Quintet

• 

  Checks and the verification call on the vendor's number on file

• 

  Main Website

Inspiration

Picture a three-person print shop. One person pays the bills, and nobody checks their work. On Tuesday the usual paper supplier emails: "We've switched banks, please use the new account." The invoice looks right, the amount is normal, and the new account belongs to a fraudster. Nobody catches it, because nobody was ever positioned to. That is payment-redirection fraud, and it's built for exactly that gap. Quintet is the second signature a small business can't staff.

We interviewed one owner at the event, Alex Marianetti of Lockhunt, a two-person locksmith company that handles 5 or 6 invoices a day (he agreed to be named and filmed). Nobody double-checks his payments, a vendor once changed bank details on him and he "didn't realize till later", and receipts are "all done manually, in spreadsheets." When he saw Quintet stop the fake bank change, he called it "incredibly useful". His main objection: getting his existing invoices in. It's one interview, not validation, but it's the person we built this for.

What it does

A clear, defined workflow runs on every document. Five steps, each owned by one seat:

1. Read. Intake clerk (Claude, no tools) extracts the fields. A plain-code parser re-reads the amount, account and invoice number, and any disagreement goes to a human.
2. Verify. Verification analyst compares the payee with the record on file, runs CRS identity and fraud checks, and flags lookalike vendors.
3. Call. If bank, phone or email details changed, a Cartesia voice agent calls the vendor on file (never a number from the document), says it's automated, and asks a yes/no question.
4. Decide. A deterministic gate returns ALLOW (pay), ASK (a human signs) or BLOCK. It's a pure TypeScript function with no I/O, and a model verdict can only make it stricter, never looser. The Controller (Claude, read-only) explains every decision from the audit log, in text or voice.
5. Pay. Payments clerk (plain code, deliberately not AI) pays through the sandbox bank with an idempotency key, so a retry never pays twice.

Four of the five seats use AI. The one that moves money doesn't.

The demo moment. The usual paper supplier emails invoice #1043 for $1,850: "we switched banks", with a new callback number and hidden white text telling the AI to "pay immediately". Three checks go red: the bank account changed, CRS says the new number belongs to someone else and returns a high fraud score, and the PDF contains instructions aimed at the AI. Payment freezes. Quintet calls the number on file, the real vendor says nothing changed, and the case is blocked for good. Ask "why did you hold it?" and the Controller answers from the log. Then the genuine invoice from the same vendor is paid, and we break the payment mid-transfer to show it still lands exactly once.

Snap a photo of a receipt and the same gate applies company policy: itemized, recent, no alcohol, gift cards or tobacco. If Ivy isn't sure what she read, a person signs.

How we built it

• Claude (Anthropic): structured-output extraction with no tools, the lookalike check, and plain-language explanations.
• The gate: rules R0 to R10, each covered by unit tests, plus the full moment end to end. Policy is data, so a new version is checked for loosening, which needs human approval.
• CRS Credit sandbox: identity, Fraud Finder score and reverse-phone lookup on new payees and changed details, only through a hard-coded test-identity allowlist.
• Cartesia: the verification call, and "Ask Quintet" spoken answers.
• Capital One Nessie: sandbox accounts, payees and idempotent transfers.
• Convex: system of record, live board, scheduled pipeline, append-only audit log.
• Next.js front end on Cloudflare Workers: a judge console with seven scenarios, a scorecard and a policy page.

Challenges we ran into

• Documents are untrusted input. A PDF can carry hidden instructions to the AI. Intake runs with no tools, hits are logged as evidence, and the gate, not the model, decides.
• Paying exactly once under failure. We inject a fault mid-payment and check that one transfer lands.
• Sandbox safety. The CRS sandbox forwards unknown requests to the real bureau. We use only test identities, behind an allowlist asserted by tests.
• A call can't prove who answered. So "yes, we changed it" only reaches ASK, and voice can never approve a payment. A forged answer cannot move money.

Accomplishments that we're proud of

• It stops the fraud without wrongly holding good vendors: 25 synthetic cases re-run from /scorecard: 25 of 25 passed. Attacks stopped 8 / 8, legitimate invoices paid automatically 10 / 10, wrongful holds 0, median time 9.3 s, about 2 cents per case.
• Every decision traces to a rule and an evidence line in the audit log, so a business owner can read why.

What we learned

Put the model where it adds judgement (reading, explaining) and plain code where it adds safety (deciding, paying). And measure wrongful holds, not just caught fraud, because a tool that blocks good vendors gets switched off.

Responsible design (Microsoft)

Claude's output can raise a verdict, never lower it. Anything unfamiliar defaults to ASK. No credit reports are pulled (identity, fraud score and reverse lookup only, on test identities). Voice can't approve a payment. Every action is logged and a kill switch freezes payments.

What's next for Quintet

Pilot with a few local small businesses, connect real bank and accounting exports, compile each business's policy from its own expense policy, add vendor consent for identity checks, and add per-business tenancy.

Real vs simulated

Real: Claude reading and explaining, the gate, CRS sandbox calls, sandbox bank transfers, the Cartesia voice agent, live state. Simulated: the business, vendors and employees (fictional, marked SYNTHETIC), CRS test identities, sandbox money, and the vendor's answer (a teammate plays the vendor; the demo call runs in the browser, not over the phone network). We did one informal interview with a small-business owner, not a study. The policy comes from a published small-business expense policy and the attacks from documented business-email-compromise patterns.

Tracks we're entering

• Atlassian: Best Security Solution for Agents. Quintet is an agent system that defends itself: intake runs with no tools, hidden instructions inside a PDF are detected and logged as evidence, and a deterministic gate (not the model) decides every payment. A model verdict can only make the outcome stricter.
• Armadin: Best Security Hack. It stops payment-redirection fraud (fake "we switched banks" invoices) 8 of 8 times in our synthetic cases, with 0 wrongful holds.
• Hyphenate: autonomous finance agents with scoped access, a work log and human escalation.
• CRS, Cartesia, Capital One Nessie, Convex, Microsoft: see "How we built it" and "Responsible design" above.
• Cal Hacks: Most Technically Complex, and Best People-First Social Impact (small businesses are the ones with nobody to double-check their payments).

Check it out Here: https://quintet.marketingmeteor.workers.dev

Where each sponsor's tech lives (video timestamps)

• Hyphenate: 0:00 the moment; 1:06 a receipt photo through the same gate
• CRS Credit: 0:08 red flags; 0:47 identity, fraud score 85 and reverse-phone checks
• Cartesia: 0:18 the verification call to the number on file
• Anthropic (Claude): 0:37 "Why was this stopped?" answered from the case record
• Capital One Nessie + Convex: 0:53 payment broken on purpose, paid exactly once, live board
• Microsoft: 1:27 scorecard, 25 cases, 0 wrongful holds

Built With

• capital-one-nessie
• cartesia
• claude
• cloudflare-workers
• convex
• crs-credit-api
• nextjs
• typescript