An AI Security Agent for Banking: Multi-Vector Fraud and AML Detection Across Retail and Corporate Accounts

arXiv:2606.17555v1 [cs.CR] 16 Jun 2026

An AI Security Agent for Banking: Multi-Vector Fraud and AML Detection Across Retail and Corporate Accounts Joseph Walusimbi

Joshua Benjamin Ssentongo

Dept. of Electronics and Computer Engineering Soroti University Soroti, Uganda [email protected]

Dept. of Electronics and Computer Engineering Soroti University Soroti, Uganda [email protected]

Abstract—Banks simultaneously face signature-based fraud (card-not-present attacks, account takeover, ATM cloning) and behavioural financial crime (structuring, layering, mule networks, business email compromise) – two threat families with fundamentally different detection requirements. Static rule engines that reliably catch brute-force and high-velocity events are structurally blind to business-email-compromise (BEC) payment redirection, session hijacking, and money-laundering layering, which are engineered to appear indistinguishable from legitimate activity at the individual transaction or session level. This paper presents an AI security agent for retail and corporate banking that addresses this gap through a three-component fusion architecture operating on two parallel event streams: a transaction stream (card fraud, ACH/wire fraud, AML categories) and a session stream (account takeover, session hijacking, SIM-swap, insider abuse). Each stream combines an LSTM sequence model capturing per-account behavioural history, a statistical velocity/threshold monitor, and a graph/network module capturing account-counterparty relationship patterns (fan-in, fan-out, passthrough ratio) for money-laundering detection. Experiments on a synthetic event log of 237,669 transactions and 113,508 sessions across 13 threat categories and 3,470 simulated accounts demonstrate overall F1 of 0.787 (transaction stream) and 0.867 (session stream) for the proposed model, versus 0.562/0.733 for a rulebased baseline and 0.655/0.713 for an LSTM-only baseline. The agent includes a customer-facing transaction-verification chatbot (96.6% identity verification accuracy, 86.8% mass-reset attack detection) and an analyst case-summary assistant (99.3% actionrecommendation F1), with Critical-tier automated response latency under 0.43 ms at the 95th percentile. Index Terms—fraud detection, anti-money laundering, LSTM, graph neural networks, banking security, anomaly detection, account takeover, structuring

I. I NTRODUCTION Financial institutions face a dual and diverging threat landscape. On one side are signature-fraud attacks — bruteforce credential stuffing, card cloning, ATM withdrawals at clone-card velocity, ACH fraud with off-hours wire transfers — that produce individually anomalous events detectable by threshold rules. On the other side are behavioural-financialcrime patterns — business email compromise (BEC) payment redirection, money-laundering structuring, network layering,

and mule account pass-through — where no individual transaction is anomalous; only the relationship among transactions, accounts, or time windows reveals the attack. Static rule engines, widely deployed in bank fraud and anti-money laundering (AML) systems, handle the first class competently but are structurally blind to the second. Business email compromise alone caused $2.9 billion in reported losses in 2023 across 21,489 US complaints to the FBI’s Internet Crime Complaint Center [11]; globally, BEC losses exceeded $55 billion over the preceding decade [12]. AML failures carry additional regulatory risk: missed structuring or layering patterns expose institutions to sanctions, reputational harm, and mandatory Suspicious Activity Report (SAR) filings. Machine learning approaches have been extensively studied for individual fraud categories: sequence models for card transactions [1], [5], graph neural networks (GNNs) for money-laundering network detection [7], [9], and isolation forest for general financial anomaly detection [2]. However, most existing work targets a single fraud category or a single stream (transactions only), and few systems integrate fraud detection, AML, and an automated response tier into a single operational agent covering both retail and corporate banking. This paper makes the following contributions: • A unified three-component detection architecture operating on two parallel streams (transaction and session), combining sequence modelling, velocity monitoring, and network graph analysis into a single fused risk score R ∈ [0, 1] per event. • A comprehensive threat model covering 13 attack categories spanning retail fraud (card-not-present, account takeover, ATM cloning, session hijacking, SIM-swap), corporate payment fraud (ACH/wire fraud, BEC), insider abuse, AML (structuring, layering, mule activity, rapid fund movement), and cross-cutting dormant-account reactivation. • Experimental evaluation on a 90-day synthetic event log (237,669 transactions, 113,508 sessions, 3,470 accounts) demonstrating that the proposed fusion model achieves

