIM swap attack with impossible travel, 3 cash-out transactions in 35 minutes. Attack timeline, session revocation, and customer comms draft. Includes a device API timeout for realism.
Evidence: IAM · Carrier · IP Intel · Device
Return Abuse — Refund Hold
Serial wardrobing across 4 store locations — 78% return rate with social media proof. Policy rule evaluation, recommended paths, and LP referral.
Evidence: OMS · POS · Policy · Social · LP
Loyalty Fraud — Points Reversal
Insider promo exploitation with 12x velocity spike, linked accounts, and expired code bypass. Points accrual graph, network cluster analysis, and rule change suggestion.
Evidence: Loyalty · Promo · HR/IAM · Network
Synthetic ID / BNPL — Compliance Packet
Fabricated identity exploiting 3 BNPL providers — SSN age mismatch, fraud ring address link. Identity signal cards, risk explanation, SAR filing, and multi-provider notifications.
Evidence: Credit Bureau · BNPL · Compliance DB
The Challenge

Fraud investigation is fragmented and manual

Analysts juggle dozens of browser tabs, copy-paste evidence between systems, and write reports from scratch — while SLAs tick down and fraud losses mount.

Today
Tab-hopping, copy-paste investigations
Evidence gathered manually across 7+ disconnected systems
Same investigation template used for every fraud type
No audit trail of what was checked, when, and by whom
Writebacks to downstream systems done manually or forgotten
With Lumi
Progressive investigation, single pane of glass
Evidence collected progressively in 3 waves from all systems
5 unique playbook workspaces tailored to each fraud type
Full audit trail with grouped entries, systems touched, artifacts
Automated writebacks to payment, CRM, compliance, and LP systems
How It Works

A five-stage investigation pipeline

Each case flows through the same structured pipeline — mirroring how the interactive demo is organized. Click "Run Playbook" and watch the system work.

1
Overview
Case context — customer, transaction, risk triggers, and SLA timer
2
Investigate
Run playbook — progressive evidence collection in 3 waves, then scenario workspace
3
Audit Trail
Grouped log of what was checked — systems touched, artifacts, policy version
4
Review & Approve
Evidence summary, key findings, AI recommendation with confidence, approval gate
5
Publish
Progressive writebacks to payment, CRM, compliance, and LP systems with receipt
What Makes It Real

Not a mockup — a working investigation system

Every interaction in the demo reflects real fraud ops workflows. Here's what sets it apart from typical product demos.

Progressive Evidence Collection
Evidence doesn't appear pre-filled. Click "Run Playbook" and watch skeleton rows flip to verified, flagged, or missing — in 3 timed waves across internal and external sources.
Scenario-Specific Workspaces
Each fraud type loads a completely different workspace — representment builder, attack timeline, refund path selector, points graph, or identity signal cards. Not the same template with different text.
Human-in-the-Loop Approvals
The system recommends — but a human decides. Every case has a named approver, a confidence score with stated limitations, and the publish action is gated behind explicit sign-off.
Lean Grouped Audit
8-12 audit entries per case — not a firehose. Each entry logs the actor, systems touched, artifacts produced, and policy version. Replayable runs with unique IDs.
Source Unavailability
One case includes a deliberate API timeout — a device reputation service fails, evidence is marked "UNAVAILABLE" with a fallback note. Confidence adjusts downward. Real systems fail; ours handles it.
Sidecar Writebacks
After approval, writebacks execute progressively to payment processors, CRM, compliance databases, and loss prevention — each with a record ID and visual confirmation. Then "Open Next Alert" loops to the queue.
Demo Walkthrough

5 cases, 5 different investigations

Each case in the demo queue represents a distinct fraud scenario with its own playbook, evidence sources, and resolution path.

01
Chargeback Abuse — "Never Delivered"
Customer disputes a $4,500 sofa delivery despite GPS + photo proof. Evidence includes Instagram post showing the item at home. Representment narrative with 92% win likelihood.
02
Account Takeover via SIM Swap
$7,200 in 35 minutes across 3 merchants after a SIM swap. Attack timeline, session revocation, device API timeout (realism trick), and customer security notification.
03
Return Abuse — Serial Wardrobing
Fashion influencer with 78% return rate across 4 stores in 60 days. Policy rule evaluation (3 of 6 fail), social media cross-reference, and refund hold recommendation.
04
Loyalty Points — Insider Exploitation
47,200 points accrued at 12x velocity with expired promo codes. Linked accounts from same address/device, network graph cluster, and points reversal with rule change suggestion.
05
Synthetic Identity — BNPL Bust-Out
Fabricated identity with SSN belonging to a minor. $4,740 across 3 BNPL providers, fraud ring address link. SAR filing, multi-provider block, and compliance watchlist.

See it in action

Walk through all 5 fraud scenarios — click "Run Playbook" and watch evidence collect live, then approve and publish writebacks.

Launch Interactive Demo Back to All Demos
Loading...
Loading demo...