Global Tier-1 Investment Bank · Investment Banking
The bank's fraud detection system was analyzing approximately 18% of transaction volume in real time, with the remainder batch-processed on a 24-hour delay. Sophisticated fraud actors had adapted their techniques to exploit this gap — using low-velocity, low-value transactions spread across thousands of accounts to stay beneath detection thresholds. The fraud team had noted unexplained losses accumulating over an 8-month period but had been unable to identify the source.
LLM reasoning was applied to 100% of transaction events in real time. The model was configured to identify coordinated behavioral patterns across accounts — not just individual transaction anomalies — surfacing network-level fraud signatures that are invisible at sampled coverage.
"The individual transactions were unremarkable. Under $50 each, spread across thousands of accounts. The pattern only exists at full volume. At 18% coverage it was statistically invisible."
Head of Financial Crime Intelligence
The coordinated ring was operating a structured layering scheme — aggregating small values across thousands of accounts before consolidation. The LLM identified the network topology in 94 minutes after full coverage was established. The ring had been active for 8 months, accumulating $47M before detection.