Paper deep dive
An AI Security Agent for Banking: Multi-Vector Fraud and AML Detection Across Retail and Corporate Accounts
Joseph Walusimbi, Joshua Benjamin Ssentongo
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 99%
Last extracted: 6/20/2026, 10:06:15 AM
Summary
The paper presents an AI security agent for retail and corporate banking designed to detect both signature-based fraud and behavioral financial crimes. The system utilizes a three-component fusion architecture—combining an LSTM sequence model, a statistical threshold monitor, and a graph/network module—operating on parallel transaction and session event streams. The agent demonstrates superior performance over rule-based and LSTM-only baselines, achieving an overall F1 of 0.787 for transactions and 0.867 for sessions. It also includes automated response tiers and customer-facing tools like a verification chatbot and an analyst assistant.
Entities (10)
Relation Signals (6)
Business Email Compromise (BEC) → detectedby → AI Security Agent
confidence 100% · The proposed model’s improvement comes entirely from the LSTM sequence model recognising the combination of add_payee + immediate large transfer...
AI Security Agent → processes → Transaction Stream
confidence 100% · operating on two parallel event streams: a transaction stream...
AI Security Agent → processes → Session Stream
confidence 100% · and a session stream (account takeover, session hijacking, SIM-swap, insider abuse)
AI Security Agent → uses → LSTM Sequence Model
confidence 100% · Each stream combines an LSTM sequence model...
AI Security Agent → uses → Statistical Threshold Monitor
confidence 100% · Each stream combines... a statistical velocity/threshold monitor
AI Security Agent → uses → Graph/Network Module
confidence 100% · Each stream combines... and a graph/network module
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Banks simultaneously face signature-based fraud (card-not-present attacks, account takeover, ATM cloning) and behavioural financial crime (structuring, layering, mule networks, business email compromise) -- two threat families with fundamentally different detection requirements. Static rule engines that reliably catch brute-force and high-velocity events are structurally blind to business-email-compromise (BEC) payment redirection, session hijacking, and money-laundering layering, which are engineered to appear indistinguishable from legitimate activity at the individual transaction or session level. This paper presents an AI security agent for retail and corporate banking that addresses this gap through a three-component fusion architecture operating on two parallel event streams: a transaction stream (card fraud, ACH/wire fraud, AML categories) and a session stream (account takeover, session hijacking, SIM-swap, insider abuse). Each stream combines an LSTM sequence model capturing per-account behavioural history, a statistical velocity/threshold monitor, and a graph/network module capturing account-counterparty relationship patterns (fan-in, fan-out, pass-through ratio) for money-laundering detection. Experiments on a synthetic event log of 237,669 transactions and 113,508 sessions across 13 threat categories and 3,470 simulated accounts demonstrate overall F1 of 0.787 (transaction stream) and 0.867 (session stream) for the proposed model, versus 0.562/0.733 for a rule-based baseline and 0.655/0.713 for an LSTM-only baseline. The agent includes a customer-facing transaction-verification chatbot (96.6% identity verification accuracy, 86.8% mass-reset attack detection) and an analyst case-summary assistant (99.3% action-recommendation F1), with Critical-tier automated response latency under 0.43 ms at the 95th percentile.
Tags
Links
- Source: https://arxiv.org/abs/2606.17555v1
- Canonical: https://arxiv.org/abs/2606.17555v1
Trouble viewing inline? Open PDF directly →
Full Text
33,827 characters extracted from source content.
