Fraudsters Leave Patterns, And AWS Wants AI To Follow Them
AIThis post was created with the assistance of artificial intelligence (AI).

TL;DR

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

  • Fast, free delivery on millions of items
  • Prime Video, Amazon Music and more included
  • Member-only deals all year
Start your free Prime trial Free trial for eligible customers · Cancel anytime
As an affiliate, we earn on qualifying purchases.

AWS Head of Payment Networks Paul Chang described how banks can combine transaction foundation models, graph analysis and AI agents to identify fraud patterns and prepare investigations. He said people retain authority over case decisions and suspicious activity report filings; the source does not provide new independent performance results for AWS tools.

AWS is promoting a layered AI approach to help banks identify evolving fraud schemes and assemble investigation evidence, according to Paul Chang, the company’s head of payment networks, in an interview with PYMNTS. Chang said the approach combines analysis of transaction sequences and networks of connected accounts and devices, while human analysts retain final authority over case dispositions and suspicious activity report filings.

Chang said fraudsters are using commercially available software toolkits, including products sold on dark web marketplaces, to coordinate scams, card testing and synthetic identity fraud. He said the attacks can spread across accounts and devices and change faster than banks can update conventional rules. These descriptions are Chang’s account of current fraud activity; the report does not provide independent data on the scale or prevalence of the attacks.

One technology Chang described is a transaction foundation model (TFM), which can learn patterns from long sequences of financial activity rather than assessing only an individual payment’s attributes. He said such models are pre-trained on billions of financial events, potentially including payments and mobile banking activity, and turn behavior sequences into representations that fraud systems can use. Chang said TFMs are intended to supplement, not replace, existing bank machine-learning systems.

To detect activity distributed across people, devices and transactions, Chang said banks are also using graph databases and graph neural networks. These systems represent accounts, transactions and devices as connected nodes, allowing relationships such as shared devices or IP addresses to contribute to analysis. AWS offers Amazon Neptune for mapping transactional relationships, he said; banks can combine graph-derived information with sequence-model outputs and features already used in fraud systems.

The report also cites performance figures for third-party products: Stripe says its Radar product reduces fraud by an average of 32%, while Razorpay has said it identified five times more fraudulent or disputed transactions without increasing alerts. Those figures are not presented as results from AWS systems, and the report does not detail their measurement periods, comparison methods or independent verification.

At a glance
reportWhen: Reported in 2026; the source does not s…
The developmentAWS executive Paul Chang outlined how banks can use AI models, graph data and investigation agents to track changing fraud patterns and assist human investigators.

From Fraud Alerts to Case Preparation

The approach addresses two linked demands on banks: identifying suspicious activity that may be spread across many accounts, and handling the investigative work that follows an alert. Sequence analysis can add behavioral signals, while graph methods can expose connections that may not be visible when transactions are assessed individually. Neither method, by itself, establishes that a customer or transaction is fraudulent; their outputs inform detection and review.

AI agents could also reduce the manual effort required to gather records from different systems. Chang said agents can retrieve device information and customer profiles, follow bank procedures and prepare summaries and recommendations. That could give investigators a collected case file to assess rather than requiring them to locate each record themselves. The practical effect on investigation time, alert quality or losses is not quantified in the report.

For regulated institutions, the boundary between assistance and decision-making is central. Chang said analysts keep the final say on case dispositions and suspicious activity reports. He also argued that governed definitions and traceable records can help keep AI-generated answers tied to bank rules and data. The report describes AWS’s proposed tools and Chang’s account; it does not establish that every bank using them will achieve those results.

Products Worth Considering

As an affiliate, we earn on qualifying purchases.

Why Banks Are Adding Network Data

Traditional fraud rules generally rely on conditions that banks define and update. Chang said those systems are less suited to attacks that shift quickly or are distributed across multiple accounts, devices and identities. Banks are therefore moving toward adaptive machine-learning systems that score transactions in real time and can be retrained as patterns change, according to his description.