macro-average F1 of 0.303/0.529 (transaction/session), compared with 0.227/0.500 for rules and 0.158/0.283 for LSTM-only. • Two customer-facing components: a transaction verification chatbot and an analyst case-summary assistant, evaluated on separate datasets. II. R ELATED W ORK A. Anomaly Detection for Financial Fraud Ahmed et al. [3] survey network anomaly detection techniques, identifying threshold rules and statistical profiling as the most widely deployed baseline approaches and noting their inability to detect slow, temporally distributed, or contextually camouflaged attacks. Chandola et al. [4] provide the foundational taxonomy of anomaly types (point, contextual, collective) that frames the detection challenge: BEC and structuring are collective anomalies — individually ordinary events that are anomalous only in combination. For transactional fraud detection specifically, deep learning methods have substantially outperformed traditional classifiers. Alghofaili et al. [5] apply LSTM networks to financial transaction sequences and report strong recall on credit card fraud. Bahnsen et al. [6] demonstrate that temporal and behavioural features (transaction recency, velocity, counterparty familiarity) are more discriminative than transaction amount alone, motivating our per-account behavioural baseline approach. B. Graph Neural Networks for AML Money laundering detection presents a naturally relational problem: structured networks of mule accounts, shell companies, and layering chains are invisible at the level of individual transactions but manifest as graph-structural anomalies. Weber et al. [7] were among the first to apply graph convolutional networks to anti-money laundering in the Elliptic Bitcoin dataset. Lo et al. [9] extend this to heterogeneous graphs modelling multiple entity types (individuals, companies, transactions) and demonstrate strong AUC on real bank data from Norway’s DNB. Our graph sub-model is a lightweight proxy of this approach — using rolling fan-in/fan-out and pass-through ratio features rather than full GNN message-passing — appropriate for a prototype that must train and infer on a CPU-only node.

The key observation motivating the architecture is that no single detection mechanism covers all 13 categories. Rules cover brute-force, velocity-burst, and single-transaction CTR triggers but score zero on session hijacking, dormant reactivation, and BEC. Unsupervised anomaly detection (Isolation Forest) adds coverage for some graph-like patterns but misses dormant accounts and SIM-swap (both require identity-state context). LSTM sequence models add behavioural context but remain unable to catch structuring without the aggregation signal the threshold monitor provides. The proposed fusion architecture is designed to combine all three signals without redundancy. TABLE I T HREAT M ODEL : 13 C ATEGORIES , S TREAMS , AND D ETECTION C HALLENGES Category

Stream

Detection challenge

CNP fraud

Txn

Account takeover ATM anomaly

Both

Burst at velocity from foreign city; no auth signal Credential-stuffing; amounts may look normal post-ATO Multi-city withdrawals in physically impossible time Same session, two different cities/devices mid-flow Device enrol + MFA + reset in rapid succession Off-hours, large, new counterparty Amount matches regular transfers; only payee is new Bulk record viewing by authorised staff account No active signal; requires account-history context Below-threshold cash deposits summing above CTR 1 large inbound → many outbound; passthrough ratio High fan-in from strangers + rapid outbound Burst of outbound transfers at unprecedented velocity

Txn

Session hijacking SIM-swap

Sess Sess

ACH/wire fraud BEC redirection

Txn Both

Insider abuse

Sess

Dormant reactivation Structuring (AML) Layering (AML)

Both

Txn

Mule accounts

Txn

Rapid fund movement

Txn

Txn

IV. S YSTEM A RCHITECTURE A. Overview

C. Multi-Category and Multi-Stream Detection Most fraud detection literature targets a single category. Work combining fraud detection with AML in a unified agent is less common. Motie and Raahemi [10] survey GNN applications to financial fraud detection broadly, noting the gap between single-category academic benchmarks and the multithreat operational reality faced by bank fraud and compliance teams. Our work addresses this gap by covering 13 categories across two event streams within a single deployable agent. III. T HREAT M ODEL Table I enumerates the 13 threat categories covered by the proposed agent, classified by the primary event stream through which they manifest and their dominant detection challenge.