Expand or collapse full text
An AI Security Agent for Banking: Multi-Vector Fraud and AML Detection Across Retail and Corporate Accounts Joseph Walusimbi Joshua Benjamin Ssentongo Abstract Banks simultaneously face signature-based fraud (card-not-present attacks, account takeover, ATM cloning) and behavioural financial crime (structuring, layering, mule networks, business email compromise) – two threat families with fundamentally different detection requirements. Static rule engines that reliably catch brute-force and high-velocity events are structurally blind to business-email-compromise (BEC) payment redirection, session hijacking, and money-laundering layering, which are engineered to appear indistinguishable from legitimate activity at the individual transaction or session level. This paper presents an AI security agent for retail and corporate banking that addresses this gap through a three-component fusion architecture operating on two parallel event streams: a transaction stream (card fraud, ACH/wire fraud, AML categories) and a session stream (account takeover, session hijacking, SIM-swap, insider abuse). Each stream combines an LSTM sequence model capturing per-account behavioural history, a statistical velocity/threshold monitor, and a graph/network module capturing account-counterparty relationship patterns (fan-in, fan-out, pass-through ratio) for money-laundering detection. Experiments on a synthetic event log of 237,669 transactions and 113,508 sessions across 13 threat categories and 3,470 simulated accounts demonstrate overall F1 of 0.787 (transaction stream) and 0.867 (session stream) for the proposed model, versus 0.562/0.733 for a rule-based baseline and 0.655/0.713 for an LSTM-only baseline. The agent includes a customer-facing transaction-verification chatbot (96.6% identity verification accuracy, 86.8% mass-reset attack detection) and an analyst case-summary assistant (99.3% action-recommendation F1), with Critical-tier automated response latency under 0.43 ms at the 95th percentile. I Introduction Financial institutions face a dual and diverging threat landscape. On one side are signature-fraud attacks — brute-force credential stuffing, card cloning, ATM withdrawals at clone-card velocity, ACH fraud with off-hours wire transfers — that produce individually anomalous events detectable by threshold rules. On the other side are behavioural-financial-crime patterns — business email compromise (BEC) payment redirection, money-laundering structuring, network layering, and mule account pass-through — where no individual transaction is anomalous; only the relationship among transactions, accounts, or time windows reveals the attack. Static rule engines, widely deployed in bank fraud and anti-money laundering (AML) systems, handle the first class competently but are structurally blind to the second. Business email compromise alone caused $2.9 billion in reported losses in 2023 across 21,489 US complaints to the FBI’s Internet Crime Complaint Center [11]; globally, BEC losses exceeded $55 billion over the preceding decade [12]. AML failures carry additional regulatory risk: missed structuring or layering patterns expose institutions to sanctions, reputational harm, and mandatory Suspicious Activity Report (SAR) filings. Machine learning approaches have been extensively studied for individual fraud categories: sequence models for card transactions [1, 5], graph neural networks (GNNs) for money-laundering network detection [7, 9], and isolation forest for general financial anomaly detection [2]. However, most existing work targets a single fraud category or a single stream (transactions only), and few systems integrate fraud detection, AML, and an automated response tier into a single operational agent covering both retail and corporate banking. This paper makes the following contributions: • A unified three-component detection architecture operating on two parallel streams (transaction and session), combining sequence modelling, velocity monitoring, and network graph analysis into a single fused risk score R∈[0,1]R∈[0,1] per event. • A comprehensive threat model covering 13 attack categories spanning retail fraud (card-not-present, account takeover, ATM cloning, session hijacking, SIM-swap), corporate payment fraud (ACH/wire fraud, BEC), insider abuse, AML (structuring, layering, mule activity, rapid fund movement), and cross-cutting dormant-account reactivation. • Experimental evaluation on a 90-day synthetic event log (237,669 transactions, 113,508 sessions, 3,470 accounts) demonstrating that the proposed fusion model achieves macro-average F1 of 0.303/0.529 (transaction/session), compared with 0.227/0.500 for rules and 0.158/0.283 for LSTM-only. • Two customer-facing components: a transaction verification chatbot and an analyst case-summary assistant, evaluated on separate datasets. I Related Work I-A Anomaly Detection for Financial Fraud Ahmed et al. [3] survey network anomaly detection techniques, identifying threshold rules and statistical profiling as the most widely deployed baseline approaches and noting their inability to detect slow, temporally distributed, or contextually camouflaged attacks. Chandola et al. [4] provide the foundational taxonomy of anomaly types (point, contextual, collective) that frames the detection challenge: BEC and structuring are collective anomalies — individually ordinary events that are anomalous only in combination. For transactional fraud detection specifically, deep learning methods have substantially outperformed traditional classifiers. Alghofaili et al. [5] apply LSTM networks to financial transaction sequences and report strong recall on credit card fraud. Bahnsen et al. [6] demonstrate that temporal and behavioural features (transaction recency, velocity, counterparty familiarity) are more discriminative than transaction amount alone, motivating our per-account behavioural baseline approach. I-B Graph Neural Networks for AML Money laundering detection presents a naturally relational problem: structured networks of mule accounts, shell companies, and layering chains are invisible at the level of individual transactions but manifest as graph-structural anomalies. Weber et al. [7] were among the first to apply graph convolutional networks to anti-money laundering in the Elliptic Bitcoin dataset. Lo et al. [9] extend this to heterogeneous graphs modelling multiple entity types (individuals, companies, transactions) and demonstrate strong AUC on real bank data from Norway’s DNB. Our graph sub-model is a lightweight proxy of this approach — using rolling fan-in/fan-out and pass-through ratio features rather than full GNN message-passing — appropriate for a prototype that must train and infer on a CPU-only node. I-C Multi-Category and Multi-Stream Detection Most fraud detection literature targets a single category. Work combining fraud detection with AML in a unified agent is less common. Motie and Raahemi [10] survey GNN applications to financial fraud detection broadly, noting the gap between single-category academic benchmarks and the multi-threat operational reality faced by bank fraud and compliance teams. Our work addresses this gap by covering 13 categories across two event streams within a single deployable agent. I Threat Model Table I enumerates the 13 threat categories covered by the proposed agent, classified by the primary event stream through which they manifest and their dominant detection challenge. The key observation motivating the architecture is that no single detection mechanism covers all 13 categories. Rules cover brute-force, velocity-burst, and single-transaction CTR triggers but score zero on session hijacking, dormant reactivation, and BEC. Unsupervised anomaly detection (Isolation Forest) adds coverage for some graph-like patterns but misses dormant accounts and SIM-swap (both require identity-state context). LSTM sequence models add behavioural context but remain unable to catch structuring without the aggregation signal the threshold monitor provides. The proposed fusion architecture is designed to combine all three signals without redundancy. TABLE I: Threat Model: 13 Categories, Streams, and Detection Challenges Category Stream Detection challenge CNP fraud Txn Burst at velocity from foreign city; no auth signal Account takeover Both Credential-stuffing; amounts may look normal post-ATO ATM anomaly Txn Multi-city withdrawals in physically impossible time Session hijacking Sess Same session, two different cities/devices mid-flow SIM-swap Sess Device enrol + MFA + reset in rapid succession ACH/wire fraud Txn Off-hours, large, new counterparty BEC redirection Both Amount matches regular transfers; only payee is new Insider abuse Sess Bulk record viewing by authorised staff account Dormant reactivation Both No active signal; requires account-history context Structuring (AML) Txn Below-threshold cash deposits summing above CTR Layering (AML) Txn 1 large inbound → many outbound; pass-through ratio Mule accounts Txn High fan-in from strangers + rapid outbound Rapid fund movement Txn Burst of outbound transfers at unprecedented velocity IV System Architecture IV-A Overview The agent processes two parallel event streams (Fig. 1): a transaction stream covering