AI Phone Calls for Banks & Fintech: Fraud Alerts, KYC and PCI Compliance

Banking institutions and fintech businesses are falling behind in two aspects at once faster fraud and more stringent compliance. Suspicious transactions can take place in a matter of minutes. A lack of KYC verification can lead to a regulatory finding. Meanwhile, a contact center with human representatives calling clients one by one was not created to solve any of these challenges.

This blog is about answering a very particular question that operations managers, compliance officers, and fintech CTOs are indeed asking: can AI for banks be used to process fraud alert calls, conduct KYC identity verification, and create regulatory records in compliance with PCI DSS, SOC 2, and audits? 

The quick answer is yes, but the devil is in the details. What follows is an analysis of the way in which artificial intelligence voice agents function in a financial organization in order to make it possible for you to evaluate this technology in terms of your particular standards.

Why Financial Institutions Are Adopting AI Voice Agents

These figures are hard to overlook. For example, account takeover fraud cost U.S. consumers and financial organizations more than $13 billion in 2023, according to industry statistics provided by Javelin Strategy & Research. In addition, the average cost of each live call made in financial services is about $6-$12 per contact, and fraud alerts, balance checks, and Know Your Customer procedures take quite a large share of the overall volume of inbound and outbound call traffic.

AI-driven agents in the banking industry are not a novelty. They are needed in order to reach out to the customer within several seconds after the suspicious activity is detected, and verify his/her identity in a reliable way. At the same time, human agents cannot cope with these challenges because of scalability issues.

The transition to AI agents is the next step in the evolution of AI in the banking industry in recent years. AI-based fraud detection systems can identify a suspicious transaction within several milliseconds. What was missing until recently was the communication part, which should be implemented in order to reach out to the customer and prevent any fraudulent activities.

Fraud Alert Calls: What Actually Happens

When talking about fraud detection in the banking industry, most people imagine that something in the risk engine detected the suspicious transaction. But what happens next is rarely known, and this is where AI phone call software comes into action.

This is what the typical workflow of the fraud alert looks like:

• The card transaction is identified as suspicious by the transaction fraud detection system, for instance, spending of $900 in another country when the phone of the card holder is geo-located in his homeland.
• The fraud detection system triggers an outbound AI call in 30 seconds after the transaction.
• The AI voice agent contacts the customer, announces that the call is from the bank and asks the customer whether the transaction is made by him.
• The customer confirms the transaction as legitimate or fraud.
• Depending on the answer, the card is either allowed to operate further or is suspended automatically without any involvement of human agents.
• All the calls are recorded.

This process isn’t theoretical. Banks using AI agents for fraud calls have found out that people respond to phone calls faster than push notifications or SMS, especially people of the older generations and people in areas where smartphone penetration rates are low.

What’s important about this example AI agents don’t actually make any decisions. They get confirmation from the client and send it to the fraud engine. That’s how it was designed – the AI only handles communication.

KYC Verification: Using AI Calls for Identity Checks

The KYC regulations are present in every regulated financial market. All banks, neobanks, and financial technology lending companies have to confirm the customer’s identity at the time of their onboarding and even periodically. The phone verification is not something new in this case the introduction of AI phone calls in banking has just improved the process.

Here is what the flow of such a call may look like:

Onboard customer process started → identity proofs provided online → AI calls to customer → agent asks KBA questions about – DOB, last 4 SSN, address filed → answers validated against customer information → recorded in log with time and recording of call → process continues or escalated for review by human agent.

The reason why this is especially helpful is consistency. A human agent who conducts the Know Your Business Agent (KBA) process at the end of their workday may miss steps or ask different questions each time. An AI agent will have the same protocol and will always follow it to the T.

This will be especially important when there is an investigation into how the onboarding process of customers was conducted. A log of the specific questions, responses, conclusion, and time stamp for a particular call is much more concrete evidence than a statement that reads, “customer verified by phone call.”

In the case of fintech companies, which are obligated to adhere to the guidance of organizations such as Financial Action Task Force (FATF) or comply with Bank Secrecy Act, conducting a KYC process is an obligatory part of their operations.

PCI DSS Considerations for AI Voice Calls

The Payment Card Industry Data Security Standard (PCI DSS), managed by the PCI Security Standards Council, regulates the handling of cardholder data and includes voice calls that discuss payment information.

Here are the key considerations for AI phone calls in banking has a PCI-compliant environment:

What AI agents should never do during a call:

• Request the client to recite the complete card number
• Keep audio files that contain the recitation of card numbers without DTMF masking or Pause/Resume control of the call
• Transmit cardholder data via an unencrypted channel

What AI calling platforms should support:

• Ability to pause and resume recordings for allowing agents to pause recording of sensitive data entry
• DTMF (telephone keypad) based inputting of card numbers instead of voice-based capturing, thus avoiding the data entry in voice recording altogether
• Encryption of recorded calls while storing and transmitting them
• Access controls on retrieval of call recordings

Vendors targeting financial institutions offer many AI telephone call systems that provide PCI compliance, but what matters is how they do it. Get specific details on their ability to pause and resume recording, mask cardholder data in transcripts, and store the encryption keys.