The agent processes two parallel event streams (Fig. 1): a transaction stream covering financial events (card purchases, wire transfers, ATM withdrawals, cash deposits) and a session stream covering authentication and user-interface events (login, MFA challenge, payee addition, bulk record export). Each stream passes through the same three-component detection pipeline, producing a stream-specific composite risk score Rtxn and Rsess . The final tier for an event is determined by R = max(Rtxn , Rsess ), ensuring that a Critical session event during an otherwise normal transaction stream (or vice versa) still triggers the appropriate response. B. Core Detection Engine Each stream’s risk score is computed as:

layer cannot suppress a near-certain LSTM detection signal on categories where threshold and graph signals are structurally absent. C. Sector-Specific Modules The core detection engine is extended by two sector modules that encode domain-specific knowledge about “normal” behaviour in each banking segment: Retail module — uses lower transaction amount baselines, higher expected ATM and card-purchase velocity, and flags card-type mismatches (a retail-checking account initiating a wire transfer). Corporate module — uses higher per-transaction amounts, elevated payroll-batch velocity at month-end, and flags offhours wire transfers and unusual payee additions relative to the corporate account’s established counterparty set.

Fig. 1. Modular architecture of the AI security agent for banking. Blue: event inputs. Green: sector modules (retail, corporate, staff). Red: response orchestrator. Orange: output interfaces.

R = α sseq + β sthresh + γ sgraph ,

α+β+γ =1

(1)

where α, β, γ are learned by logistic regression on the training set. The three sub-models are: 1) Sequence model (sseq ): An LSTM network [1] trained on sliding windows of length L=10 over each account’s transaction or session history. The model learns peraccount behavioural baselines over the training window and scores each new event against those baselines. sseq ∈ [0, 1] is the predicted fraud probability of the final event in each window. 2) Threshold monitor (sthresh ): A continuous-valued extension of the rule-based baseline, combining normalised amount z-score (for transfer-type transactions), velocity ratio (ntxns,10min /Θv ), structuring aggregate ratio (rolling 7-day cash-deposit sum / CTR threshold), and newcounterparty signal. sthresh ∈ [0, 1]. 3) Graph/network module (sgraph ): Proxy GNN features [8], [9] capturing account-counterparty network structure via rolling 24/48-hour windows: fan-in (distinct inbound senders), fan-out (distinct outbound recipients), and pass-through ratio (amount out48h /amount in48h ). Dormant account reactivation and impossible travel (city change within a physically implausible gap) are also included. sgraph ∈ [0, 1]. A single-sub-model override is applied for categories where the LSTM is highly confident (sseq ≥ 0.90) but the other two sub-models produce near-zero scores — specifically BEC and payment redirection, where the transaction amount and network pattern are deliberately engineered to look normal. In this case, R ← max(R, sseq ), ensuring that the fusion

D. Automated Response Framework Risk score R is mapped to one of four tiers:  Low 0 ≤ R < 0.30    Medium 0.30 ≤ R < 0.60 tier(R) = High 0.60 ≤ R < 0.85    Critical 0.85 ≤ R ≤ 1

(2)

Table II lists the automated actions at each tier. The Critical tier includes compliance escalation for SAR consideration — this triggers a human compliance review, not an automated SAR filing. TABLE II F OUR -T IER AUTOMATED R ESPONSE F RAMEWORK Tier

Automated actions

Hold type

Notification

Low

Log; update baseline Log; step-up auth; soft hold

None

None

Medium

High

Critical

Log; hard hold; block session; incident report Log; account freeze; financial freeze; incident; SAR escalation; immediate analyst page

Soft In-app alert (customerreversible) Hard SMS/email + an(analystalyst alert required) Account Immediate freeze SMS/email/push; (compliance- analyst paged required)

E. Customer Chatbot For High and Critical transactions, the agent initiates a “was this you?” conversational flow via SMS or in-app message. The chatbot collects an OTP-based identity confirmation from the account holder. Separately, a velocity-based mass-reset detector monitors password-reset requests across all accounts, flagging incidents where more than Θmr = 15 requests arrive from the same source city within a 10-minute window — consistent with a scripted credential-stuffing attack targeting many accounts from a common exit node.