financial events (card purchases, wire transfers, ATM withdrawals, cash deposits) and a session stream covering authentication and user-interface events (login, MFA challenge, payee addition, bulk record export). Each stream passes through the same three-component detection pipeline, producing a stream-specific composite risk score RtxnR_txn and RsessR_sess. The final tier for an event is determined by R=max(Rtxn,Rsess)R= (R_txn,R_sess), ensuring that a Critical session event during an otherwise normal transaction stream (or vice versa) still triggers the appropriate response. Figure 1: Modular architecture of the AI security agent for banking. Blue: event inputs. Green: sector modules (retail, corporate, staff). Red: response orchestrator. Orange: output interfaces. IV-B Core Detection Engine Each stream’s risk score is computed as: R=αsseq+βsthresh+γsgraph,α+β+γ=1R=α\,s_seq+β\,s_thresh+γ\,s_graph, α+β+γ=1 (1) where α, β, γ are learned by logistic regression on the training set. The three sub-models are: 1. Sequence model (sseqs_seq): An LSTM network [1] trained on sliding windows of length L=10L=10 over each account’s transaction or session history. The model learns per-account behavioural baselines over the training window and scores each new event against those baselines. sseq∈[0,1]s_seq∈[0,1] is the predicted fraud probability of the final event in each window. 2. Threshold monitor (sthreshs_thresh): A continuous-valued extension of the rule-based baseline, combining normalised amount z-score (for transfer-type transactions), velocity ratio (ntxns,10min/Θvn_txns,10min/ _v), structuring aggregate ratio (rolling 7-day cash-deposit sum / CTR threshold), and new-counterparty signal. sthresh∈[0,1]s_thresh∈[0,1]. 3. Graph/network module (sgraphs_graph): Proxy GNN features [8, 9] capturing account-counterparty network structure via rolling 24/48-hour windows: fan-in (distinct inbound senders), fan-out (distinct outbound recipients), and pass-through ratio (amount_out48h/amount_in48hamount\_out_48h/amount\_in_48h). Dormant account reactivation and impossible travel (city change within a physically implausible gap) are also included. sgraph∈[0,1]s_graph∈[0,1]. A single-sub-model override is applied for categories where the LSTM is highly confident (sseq≥0.90s_seq≥ 0.90) but the other two sub-models produce near-zero scores — specifically BEC and payment redirection, where the transaction amount and network pattern are deliberately engineered to look normal. In this case, R←max(R,sseq)R← (R,s_seq), ensuring that the fusion layer cannot suppress a near-certain LSTM detection signal on categories where threshold and graph signals are structurally absent. IV-C Sector-Specific Modules The core detection engine is extended by two sector modules that encode domain-specific knowledge about “normal” behaviour in each banking segment: Retail module — uses lower transaction amount baselines, higher expected ATM and card-purchase velocity, and flags card-type mismatches (a retail-checking account initiating a wire transfer). Corporate module — uses higher per-transaction amounts, elevated payroll-batch velocity at month-end, and flags off-hours wire transfers and unusual payee additions relative to the corporate account’s established counterparty set. IV-D Automated Response Framework Risk score R is mapped to one of four tiers: tier(R)=Low0≤R<0.30Medium0.30≤R<0.60High0.60≤R<0.85Critical0.85≤R≤1tier(R)= casesLow&0≤ R<0.30\\ Medium&0.30≤ R<0.60\\ High&0.60≤ R<0.85\\ Critical&0.85≤ R≤ 1 cases (2) Table I lists the automated actions at each tier. The Critical tier includes compliance escalation for SAR consideration — this triggers a human compliance review, not an automated SAR filing. TABLE I: Four-Tier Automated Response Framework Tier Automated actions Hold type Notification Low Log; update baseline None None Medium Log; step-up auth; soft hold Soft (customer-reversible) In-app alert High Log; hard hold; block session; incident report Hard (analyst-required) SMS/email + analyst alert Critical Log; account freeze; financial freeze; incident; SAR escalation; immediate analyst page Account freeze (compliance-required) Immediate SMS/email/push; analyst paged IV-E Customer Chatbot For High and Critical transactions, the agent initiates a “was this you?” conversational flow via SMS or in-app message. The chatbot collects an OTP-based identity confirmation from the account holder. Separately, a velocity-based mass-reset detector monitors password-reset requests across all accounts, flagging incidents where more than Θmr=15 _mr=15 requests arrive from the same source city within a 10-minute window — consistent with a scripted credential-stuffing attack targeting many accounts from a common exit node. IV-F Analyst Case-Summary Assistant Every incident visible to the fraud/AML security team is accompanied by an automatically generated plain-English case summary that includes the sub-model score breakdown (sseqs_seq, sthreshs_thresh, sgraphs_graph), a threat-category-specific narrative, and a ranked list of recommended next actions drawn from a 13-category action library. The assistant maps each threat category, tier pair to a domain-specific action list, prepending tier-appropriate framing actions (e.g., “Confirm account freeze is in place” for Critical) before the category-specific sequence. V Detection Methodology V-A LSTM Sequence Model Let t(u)∈ℝdx_t^(u) ^d denote the feature vector for account u’s t-th event (transaction or session). The LSTM receives a window t(u)=[t−L+1(u),…,t(u)]X_t^(u)=[x_t-L+1^(u),…,x_t^(u)], left-padded with zeros for accounts with fewer than L=10L=10 prior events, and produces a hidden state th_t from which the anomaly probability sseq,ts_seq,t is derived via a two-layer classification head. The model is trained with a binary cross-entropy loss using class-balanced reweighting. Transaction features (d=10d=10): amount, amount z-score, n_txns_last_10min, n_distinct_counterparties_24h, account_age_days, n_regular_counterparties, city_changed, device_changed, gap_minutes, is_dormant. Session features (d=18d=18): n_events, duration_seconds, n_distinct_event_types, n_failed_logins, n_mfa_failed, n_add_payee, n_view_customer_record, n_export_bulk, n_device_enrollment, n_password_reset, n_distinct_cities, n_distinct_devices, start_hour, city_changed, device_changed, gap_minutes, is_dormant, account_age_days. V-B Threshold Monitor The threshold monitor provides a continuous score by normalising each rule signal to [0,1][0,1]: sthresh=max(zΘz,n10min−1Θv,∑τ∈wcτCTR,fcp)s_thresh= \! ( z _z,\, n_10min-1 _v,\, _τ∈ wc_τCTR,\,f_cp ) (3) where z is the amount z-score (restricted to transfer-type transactions), Θz=3.0 _z=3.0, Θv=4 _v=4 transactions, ∑τ∈wcτ _τ∈ wc_τ is the 7-day rolling cash-deposit aggregate, CTR is the reporting threshold, and fcpf_cp is the normalised new-counterparty signal. The n10min−1n_10min-1 correction removes the transaction being scored from its own velocity count, so an isolated transaction scores 0 rather than 0.25. V-C Graph Module Fan-in and fan-out are computed using pandas time-indexed rolling windows per account group — a vectorised implementation that processes 237,669 transactions in approximately 12 seconds on a single CPU, compared with approximately 168 seconds for a naive per-row Python loop. The graph score is: sgraph=max(sdormant,stravel,smule,slayer,scombo)s_graph= (s_dormant,\,s_travel,\,s_mule,\,s_layer,\,s_combo) (4) where sdormant=[is_dormant]s_dormant=1[is\_dormant]; stravel=[city_changed]⋅(1−Δt/Δtmax)s_travel=1[city\_changed]·(1- t/ t_ ) for Δt<Δtmax=120min t< t_ =120~min; smule=clip(fan_in/Θin)⋅[r∈[0.85,1.05]]s_mule=clip(fan\_in/ _in)·1[r∈[0.85,1.05]]; slayer=clip(fan_out/Θout)⋅[r∈[0.30,2.00]]s_layer=clip(fan\_out/ _out)·1[r∈[0.30,2.00]]; and scombo=0.5⋅ccity⋅cdevices_combo=0.5· c_city· c_device, with Θin=3 _in=3, Θout=4 _out=4, and r the 48-hour pass-through ratio. The layering and mule signals use different ratio bands because layering unwinds progressively (the pass-through ratio is measured mid-chain, not at completion, so it passes through a wide band) while mule activity produces near-perfect in/out matching per round. V-D Fusion and Threshold Tuning The fusion layer is a logistic regression Pr(y=1∣)=σ(⊤+b) (y=1 )=σ(w s+b) where =[sseq,sthresh,sgraph]s=[s_seq,s_thresh,s_graph]. Normalised, non-negative weights α,β,γ=wi/∥w∥1α,β,γ=w_i/ w _1 are reported as the “learned fusion weights” (Tables I and IV). The decision threshold is tuned on the validation set to maximise F1; the prototype uses threshold =0.63=0.63 for transactions and 0.310.31 for sessions. VI Experiments and Results VI-A Dataset and Simulation In the absence of a publicly labelled bank event log covering all 13 threat categories with ground-truth labels, we follow established practice in fraud ML research of using a synthetic evaluation dataset [13]. The dataset models 3,470 accounts (3,000 retail, 400 corporate, 70 internal staff) over 90 simulated days, generating: • 237,669 transactions (225,195 normal + 12,474 attack; 5.25% attack prevalence) • 113,508 sessions (111,863 normal + 1,645 attack; 1.45% attack prevalence) Normal activity follows per-account behavioural baselines (login hour, session duration, transaction amount distribution, regular