FraudShield AI

An autonomous AI agent for real-time fraud detection and investigation

Comment

🛡️ FraudShield AI

Inspiration

Financial fraud continues to evolve rapidly, while traditional fraud detection systems still rely heavily on static rules and manual investigation workflows. Most systems can flag suspicious transactions, but they fail to explain why a transaction is risky, what actions should be taken, or how the bank remains compliant under automation guidelines.

We wanted to explore how AI agents could move beyond simple fraud scoring and instead behave like autonomous investigators that can reason, analyze behavioral patterns, check receiver profiles, and take immediate action.

The Google Cloud Rapid Agent Hackathon inspired us to build FraudShield AI—a system where AI does not just answer questions, but actively investigates, freezes accounts, and documents its decisions for regulators in under 30 seconds.

🚨 What It Does

FraudShield AI is an autonomous, real-time fraud investigation platform built entirely on Google Cloud.

The system:

  • Monitors In Real-Time: Streams transactions dynamically and triggers alerts when baselines are breached (impossible velocity, device mismatches, amount anomalies).
  • Runs Autonomous Investigations: Clicking "Investigate" launches a ReAct agent loop powered by Gemini 2.5 Flash, which autonomously queries histories and detects money-mule networks.
  • Maintains GDPR Compliance: Automatically generates direct customer-facing explanations (required by GDPR Article 22 for automated decisions) alongside structured regulatory audit trails.
  • Evolves Per-User (Living Baselines): Recalculates a customer's behavioral baseline (frequent locations, devices, average spend caps) after clean transactions to actively slash future false positives.

🧠 How We Built It

We designed FraudShield AI using a modular architecture focused on real-time event processing and protocol-driven agent capability.

Frontend

  • React + TypeScript + Vite: Built a responsive, real-time analyst dashboard.
  • Vanilla CSS: Crafted a custom, premium glassmorphism theme from scratch (styled in index.css) featuring glowing alerts, table filtering, and animated agent timelines.

Backend

  • Spring Boot 4.0 & Java 21: Handles the heuristic rules engine, transaction ingestion pipeline, and WebSocket broadcasts to keep the dashboard updated with zero page polling.

Database

  • MongoDB Atlas: Stores 19,000 real financial transactions (Kaggle dataset), active fraud alerts, and customer profile records.

AI & Agent Layer

  • Gemini 2.5 Flash via Vertex AI: Provides sub-second inference and function-calling capabilities for both initial transaction scoring and the subsequent ReAct agent investigation loop.
  • Model Context Protocol (MCP): Implemented a Python FastMCP server that exposes 7 database-connected tools (e.g., get_user_baseline, get_case_transactions, get_receiver_profile, get_open_cases, get_fraud_network_stats) directly to the Gemini agent.

⚙️ Agent Workflow

FraudShield AI executes a multi-step autonomous workflow:

  1. A transaction is processed by the Spring Boot backend rules engine.
  2. If an anomaly is detected, the transaction is evaluated by Gemini 2.5 Flash on Vertex AI. High-risk alerts are pushed instantly to the frontend queue over WebSockets.
  3. The analyst triggers the ReAct Agent.
  4. Gemini uses the FastMCP server tools to inspect the sender’s historical baseline, pull recent transactions, check the receiver account for money-mule patterns, and scan for other active alerts.
  5. Gemini synthesizes the findings: it freezes the account (ACCOUNT_FROZEN), drafts the GDPR Article 22 customer SMS, and logs the step-by-step regulatory audit record.

🔥 Example Fraud Signals

The system detects complex patterns such as:

  • Impossible Travel Velocity: Card swiped in Tokyo 10 minutes after New York.
  • Money Mule Networks: Receiver accounts exhibiting high inbound velocity (e.g., receiving from 20+ unique senders in 24 hours).
  • Behavioral Deviations: Transactions that are 2x+ greater than the user's average spend.
  • Device/Location Drift: Sudden logins on unknown devices or locations.

📈 What We Learned

  • Model Context Protocol (MCP) is an open standard that decouples core database tools from the AI reasoning model, allowing us to expose tools to any compliant LLM client effortlessly.
  • Building an AI agent is not just about prompts; it requires orchestration, state management, tool feedback, and action execution.
  • Gemini 2.5 Flash provides the optimal balance of reasoning and low-latency response times needed for multi-step agent loops.

🚧 Challenges We Faced

  • Loop Latency: Chaining multiple API calls in a ReAct loop can be slow. Using Gemini 2.5 Flash and caching baseline queries helped us resolve cases in under 30 seconds.
  • Catching Mule Rings: Multi-hop fraud rings are hard to identify by checking the sender alone. We had to build live MongoDB Atlas aggregation pipelines to evaluate the receiver's incoming history.

🚀 Future Improvements

  • Pre-Transaction Behavioral Drift: Block logins and transactions before execution on session anomalies (failed password resets, session mismatches).
  • Multi-Channel Dispatching: Push the GDPR-compliant notification directly to Twilio for SMS delivery and SendGrid for emails.
  • Multi-Mule Graph Analysis: Map receiver network paths to identify large-scale organized crime rings.

Built With

Share this project:

Updates