F. Analyst Case-Summary Assistant Every incident visible to the fraud/AML security team is accompanied by an automatically generated plain-English case summary that includes the sub-model score breakdown (sseq , sthresh , sgraph ), a threat-category-specific narrative, and a ranked list of recommended next actions drawn from a 13-category action library. The assistant maps each {threat category, tier} pair to a domain-specific action list, prepending tier-appropriate framing actions (e.g., “Confirm account freeze is in place” for Critical) before the category-specific sequence.

D. Fusion and Threshold Tuning

V. D ETECTION M ETHODOLOGY A. LSTM Sequence Model (u) Let xt

d

∈ R denote the feature vector for account u’s t-th event (transaction or session). The LSTM receives a (u) (u) (u) window Xt = [xt−L+1 , . . . , xt ], left-padded with zeros for accounts with fewer than L = 10 prior events, and produces a hidden state ht from which the anomaly probability sseq,t is derived via a two-layer classification head. The model is trained with a binary cross-entropy loss using class-balanced reweighting. Transaction features (d = 10): amount, amount zscore, n txns last 10min, n distinct counterparties 24h, account age days, n regular counterparties, city changed, device changed, gap minutes, is dormant. Session features (d = 18): n events, duration seconds, n distinct event types, n failed logins, n mfa failed, n add payee, n view customer record, n export bulk, n device enrollment, n password reset, n distinct cities, n distinct devices, start hour, city changed, device changed, gap minutes, is dormant, account age days. B. Threshold Monitor The threshold monitor provides a continuous score by normalising each rule signal to [0, 1]: P   z n10min − 1 τ ∈w cτ sthresh = max , fcp , , Θz Θv CTR

(3)

where z is the amount z-score (restricted to transfer-type P transactions), Θz = 3.0, Θv = 4 transactions, τ ∈w cτ is the 7-day rolling cash-deposit aggregate, CTR is the reporting threshold, and fcp is the normalised new-counterparty signal. The n10min −1 correction removes the transaction being scored from its own velocity count, so an isolated transaction scores 0 rather than 0.25. C. Graph Module Fan-in and fan-out are computed using pandas time-indexed rolling windows per account group — a vectorised implementation that processes 237,669 transactions in approximately 12 seconds on a single CPU, compared with approximately 168 seconds for a naive per-row Python loop. The graph score is: sgraph = max(sdormant , stravel , smule , slayer , scombo )

where sdormant = 1[is dormant]; stravel = 1[city changed] · (1 − ∆t/∆tmax ) for ∆t < ∆tmax = 120 min; smule = clip(fan in/Θin ) · 1[r ∈ [0.85, 1.05]]; slayer = clip(fan out/Θout ) · 1[r ∈ [0.30, 2.00]]; and scombo = 0.5 · ccity · cdevice , with Θin = 3, Θout = 4, and r the 48-hour pass-through ratio. The layering and mule signals use different ratio bands because layering unwinds progressively (the pass-through ratio is measured mid-chain, not at completion, so it passes through a wide band) while mule activity produces near-perfect in/out matching per round.

(4)

The fusion layer is a logistic regression Pr(y = 1 | s) = σ(w⊤ s + b) where s = [sseq , sthresh , sgraph ]. Normalised, nonnegative weights α, β, γ = wi /∥w∥1 are reported as the “learned fusion weights” (Tables III and IV). The decision threshold is tuned on the validation set to maximise F1; the prototype uses threshold = 0.63 for transactions and 0.31 for sessions. VI. E XPERIMENTS AND R ESULTS A. Dataset and Simulation In the absence of a publicly labelled bank event log covering all 13 threat categories with ground-truth labels, we follow established practice in fraud ML research of using a synthetic evaluation dataset [13]. The dataset models 3,470 accounts (3,000 retail, 400 corporate, 70 internal staff) over 90 simulated days, generating: • 237,669 transactions (225,195 normal + 12,474 attack; 5.25% attack prevalence) • 113,508 sessions (111,863 normal + 1,645 attack; 1.45% attack prevalence) Normal activity follows per-account behavioural baselines (login hour, session duration, transaction amount distribution, regular counterparty set) with seasonal effects (end-of-month payroll/bill spikes for corporate accounts, ATM salary-day spikes for retail, holiday-period card-purchase uplift). Attack scenarios are injected at the rates specified by the threat-weight distribution in Table I. Splits use a 70/15/15% stratified partition on (label, threat category), preserving class balance across all splits. The complete dataset generator is included in the accompanying code repository. B. Baseline Comparisons The proposed agent is compared against three baselines: Rule-based IDS: Static threshold rules modelling a typical bank fraud engine (Eq. 3 binarised at Θz = 3, Θv = 4; structuring aggregate at 7-day CTR; session rules for bruteforce, MFA failure, bulk export, device-reset combo). This is Baseline 1 and represents the industry status quo. Isolation Forest: Unsupervised anomaly detection trained on numeric features of each stream [2], with contamination set to the training-set positive rate. This is Baseline 2. LSTM-only: The proposed sequence sub-model trained and evaluated in isolation, without threshold or graph components,