counterparty set) with seasonal effects (end-of-month payroll/bill spikes for corporate accounts, ATM salary-day spikes for retail, holiday-period card-purchase uplift). Attack scenarios are injected at the rates specified by the threat-weight distribution in Table I. Splits use a 70/15/15% stratified partition on (label, threat_category), preserving class balance across all splits. The complete dataset generator is included in the accompanying code repository. VI-B Baseline Comparisons The proposed agent is compared against three baselines: Rule-based IDS: Static threshold rules modelling a typical bank fraud engine (Eq. 3 binarised at Θz=3 _z=3, Θv=4 _v=4; structuring aggregate at 7-day CTR; session rules for brute-force, MFA failure, bulk export, device-reset combo). This is Baseline 1 and represents the industry status quo. Isolation Forest: Unsupervised anomaly detection trained on numeric features of each stream [2], with contamination set to the training-set positive rate. This is Baseline 2. LSTM-only: The proposed sequence sub-model trained and evaluated in isolation, without threshold or graph components, using a 0.5 decision threshold. This is Baseline 3, isolating the contribution of the LSTM from the full fusion system. VI-C Detection Performance Tables I and IV present per-category F1 scores on the held-out test set for both streams. TABLE I: Transaction Stream: Per-Category F1 (Test Set) Threat Rules Iso.F. LSTM Ours CNP fraud 0.327 0.237 0.387 0.629 Structuring 0.263 0.404 0.302 0.570 Mule activity 0.406 0.053 0.222 0.427 ATM anomaly 0.418 0.057 0.165 0.377 Rapid fund movement 0.335 0.223 0.176 0.378 ACH/wire fraud 0.213 0.096 0.068 0.179 Layering 0.041 0.082 0.114 0.131 BEC redirection 0.000 0.046 0.042 0.064 Account takeover (txn) 0.192 0.009 0.062 0.169 Dormant reactivation 0.075 0.000 0.037 0.105 Macro-avg F1 0.227 0.121 0.158 0.303 Overall F1 0.562 0.475 0.655 0.787 TABLE IV: Session Stream: Per-Category F1 (Test Set) Threat Rules Iso.F. LSTM Ours Account takeover (sess.) 1.000 0.632 0.467 0.740 Insider abuse 1.000 0.465 0.278 0.556 Session hijacking 0.000 0.447 0.294 0.576 SIM-swap indicator 1.000 0.000 0.186 0.427 Dormant reactivation (sess.) 0.000 0.000 0.238 0.504 BEC redirection (sess.) 0.000 0.000 0.234 0.368 Macro-avg F1 0.500 0.257 0.283 0.529 Overall F1 0.733 0.625 0.713 0.867 Learned fusion weights are α=0.725α=0.725, β=0.153β=0.153, γ=0.122γ=0.122 (transaction) and α=0.462α=0.462, β=0.265β=0.265, γ=0.273γ=0.273 (session). The session stream assigns substantially higher weight to β (threshold) and γ (graph) relative to the transaction stream, because session threats include several categories (ATO brute-force, SIM-swap, insider bulk-export) where the threshold monitor’s binary rule signal is already near-sufficient, and dormant reactivation where the graph module’s is_dormant feature is perfectly discriminative. Several observations are informative beyond the headline macro-F1 improvement: BEC detection is universally low. BEC payment redirection achieves F1 of 0.000 for rules and 0.000 for Isolation Forest on both streams, rising only to 0.064 (transaction) and 0.368 (session) for the proposed model. This is the expected behaviour of a threat designed to be undetectable by its amount, velocity, and counterparty profile alone — BEC specifically exploits the fact that the redirected payment matches the regular size and cadence of legitimate payments. The proposed model’s improvement comes entirely from the LSTM sequence model recognising the combination of add_payee + immediate large transfer as an anomalous session sequence, and from the single-sub-model override (Section IV-B). Rules and LSTM-only complement each other. For session-stream account takeover, rules score a perfect 1.000 while LSTM-only scores only 0.467. For dormant reactivation, rules score 0.000 while LSTM-only scores 0.238. This complementarity is why the fusion model consistently outperforms both: it learns weights that use each sub-model where it is strongest. Layering remains the hardest transaction-stream category. Layering achieves only 0.131 F1 for the proposed model. This reflects the mid-chain measurement problem: the rolling pass-through ratio is computed at each outbound transaction, not at completion of the layering chain, so early outbound transfers in a layering sequence have low ratio values that do not yet differentiate them from normal transfers. End-to-end chain detection would require a GNN with message passing over the full counterparty graph, which is identified as future work. VI-D Response Latency Table V reports end-to-end automated response