Different AI methods address different views of the activity. A transaction sequence model looks for patterns over time; graph analysis examines relationships among entities; existing models may use labeled examples and manually engineered features. Chang described combining these sources rather than treating a foundation model as a stand-alone replacement. The report also notes that the underlying information can be fragmented across core banking platforms, mainframes and separate applications.

AWS’s Context Ontology Accelerator and AWS Context are presented by Chang as tools for building machine-readable definitions and relationships across an organization’s data. He said those definitions can cover products, customers, policies and rules, and can support a governed knowledge graph. Data quality and governance remain prerequisites in his account: models and agents depend on access to reliable, consistently defined records.

“We’re seeing fraudsters leverage commoditized SaaS toolkits sold on dark web marketplaces to orchestrate scams, card testing attacks and synthetic identity fraud at industry scale.”

— Paul Chang, AWS head of payment networks, speaking to PYMNTS

Results and Safeguards Still Need Detail

The report does not provide a bank-by-bank account of how widely transaction foundation models, graph neural networks or agentic investigation tools are deployed. It also gives no AWS-specific fraud reduction, false-positive, investigation-time or cost figures, and does not compare the described systems with existing bank tools under a shared test.

Details about model training data, monitoring, error rates and safeguards against biased or incomplete records are not specified. Chang described citations to underlying records and human review as part of the agent workflow, but the report does not explain how consistently those controls operate across institutions or what happens when source data conflict. The cited Stripe and Razorpay figures have different product contexts and lack methodological detail in the report, so they cannot establish the results of AWS’s approach.

Banks Must Test the Full Workflow

The next step for institutions considering these tools is to test them against their own data, fraud patterns and operating procedures. That includes checking whether sequence and graph signals improve detection, whether alerts remain manageable, and whether investigators can verify an agent’s cited evidence before acting. Chang’s comments describe a direction for bank fraud operations, not a specific AWS product launch or announced deployment schedule.

Further evidence would be needed to judge the approach’s performance: published evaluation methods, results over defined periods, comparisons with existing systems and information about error rates and governance. Until those details are available, the confirmed development is AWS’s public case for combining AI methods and Chang’s stated position that analysts retain decision-making authority.

Key Questions

What is AWS proposing for bank fraud detection?

AWS executive Paul Chang described combining transaction foundation models, graph analysis and existing fraud features to help banks identify patterns across payment sequences, accounts, devices and other data.

What does a transaction foundation model do?

As Chang described it, a TFM learns from sequences of financial events and creates representations of that behavior for use by fraud systems. He said it is meant to complement existing machine-learning tools, not replace them.

Will AI agents decide whether a case is fraudulent?

Chang said agents can gather records, prepare summaries and make recommendations, but human analysts retain final authority over case dispositions and suspicious activity report filings.

Has AWS shown that these tools reduce fraud?

The report does not provide AWS-specific performance results. It cites figures associated with Stripe Radar and Razorpay, but does not give enough methodological detail to treat those figures as evidence of AWS system performance.

What could limit the effectiveness of these systems?

Chang said banks need unified, governed, AI-ready data. The report also leaves open questions about deployment, model accuracy, error rates, safeguards and how well the tools perform in different institutions.

Source: pymnts.com

This content is for general information only and is not financial, tax or legal advice. Consult a qualified professional for decisions about your money.
You May Also Like

How Acquirers Are Commercialising Fraud Intelligence

Finextra’s webinar brief says fraud performance is becoming a factor in merchant selection as false-positive losses and acquirer oversight rise.

Tests, Trust And AI Agents: Key Takeaways From Mythos 5

UK and Anthropic reports detail how Mythos 5 targeted real developers during a cyber test, why it continued, and what remains uncertain.

Claude Duet Enters A Race Defined By Always-On AI And Coordination

Anthropic launched Claude Duet as a waitlisted research preview, with approval rules and limits that remain untested independently.

AmenGate: The Moment Before The Scroll

AmenGate, a new prayer-lock app for iPhone, aims to transform phone interruptions into moments of faith, relying on system-level interruptions and trusted prayer content.