using a 0.5 decision threshold. This is Baseline 3, isolating the contribution of the LSTM from the full fusion system. C. Detection Performance Tables III and IV present per-category F1 scores on the held-out test set for both streams. TABLE III T RANSACTION S TREAM : P ER -C ATEGORY F1 (T EST S ET ) Threat

Rules

Iso.F.

LSTM

Ours

CNP fraud Structuring Mule activity ATM anomaly Rapid fund movement ACH/wire fraud Layering BEC redirection Account takeover (txn) Dormant reactivation

0.327 0.263 0.406 0.418 0.335 0.213 0.041 0.000 0.192 0.075

0.237 0.404 0.053 0.057 0.223 0.096 0.082 0.046 0.009 0.000

0.387 0.302 0.222 0.165 0.176 0.068 0.114 0.042 0.062 0.037

0.629 0.570 0.427 0.377 0.378 0.179 0.131 0.064 0.169 0.105

Macro-avg F1 Overall F1

0.227 0.562

0.121 0.475

0.158 0.655

0.303 0.787

The proposed model’s improvement comes entirely from the LSTM sequence model recognising the combination of add payee + immediate large transfer as an anomalous session sequence, and from the single-sub-model override (Section IVB). Rules and LSTM-only complement each other. For session-stream account takeover, rules score a perfect 1.000 while LSTM-only scores only 0.467. For dormant reactivation, rules score 0.000 while LSTM-only scores 0.238. This complementarity is why the fusion model consistently outperforms both: it learns weights that use each sub-model where it is strongest. Layering remains the hardest transaction-stream category. Layering achieves only 0.131 F1 for the proposed model. This reflects the mid-chain measurement problem: the rolling pass-through ratio is computed at each outbound transaction, not at completion of the layering chain, so early outbound transfers in a layering sequence have low ratio values that do not yet differentiate them from normal transfers. End-to-end chain detection would require a GNN with message passing over the full counterparty graph, which is identified as future work. D. Response Latency

TABLE IV S ESSION S TREAM : P ER -C ATEGORY F1 (T EST S ET ) Threat

Rules

Iso.F.

LSTM

Ours

Account takeover (sess.) Insider abuse Session hijacking SIM-swap indicator Dormant reactivation (sess.) BEC redirection (sess.)

1.000 1.000 0.000 1.000 0.000 0.000

0.632 0.465 0.447 0.000 0.000 0.000

0.467 0.278 0.294 0.186 0.238 0.234

0.740 0.556 0.576 0.427 0.504 0.368

Macro-avg F1 Overall F1

0.500 0.733

0.257 0.625

0.283 0.713

0.529 0.867

Learned fusion weights are α=0.725, β=0.153, γ=0.122 (transaction) and α=0.462, β=0.265, γ=0.273 (session). The session stream assigns substantially higher weight to β (threshold) and γ (graph) relative to the transaction stream, because session threats include several categories (ATO brute-force, SIM-swap, insider bulk-export) where the threshold monitor’s binary rule signal is already near-sufficient, and dormant reactivation where the graph module’s is dormant feature is perfectly discriminative. Several observations are informative beyond the headline macro-F1 improvement: BEC detection is universally low. BEC payment redirection achieves F1 of 0.000 for rules and 0.000 for Isolation Forest on both streams, rising only to 0.064 (transaction) and 0.368 (session) for the proposed model. This is the expected behaviour of a threat designed to be undetectable by its amount, velocity, and counterparty profile alone — BEC specifically exploits the fact that the redirected payment matches the regular size and cadence of legitimate payments.