latency (time from scored event to completion of all automated actions for the assigned tier) on the test set, measured on a single CPU-only node with local file I/O and in-memory state updates. TABLE V: End-to-End Response Latency (Single-Node Prototype) Tier Mean (ms) 95th pct (ms) Test events Low 0.044 0.074 50,034 Medium 0.047 0.079 388 High 0.200 0.351 134 Critical 0.265 0.427 2,122 All tiers complete in well under 1 ms at the 95th percentile. Latency increases monotonically from Low to Critical as the number of dispatched actions grows (one log write for Low; six actions including incident report, customer notification, analyst page, and compliance escalation for Critical). A networked production deployment (database writes, API calls, message broker round-trips) will add one to two orders of magnitude of overhead, but the Critical-tier response remains within the sub-second threshold required for effective account lockdown before a brute-force sequence completes. VI-E Chatbot Evaluation Customer verification chatbot evaluated on 1,720 simulated recovery sessions (1,221 legitimate, of which 850 were a legitimate high-volume burst simulating month-start credential resets; 499 injected mass-reset attack sessions). Results: • OTP-based identity verification accuracy: 96.6% • Mass-reset attack detection rate: 86.8% • False-positive rate (high-volume burst sessions): 0.0% • False-positive rate (overall legitimate): 0.08% The residual 13.2% of undetected mass-reset attacks corresponded to incidents where the attacker distributed requests across 2–3 source cities, each individually below the per-city velocity threshold — a known limitation of single-source velocity checks that would require cross-source correlation (e.g., account-level velocity independent of source city) to close. Analyst case-summary assistant evaluated on 50 sampled attack incidents from the transaction test set: • Narrative accuracy (correct threat category named): 100% • Action recall (fraction of correct actions recommended): 100% • Action precision (fraction of recommended actions that are correct): 98.7% • Action F1: 99.3% VII Discussion VII-A Why Rule-Based Systems Are Insufficient The transaction-stream rule baseline achieves overall F1 of 0.562, with BEC redirection and layering scoring 0.000. This is not a consequence of under-engineered rules: the rule engine includes a structuring-aggregate check (rolling 7-day cash-deposit sum), a velocity burst check, a large-amount-zscore check (restricted to transfer types to avoid false positives on cash deposits), and a new-counterparty-large-amount combined check. These are the rules a well-configured bank fraud engine would have. The gaps are structural: BEC and layering exploit the fact that individual events are locally legitimate, and no finite set of single-event rules can detect collective anomalies [4]. VII-B The Dual-Stream Architecture Advantage The separation of transaction and session streams is essential for the threat model. Dormant account reactivation manifests in both streams: a session event (login after 400 days) and a transaction event (immediate outbound transfer). The session-stream graph module catches it at F1=0.504 using the is_dormant flag; the transaction-stream graph module also catches it at F1=0.105. Together with the combined-tier max operation (R=max(Rsess,Rtxn)R= (R_sess,R_txn)), the agent achieves redundant coverage for this category from two independent detection paths. Account takeover is another cross-stream category: the session-stream rule engine achieves F1=1.000 on ATO (brute-force threshold) but the transaction-stream rule engine achieves only 0.192 (the post-ATO transfer is often within the account’s normal amount range). The proposed model improves the transaction-stream ATO F1 to 0.169 through s_seq learning the temporal proximity of failed-login sessions to subsequent anomalous transfers. VII-C Limitations The evaluation rests on synthetic data. While the generator is carefully designed to reproduce the statistical characteristics of each attack pattern and the base rates are calibrated to realistic prevalences (5.25% for transactions, 1.45% for sessions), it cannot capture the full distributional complexity of real bank traffic — long-tail transaction amounts, seasonal/cultural payment patterns in Uganda and East Africa, or the adversarial adaptation of real attackers. Retraining on real labelled data before production deployment is essential (see accompanying deployment guide). Layering detection remains the weakest category (F1=0.131). The rolling-window fan-out proxy is an approximation of the graph-structural