Case Study: Transactional Fraud Detection

Context: the problem that can't wait

Mexico lost USD 1,067 million in digital fraud in 2025, per analysis using Banxico and CONDUSEF data. Of that total, only 1.4% was ever recovered by the victim. Fraud in digital account openings grew 300%, tied to deepfakes and AI-generated synthetic identities.

The share of financial institutions reporting growing fraud losses year over year rose from 59% to 76% between 2025 and 2026. And fraud's profile changed: it's no longer misspelled emails or clumsy call scripts — it's an organized industry with AI tools more sophisticated than many detection teams'.

Banco BANSI Mexico, a B2B2C digital bank present in 18 states, processed roughly 4.2 million monthly transactions in 2024 across corporate payments, payroll disbursements, and electronic vouchers. Its fraud-detection engine was a static rules system over six years old: functional for 2018's fraud, blind to 2024's.

The challenge

Regulatory. Corporate clients' and their employees' transactional data is subject to LFPDPPP and CNBV security provisions. No transaction data could go to a third-party API outside Mexico without a privacy-impact analysis and specific contractual authorization — ruling out any SaaS solution processing data on external servers from the start.

Operational. The rules system generated false positives on 18% of legitimate transactions, creating friction with corporate clients reporting payroll payments stopped for no apparent reason. Operations dedicated 6 full-time analysts to manual review.

Technical. Fraud patterns evolved faster than rule-update cycles — a new attack vector took 3 to 6 weeks to become a detection rule. By then, the damage was done.

Latency. The authorization SLA was 800 ms. Any AI solution that didn't fit that margin wasn't operationally viable.

The solution: on-premise private models with real-time inference

BANSI chose an approach of proprietary models deployed on its private infrastructure (own data center in Mexico City with redundancy in Querétaro), trained exclusively on its historical transaction data.

Two-layer scoring architecture. Layer 1 — Fast scoring (< 80 ms): a gradient-boosting model (LightGBM) trained on 18 months of transaction history computes an initial risk score based on 47 variables: user's historical behavior, device, geolocation, time, amount relative to average, transaction velocity over the last 24 hours, and origin channel. If the score is below 0.15, it auto-authorizes. Above 0.75, it blocks and generates an alert.

Layer 2 — Contextual scoring (< 400 ms): transactions in the gray zone (score 0.15-0.75) pass to a graph neural network (GNN) model that analyzes relationships between involved accounts — identifying mule-account rings, structuring (smurfing) patterns, and coordinated anomalous behavior across multiple accounts in real time.

Real-time feature store: behavioral variables recalculated in milliseconds using Apache Kafka as the streaming backbone — the model always sees the customer's current state, not 24 hours ago.

Continuous feedback: the fraud team's analysts label manual-review cases. Those labels feed the model's weekly retraining, which learns from new attack vectors without waiting for a rule-update cycle.

Total data sovereignty: no transaction, no customer data, and no model output leaves BANSI's infrastructure. The CNBV can audit the model, training data, and decision logs at any time — everything stays inside the regulatory perimeter.

Results at 9 months

Metric	Before	After
Decision time per transaction	800-1,200 ms	< 380 ms
False positives (legitimate transactions blocked)	18%	3.2%
Fraud detected before settlement	44%	91%
Direct fraud losses (base 100)	100	31
Analysts dedicated to manual review	6	2 (high-complexity cases)
New attack vectors incorporated into model	Weeks	< 7 days (weekly retraining)

The most significant business impact wasn't the loss reduction — it was recovering corporate clients' trust. Complaints about blocked legitimate transactions fell 82%, and corporate-segment NPS rose 31 points over the period.

What made the difference

Proprietary models, not a vendor's black box. BANSI can explain every decision to the corporate client, the CNBV, and its own audit team. When a transaction is blocked, the system automatically generates the justification: which variables triggered the risk and with what weight. That turns a rejection into a conversation, not a wall.

Private infrastructure as a strategic decision, not a regulatory constraint. Beyond compliance, keeping the model within proprietary infrastructure gave BANSI control over retraining schedules, what data enters the model, and how it evolves — without depending on an external vendor's roadmap.

The analyst team as part of the system, not an alternative to it. Analysts who used to manually review 18% of transactions now label the 50-70 weekly complex cases the model can't resolve with certainty. That feedback is the system's most valuable asset — it turns the human team's experience into continuous training signal.

The context that makes it replicable

AI in 2026 stopped being a trend and became a key element for Mexico's financial sector, especially in its ability to analyze in milliseconds, blocking suspicious transactions and enabling both preventive and reactive detection.

Mexico's 2025-2030 National Digital Finance Strategy aims to ease regulations to foster innovation, including the possibility of extended regulatory sandboxes and public-private collaboration on cybersecurity. Shared fraud databases between financial institutions are being piloted, potentially enabling AI models to be trained on more robust and diverse datasets.

BANSI's case isn't exceptional — it's the standard Mexican financial institutions are converging toward: proprietary AI models, on proprietary data, with infrastructure under proprietary control. What differs between institutions is how fast they get to that architecture.

Illustrative case. Context sources: Banxico, CONDUSEF, BioCatch Digital Banking Fraud Report 2026, Mexico's 2025-2030 National Digital Finance Strategy — reviewed July 2026.