Table V reports end-to-end automated response latency (time from scored event to completion of all automated actions for the assigned tier) on the test set, measured on a single CPUonly node with local file I/O and in-memory state updates. TABLE V E ND - TO -E ND R ESPONSE L ATENCY (S INGLE -N ODE P ROTOTYPE ) Tier Low Medium High Critical

Mean (ms)

95th pct (ms)

0.044 0.047 0.200 0.265

0.074 0.079 0.351 0.427

Test events 50,034 388 134 2,122

All tiers complete in well under 1 ms at the 95th percentile. Latency increases monotonically from Low to Critical as the number of dispatched actions grows (one log write for Low; six actions including incident report, customer notification, analyst page, and compliance escalation for Critical). A networked production deployment (database writes, API calls, message broker round-trips) will add one to two orders of magnitude of overhead, but the Critical-tier response remains within the sub-second threshold required for effective account lockdown before a brute-force sequence completes. E. Chatbot Evaluation Customer verification chatbot evaluated on 1,720 simulated recovery sessions (1,221 legitimate, of which 850 were a legitimate high-volume burst simulating month-start credential resets; 499 injected mass-reset attack sessions). Results: • OTP-based identity verification accuracy: 96.6% • Mass-reset attack detection rate: 86.8%

• •

False-positive rate (high-volume burst sessions): 0.0% False-positive rate (overall legitimate): 0.08%

The residual 13.2% of undetected mass-reset attacks corresponded to incidents where the attacker distributed requests across 2–3 source cities, each individually below the percity velocity threshold — a known limitation of single-source velocity checks that would require cross-source correlation (e.g., account-level velocity independent of source city) to close. Analyst case-summary assistant evaluated on 50 sampled attack incidents from the transaction test set: Narrative accuracy (correct threat category named): 100% • Action recall (fraction of correct actions recommended): 100% • Action precision (fraction of recommended actions that are correct): 98.7% • Action F1: 99.3%

•

VII. D ISCUSSION A. Why Rule-Based Systems Are Insufficient The transaction-stream rule baseline achieves overall F1 of 0.562, with BEC redirection and layering scoring 0.000. This is not a consequence of under-engineered rules: the rule engine includes a structuring-aggregate check (rolling 7-day cash-deposit sum), a velocity burst check, a largeamount-zscore check (restricted to transfer types to avoid false positives on cash deposits), and a new-counterparty-largeamount combined check. These are the rules a well-configured bank fraud engine would have. The gaps are structural: BEC and layering exploit the fact that individual events are locally legitimate, and no finite set of single-event rules can detect collective anomalies [4]. B. The Dual-Stream Architecture Advantage The separation of transaction and session streams is essential for the threat model. Dormant account reactivation manifests in both streams: a session event (login after 400 days) and a transaction event (immediate outbound transfer). The session-stream graph module catches it at F1=0.504 using the is dormant flag; the transaction-stream graph module also catches it at F1=0.105. Together with the combined-tier max operation (R = max(Rsess , Rtxn )), the agent achieves redundant coverage for this category from two independent detection paths. Account takeover is another cross-stream category: the session-stream rule engine achieves F1=1.000 on ATO (brute-force threshold) but the transaction-stream rule engine achieves only 0.192 (the post-ATO transfer is often within the account’s normal amount range). The proposed model improves the transaction-stream ATO F1 to 0.169 through s seq learning the temporal proximity of failed-login sessions to subsequent anomalous transfers.