signal that a proper GNN message-passing algorithm would provide. The LSTM models require approximately 10 prior transactions/sessions per account to reach full discriminative power. For new accounts or recently migrated customers, the first 30 days of scoring will use left-zero-padded sequences that are less informative than the long-horizon baselines the model was trained on. VIII Conclusion This paper presented an AI security agent for banking that covers 13 threat categories across retail and corporate banking through a dual-stream, three-component fusion architecture. The proposed model achieves macro-average F1 of 0.303 (transaction stream) and 0.529 (session stream), compared with 0.227/0.500 for a well-configured rule-based engine and 0.158/0.283 for a sequence-only LSTM baseline. Every threat category shows improvement over every baseline. The most important single result is BEC redirection: a threat that no rule engine or unsupervised anomaly detector can detect, where the proposed LSTM sequence model provides the only available detection path by learning that the combination of payee-addition and subsequent matched-amount wire transfer is anomalous in the context of an account’s recent history — even when no individual feature crosses any threshold. The integrated customer chatbot and analyst assistant reduce the operational burden on the fraud team: the chatbot handles first-line customer verification for flagged transactions and mass-reset detection for the password-recovery flow, while the analyst assistant generates threat-category-specific case summaries and ranked action lists that reduce the time from incident creation to analyst decision. Future work will replace the proxy graph module with a full heterogeneous GNN to improve layering detection, incorporate real-time model retraining triggered by analyst false-positive feedback, and evaluate the system on real bank event logs from a partner institution. Acknowledgment The authors thank the administration of Arapai Technologies International – Uganda, for providing domain knowledge and operational insight into banking security requirements, and for supporting the development of the agent. References [1] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural Computation, vol. 9, no. 8, p. 1735–1780, 1997. doi: 10.1162/neco.1997.9.8.1735. [2] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. 8th IEEE Int. Conf. Data Mining (ICDM), Pisa, Italy, 2008, p. 413–422. doi: 10.1109/ICDM.2008.17. [3] M. Ahmed, A. N. Mahmood, and J. Hu, “A survey of network anomaly detection techniques,” J. Netw. Comput. Appl., vol. 60, p. 19–31, 2016. doi: 10.1016/j.jnca.2015.11.016. [4] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: a survey,” ACM Comput. Surv., vol. 41, no. 3, p. 15, 2009. doi: 10.1145/1541880.1541882. [5] Y. Alghofaili, A. Albattah, and M. A. Rassam, “A financial fraud detection model based on LSTM deep learning technique,” J. Appl. Secur. Res., vol. 15, no. 4, p. 498–516, 2020. doi: 10.1080/19361610.2020.1815491. [6] A. C. Bahnsen, D. Aouada, A. Stojanovic, and B. Ottersten, “Feature engineering strategies for credit card fraud detection,” Expert Syst. Appl., vol. 51, p. 134–142, 2016. doi: 10.1016/j.eswa.2015.12.030. [7] M. Weber, G. Domeniconi, J. Chen, D. K. I. Weidele, C. Bellei, T. Robinson, and C. E. Leiserson, “Anti-money laundering in Bitcoin: experimenting with graph convolutional networks for financial forensics,” in Proc. KDD 2019 Workshop FinancialCrime, 2019. [8] T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” in Proc. 5th Int. Conf. Learning Representations (ICLR), Toulon, France, 2017. [9] W. W. Lo, G. Opedal, and T. Verdonck, “Finding money launderers using heterogeneous graph neural networks,” Intelligent Systems with Applications, vol. 25, 2025. doi: 10.1016/j.iswa.2025.200479. [10] S. Motie and B. Raahemi, “Financial fraud detection using graph neural networks: a systematic review,” Expert Syst. Appl., vol. 240, p. 122156, 2024. doi: 10.1016/j.eswa.2023.122156. [11] FBI Internet Crime Complaint Center (IC3), “Internet Crime Report 2023,” Federal Bureau of Investigation, Washington, DC, 2024. [Online]. Available: https://w.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf [12] Palo Alto Networks Unit 42, “What is business email compromise (BEC)?” 2024. [Online]. Available: https://w.paloaltonetworks.com/cyberpedia/what-is-business-email-compromise-bec-tactics-and-prevention [13] P. Goldschmidt and D. Chudá, “Network intrusion datasets: a survey, limitations, and recommendations,” Computers & Security, vol. 156, p. 104510, 2025. doi: 10.1016/j.cose.2025.104510.