AI Prompt Template for Fraud Detection and Anomaly Investigation

Objective: Equip risk and compliance teams with a structured AI prompt that systematically reviews transaction patterns, behavioral baselines, known fraud indicators, and contextual signals, then produces clear risk scores along with recommended investigation or blocking actions.

The base prompt was formed through these deliberate steps:

Identify the core analytical sequence required by the use case: establish behavioral baselines first, then examine transaction patterns against those baselines, map known fraud indicators, layer contextual signals, calculate a risk score, and finally output actionable recommendations.
Isolate reusable organizational knowledge (brand voice, risk appetite, escalation rules) so it can be maintained once and injected consistently via snippets.
Extract the variable elements that change with every investigation (specific transaction data, customer profile, time window, jurisdiction) so they can be supplied at runtime without rewriting the prompt.
Sequence the instructions so the model must reason step by step rather than jump to a conclusion, reducing hallucinated risk scores.
Add explicit output constraints (score scale, evidence requirements, recommendation categories) to keep responses uniform and audit-ready.

Note

Keeping organizational rules inside snippets means the same prompt works across multiple products or regions without duplicating policy text.

Prompt Template

{{snippet:brand_voice}}

You are a senior fraud analyst assisting the risk team. Analyze the following case using the sequence below.

Customer profile:
{{customer_profile}}

Transaction data under review:
{{transaction_data}}

Time window:
{{time_window}}

Jurisdiction and regulatory context:
{{jurisdiction}}

Follow these steps exactly:

1. Reconstruct the customer's behavioral baseline from historical patterns supplied in the data.
2. Compare the current transaction patterns against that baseline and list every material deviation.
3. Map the observed deviations to known fraud indicators (velocity, device, location, amount, merchant category, etc.).
4. Incorporate the contextual signals provided and note any amplifying or mitigating factors.
5. Assign a risk score on a 0-100 scale. Justify the score with the strongest evidence only.
6. Recommend one primary action: Investigate further, Block immediately, or Monitor. Include secondary monitoring steps if relevant.

Output format:
- Risk score: [number]
- Key evidence: [bullet list]
- Primary recommendation: [Investigate / Block / Monitor]
- Rationale: [concise paragraph]
- Suggested next steps: [bullet list]

{{snippet:risk_appetite}}
{{snippet:escalation_rules}}

Element	Type	Example value
{{snippet:brand_voice}}	snippet	You speak in a precise, neutral, and evidence-focused manner. Avoid sensational language.
{{snippet:risk_appetite}}	snippet	Our institution treats any score above 70 as high risk requiring immediate human review.
{{snippet:escalation_rules}}	snippet	Escalate to the fraud operations team within 15 minutes for scores of 85 or higher.
{{customer_profile}}	variable	Retail banking customer, account age 4 years, average monthly spend $2,800, primary device registered in Singapore.
{{transaction_data}}	variable	Three outbound transfers totaling $9,400 in 40 minutes to new beneficiaries in a high-risk corridor, initiated from an unrecognized device.
{{time_window}}	variable	Last 72 hours
{{jurisdiction}}	variable	Singapore, MAS Notice 626 compliance required

Prompt Example

You speak in a precise, neutral, and evidence-focused manner. Avoid sensational language.

You are a senior fraud analyst assisting the risk team. Analyze the following case using the sequence below.

Customer profile:
Retail banking customer, account age 4 years, average monthly spend $2,800, primary device registered in Singapore.

Transaction data under review:
Three outbound transfers totaling $9,400 in 40 minutes to new beneficiaries in a high-risk corridor, initiated from an unrecognized device.

Time window:
Last 72 hours

Jurisdiction and regulatory context:
Singapore, MAS Notice 626 compliance required

Follow these steps exactly:

1. Reconstruct the customer's behavioral baseline from historical patterns supplied in the data.
2. Compare the current transaction patterns against that baseline and list every material deviation.
3. Map the observed deviations to known fraud indicators (velocity, device, location, amount, merchant category, etc.).
4. Incorporate the contextual signals provided and note any amplifying or mitigating factors.
5. Assign a risk score on a 0-100 scale. Justify the score with the strongest evidence only.
6. Recommend one primary action: Investigate further, Block immediately, or Monitor. Include secondary monitoring steps if relevant.

Output format:
- Risk score: [number]
- Key evidence: [bullet list]
- Primary recommendation: [Investigate / Block / Monitor]
- Rationale: [concise paragraph]
- Suggested next steps: [bullet list]

Our institution treats any score above 70 as high risk requiring immediate human review.
Escalate to the fraud operations team within 15 minutes for scores of 85 or higher.

Extended example values:

{{snippet:brand_voice}}
- You speak in a precise, neutral, and evidence-focused manner. Avoid sensational language.
- Maintain a calm professional tone that prioritizes factual accuracy over urgency.
{{snippet:risk_appetite}}
- Our institution treats any score above 70 as high risk requiring immediate human review.
- Scores between 40 and 69 trigger enhanced monitoring for 48 hours before clearance.
{{snippet:escalation_rules}}
- Escalate to the fraud operations team within 15 minutes for scores of 85 or higher.
- Notify the relationship manager within one hour for any confirmed account takeover pattern.
{{customer_profile}}
- Retail banking customer, account age 4 years, average monthly spend $2,800, primary device registered in Singapore.
- SME client, account age 18 months, typical payment volume $45,000 per week, dual-authorization enabled.
{{transaction_data}}
- Three outbound transfers totaling $9,400 in 40 minutes to new beneficiaries in a high-risk corridor, initiated from an unrecognized device.
- Single card-not-present purchase of $6,200 at an electronics merchant outside the customer's usual geographic range, followed by two cash withdrawals.
{{time_window}}
- Last 72 hours
- Previous 14 days
{{jurisdiction}}
- Singapore, MAS Notice 626 compliance required
- European Union, PSD2 strong customer authentication obligations apply

Tip

Test the filled prompt with both high-risk and low-risk sample cases to confirm the model consistently follows the six-step sequence and respects the risk-appetite thresholds defined in the snippets.