C. Limitations The evaluation rests on synthetic data. While the generator is carefully designed to reproduce the statistical characteristics of each attack pattern and the base rates are calibrated to realistic prevalences (5.25% for transactions, 1.45% for sessions), it cannot capture the full distributional complexity of real bank traffic — long-tail transaction amounts, seasonal/cultural payment patterns in Uganda and East Africa, or the adversarial adaptation of real attackers. Retraining on real labelled data before production deployment is essential (see accompanying deployment guide). Layering detection remains the weakest category (F1=0.131). The rolling-window fan-out proxy is an approximation of the graph-structural signal that a proper GNN message-passing algorithm would provide. The LSTM models require approximately 10 prior transactions/sessions per account to reach full discriminative power. For new accounts or recently migrated customers, the first 30 days of scoring will use left-zero-padded sequences that are less informative than the long-horizon baselines the model was trained on. VIII. C ONCLUSION This paper presented an AI security agent for banking that covers 13 threat categories across retail and corporate banking through a dual-stream, three-component fusion architecture. The proposed model achieves macro-average F1 of 0.303 (transaction stream) and 0.529 (session stream), compared with 0.227/0.500 for a well-configured rule-based engine and 0.158/0.283 for a sequence-only LSTM baseline. Every threat category shows improvement over every baseline. The most important single result is BEC redirection: a threat that no rule engine or unsupervised anomaly detector can detect, where the proposed LSTM sequence model provides the only available detection path by learning that the combination of payee-addition and subsequent matched-amount wire transfer is anomalous in the context of an account’s recent history — even when no individual feature crosses any threshold. The integrated customer chatbot and analyst assistant reduce the operational burden on the fraud team: the chatbot handles first-line customer verification for flagged transactions and mass-reset detection for the password-recovery flow, while the analyst assistant generates threat-category-specific case summaries and ranked action lists that reduce the time from incident creation to analyst decision. Future work will replace the proxy graph module with a full heterogeneous GNN to improve layering detection, incorporate real-time model retraining triggered by analyst false-positive feedback, and evaluate the system on real bank event logs from a partner institution. ACKNOWLEDGMENT The authors thank the administration of Arapai Technologies International – Uganda, for providing domain knowledge and operational insight into banking security requirements, and for supporting the development of the agent.

R EFERENCES [1] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural Computation, vol. 9, no. 8, pp. 1735–1780, 1997. doi: 10.1162/neco.1997.9.8.1735. [2] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. 8th IEEE Int. Conf. Data Mining (ICDM), Pisa, Italy, 2008, pp. 413–422. doi: 10.1109/ICDM.2008.17. [3] M. Ahmed, A. N. Mahmood, and J. Hu, “A survey of network anomaly detection techniques,” J. Netw. Comput. Appl., vol. 60, pp. 19–31, 2016. doi: 10.1016/j.jnca.2015.11.016. [4] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: a survey,” ACM Comput. Surv., vol. 41, no. 3, p. 15, 2009. doi: 10.1145/1541880.1541882. [5] Y. Alghofaili, A. Albattah, and M. A. Rassam, “A financial fraud detection model based on LSTM deep learning technique,” J. Appl. Secur. Res., vol. 15, no. 4, pp. 498–516, 2020. doi: 10.1080/19361610.2020.1815491. [6] A. C. Bahnsen, D. Aouada, A. Stojanovic, and B. Ottersten, “Feature engineering strategies for credit card fraud detection,” Expert Syst. Appl., vol. 51, pp. 134–142, 2016. doi: 10.1016/j.eswa.2015.12.030. [7] M. Weber, G. Domeniconi, J. Chen, D. K. I. Weidele, C. Bellei, T. Robinson, and C. E. Leiserson, “Anti-money laundering in Bitcoin: experimenting with graph convolutional networks for financial forensics,” in Proc. KDD 2019 Workshop FinancialCrime, 2019. [8] T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” in Proc. 5th Int. Conf. Learning Representations (ICLR), Toulon, France, 2017. [9] W. W. Lo, G. Opedal, and T. Verdonck, “Finding money launderers using heterogeneous graph neural networks,” Intelligent Systems with Applications, vol. 25, 2025. doi: 10.1016/j.iswa.2025.200479. [10] S. Motie and B. Raahemi, “Financial fraud detection using graph neural networks: a systematic review,” Expert Syst. Appl., vol. 240, p. 122156, 2024. doi: 10.1016/j.eswa.2023.122156. [11] FBI Internet Crime Complaint Center (IC3), “Internet Crime Report 2023,” Federal Bureau of Investigation, Washington, DC, 2024. [Online]. Available: https://www.ic3.gov/Media/PDF/AnnualReport/2023 IC3Report.pdf [12] Palo Alto Networks Unit 42, “What is business email compromise (BEC)?” 2024. [Online]. Available: https://www.paloaltonetworks.com/cyberpedia/ what-is-business-email-compromise-bec-tactics-and-prevention [13] P. Goldschmidt and D. Chudá, “Network intrusion datasets: a survey, limitations, and recommendations,” Computers & Security, vol. 156, p. 104510, 2025. doi: 10.1016/j.cose.2025.104510.