PCI DSS 4.0, which was effective from 2024, placed greater emphasis on multi-factor authentication and access controls for any system that processes call data related to cardholder data.

SOC 2 Requirements for AI Calling Platforms

SOC 2 (Service Organization Control 2), controlled by the American Institute of Certified Public Accountants (AICPA), is the basic security certification that any bank or fintech company demands from its tech vendors. Thus, when you analyze an AI calling solution, the minimum threshold is SOC 2 Type II. 

Unlike other types of SOC 2 reports, which just confirm that security controls are in place, SOC 2 Type II guarantees that they function properly in the long term (typically during the period of six to twelve months). When it comes to AI phone call software for banks, the applicable Trust Service Criteria are:

• Security: Is the access to call data restricted and documented?
• Availability: Is the platform capable of meeting uptime requirements for fraud calls, if needed?
• Confidentiality: Is call data safeguarded against unauthorized disclosure?
• Processing Integrity: Is the processing of calls performed correctly?

In other words, a SOC 2 Type II report confirms that these security controls have been verified independently. Therefore, ask the vendor for the document itself, not just a checkmark on a compliance page.

Regulatory Call Recording and Audit Trails

This is among the least addressed issues when it comes to the use of AI software for financial planners. It is among the most significant.

There are different record keeping laws and regulations in place for US financial institutions. There are examination standards provided by the Federal Financial Institutions Examination Council (FFIEC) and there are additional state retention laws in addition to federal guidelines. In Europe, MiFID II requires businesses to keep records of communication pertaining to financial transactions for five years.

With regards to AI phone calls, here are the things that an audit-ready log must have:

• A full audio log with a timestamp
• A transcript of the conversation (with all sensitive PCI data appropriately masked)
• Customer ID information associated with the call (account number, authentication result)
• Agent script version used on the call
• Access log indicating which user accessed the call log. 

This is very important because dispute resolution comes into play. The customer can raise an issue against a transaction, saying that they did not agree to anything on a fraud warning call. In this case, the bank will need to be able to present the transcript and audio of the conversation to disprove the claim. Structured logging is essential for this.

Structured logs from the AI calling platform are mandatory in many environments.

Security Risks and How Banks Mitigate Them

The use of AI call assistant in banking cannot be considered without looking at the possible dangers, not only the advantages. Below are the major ones and ways of handling them:

The last line bears repeating: When it comes to fraud and KYC calls, the banks should be using AI agents executing deterministic call scripts – and not general conversational agents which improvise their responses. There is simply no room for deviation from the script when making calls for identity verification purposes in the financial sector.

Implementation Checklist for Banks and Fintech Companies

Prior to rolling out any AI call center application for banking applications, ensure the following:

• The vendor is SOC 2 Type II certified (for the full audit report)
• Supports call recording features such as pause and resume (PCI-compliant)
• Supports DTMF entry (collects cardholder data)
• Timestamp, call log transcript, and result of verification are included in the log
• Customizable retention period to meet regulatory guidelines (at least 5 years in most cases)
• Call recording role-based access control
• Customer consent language adheres to TCPA (U.S.) or equivalent law in your jurisdiction
• Integration with the existing fraud management system or core banking solution
• Live agent transfer for AI unable to handle calls. 

What Compliance Teams Need to Know Before Going Live 

Are AI calls PCI compliant? They can be if the platform allows collecting the DTMF input, allows pauses and resuming of recordings, and storing it in an encrypted form.

Can AI call agents perform KYC identification of the customer? Yes, AI call agents can make knowledge-based authentication calls and record the outcomes. Researchers usually apply this method together with the documents verification procedure.

Do I need to get customer consent for AI phone calls? In the United States, under the TCPA regulations, such calls require a prior consent of the customers. It is usually obtained when the client opens an account with the bank.

How long should banks keep AI call recordings? It differs according to requirements. Many U.S. federal regulations require individuals to keep financial documents for at least five years. There may be some different requirements under certain state laws or foreign regulations like MIFID II in the EU. Set up retention periods in accordance with the most stringent regulation.

Well-designed AI call systems ensure that they escalate failed calls to human agents or secondary contact through SMS or email. No one must ever drop an anti-fraud alert just because the AI call did not succeed.

Closing Note

Today, banks can use AI-based software for phone call transactions that sufficiently advances their ability to deal with live fraud alerts and customer due diligence processes but properly implementing it requires far more than selecting a vendor with a cool demo product. One should know about PCI DSS, SOC 2, call recording requirements and practical aspects of integrating such calls into one’s current fraud/compliance stack.

For a closer look at the integration of AI-based voice agents into the fraud prevention process, FFIEC guidelines on digital authentication are a good primary source to consult. To understand how to deal with voice calls in terms of PCI, there’s an Information Supplement by PCI SSC about protection of telephone-based payment card data. 

Banks and fintechs that implement it properly will be able to reduce their fraud losses, save on costs and develop compliance programs capable of withstanding an audit. Those who hurry to do it improperly will face regulatory attention.