Sound First Responder

• 

  First Responder Workflow

Inspiration

Sound Credit Union’s risk management team faces a timing gap between when a medium-risk transaction is flagged and when a human reviewer can speak with the member to understand the context.

By the time the member is contacted, often the next day, the damage is already done. Details may be harder to recall, the member may be less willing to engage, and the opportunity for earlier intervention may have already passed.

This project attempts at answering:

How can we capture the most relevant details about a suspicious incident quickly and accurately so the risk management team can triage cases with greater confidence?

What it does

First Responder turns medium-risk transaction alerts into immediate opportunities to gather relevant context. Members are invited to complete a short voice or text interview within their authenticated Sound Credit Union banking session, explaining the payment’s purpose, their relationship with the recipient, and any circumstances surrounding the transaction.

The First Responder agent combines these responses with information on device telemetry, and recent account activity. It generates a structured incident report with a qualitative risk assessment, supporting evidence, potential inconsistencies, and concerns requiring urgent review.

This report is then handed off to the risk management team at SCU.

The system operates alongside SCU’s existing risk engine: low-risk payments proceed normally, high-risk payments are rejected, and medium-risk payments proceed while the interview workflow gathers context. It does not pause or reverse payments.

Benefits

• Captures context sooner: Collects the member’s account while details are fresh, reducing reliance on next-day recall.
• Supports faster triage: Gives reviewers an organized, evidence-backed report instead of requiring them to reconstruct events from scattered records.
• Creates opportunities for earlier intervention: Helps surface possible manipulation or account compromise sooner, potentially preventing additional payments.
• Provides a trusted communication channel: Keeps the interview within the authenticated banking experience, reducing the trust challenges associated with unexpected phone calls.
• Offers accessible response options: Allows members to speak or type, depending on their preferences and circumstances.

Challenges

• Depends on member participation: Members may ignore the interview, provide incomplete answers, or repeat instructions supplied by a scammer. The response collection must be robust and account for unfaithful interview attempts.
• Authentication does not eliminate compromise: An authenticated session may still be controlled by an attacker, and a legitimate member may unknowingly authorize a scam.

Built With

• agents
• large-language-model
• natural-language-processing
• telemetry
• threat-analysis