Fraud investigation is one of those processes where interface design can directly shape the quality of a decision. Strong detection systems, alerts and large volumes of data are the foundation, but the people investigating also need to understand what is happening, spot the relevant signals and act with sound judgment.
By fraud investigation, we mean the process through which an analyst examines suspicious activity, gathers evidence, assesses the risk and determines what action to take.
In a bank or a fintech, these decisions are part of everyday work. Analysts have to review multiple alerts, interpret information from different sources and resolve situations that can affect both the financial institution and its customers.
From a UX perspective, there is one question I consider fundamental: are we designing tools that genuinely help people investigate, or are we simply displaying information?
Having all the data available does not guarantee that we can interpret it correctly. And when someone has to make decisions about potential fraud, that difference matters.
The challenge of investigating under pressure
To design a fraud investigation tool, we first need to understand the conditions in which the people using it work.
An analyst may spend much of the day reviewing suspicious transactions, cross-checking information and identifying patterns. Some alerts can be dismissed quickly, while others require digging into an identity’s history, examining devices or analyzing behavior.
The problem arises when the tool itself adds complexity to that work.
If understanding an alert means opening several screens, searching for identifiers or comparing information manually, part of the analyst’s attention goes into navigating the tool rather than investigating. That effort builds up over the day.
As the shift goes on, constantly reviewing alerts can lead to fatigue, especially when many of them turn out to be false positives. This can make it harder for the truly relevant cases to get the attention they need.
“The design challenge lies in reducing that unnecessary effort without simplifying the information so much that we lose important evidence.”
Vicky Tomasek, UX/UI & Design Director at Facephi
Our aim is for investigation time to go into understanding the case rather than figuring out how the platform works, even if that does not always mean going faster.
What an analyst needs to see first
One of the first challenges comes when deciding how to organize the information.
A fraud platform brings together risk scores, alerts, rules, transactions, identities, devices and behavioral signals.
All of this data can be useful, but it does not necessarily carry the same weight at every stage of the investigation.
That is why one of the key UX decisions is establishing what the analyst needs to know at the outset.
We can structure that first read around three questions:
- What is happening? Identify the suspicious transaction or activity and understand its risk level.
- Why does it need attention? Recognize the signals and conditions that triggered the alert.
- How can I move forward? Find the related evidence and the actions available to continue the investigation.
This structure makes it possible to build a visual hierarchy that follows the person’s reasoning, instead of forcing them to work through all the available information.
Risk, urgency and priority do not always mean the same thing
There is one distinction that matters especially when organizing alerts.
A high-risk transaction does not necessarily need to be investigated before another one if their conditions, deadlines or consequences differ.
The risk level helps convey the potential severity of a situation. Urgency indicates how much time there is to act. Priority may depend on both, as well as on each institution’s operational rules.
This is why ordering alerts by risk score alone may not be enough to support the work of a fraud team.
From a UX perspective, these criteria need to be understandable, so the analyst can see why certain cases require attention before others.
Highlighting information with colors or labels is only part of it. What matters is helping analysts make better decisions about where to focus their effort.
Making complex data understandable
Once suspicious activity has been identified, another part of the work begins: understanding what information justifies the alert.
Take a transaction with a high risk level. It may be linked to an unknown device, an unusual connection or behavior that differs from what has been recorded before.
Each signal provides information, but none of them should automatically be read as proof of fraud.
Accessing an account from a different location, for example, can be perfectly legitimate. What matters is understanding that signal within the context of the transaction and its relationship with other indicators.
A risk score needs an explanation
This is one of the challenges our UX team at Facephi has been working on while designing Facephi Intelligence Platform.
A score makes it possible to quickly recognize a situation that deserves attention, but the analyst also needs to understand which signals and factors are behind that assessment.
That is why we are working on how to represent risk levels, organize the associated signals and make it easier to access the information that allows each assessment to be explored in more depth.
This involves decisions about visual hierarchy, labels, colors and levels of detail.
A very high-risk signal, for instance, should be easy to identify, but we also need to explain what it means and what information supports it.
It is also important to distinguish between a detected signal, a risk assessment and a final decision. Although they are related, they represent different moments in the process.
An alert tells us that something deserves attention. The investigation is what allows us to determine how to interpret that information and what to do about it.
This distinction helps prevent a score from shaping a decision before the necessary evidence has been reviewed.
Investigating without losing context
Another challenge we have encountered while designing Facephi Intelligence Platform is how to connect information that is related but sits in different parts of the platform.
When an analyst investigates a transaction, they may need to check the associated identity, review other sessions or examine information about devices and connections.
If every lookup requires a new search, the flow is interrupted and the person has to mentally rebuild the relationship between the data points.
That is why our UX team is paying particular attention to how this content is connected and to the continuity of navigation.
The goal is for analysts to go deeper into an investigation without losing track of where they started or what they were trying to verify.
Where an investigation can lose momentum
There are several moments where an interface can create unnecessary friction:
- When deciding which case to handle. If alerts lack a clear hierarchy, prioritizing them requires reviewing additional information.
- When interpreting risk. A score without explanatory signals forces the analyst to look for the reasons behind the assessment.
- When checking related information. Switching between transactions, identities and sessions can interrupt the investigation if navigation is not connected.
- When comparing evidence. When data changes format or location from one screen to another, differences and patterns become harder to spot.
- When resolving the case. Unclear actions or missing context can create doubts about the next step.
- When documenting the decision. Re-entering information the system already has adds unnecessary administrative work.
These situations help us identify where design can make a difference.
Sometimes the improvement lies in reorganizing a screen. Other times, it comes from connecting content, keeping filters in place while navigating or making it easy to return to the previous point.
Continuity of experience is also part of the quality of an investigation.
There is another important aspect: investigations do not always end immediately with an approval or a block.
Depending on each organization’s procedures, it may be necessary to look more closely at the evidence, request additional information or escalate the case.
A good tool has to support these paths without pushing people toward a decision while information is still missing.
Designing for people who spend hours investigating
There is one characteristic of these platforms we should not overlook: they are tools for intensive use.
A person may spend several hours reviewing complex information and carrying out similar tasks.
In that context, visual design stops being a purely aesthetic matter.
Typography, spacing, contrast, component consistency and information density all affect how much effort it takes to interpret each screen.
When everything stands out, nothing does
Fraud tools commonly use color to represent statuses, alerts and risk levels.
But if too many elements compete for attention, we lose the ability to highlight what truly needs it.
Color should have a clear and consistent meaning. Critical information should also never depend on color alone.
A high-risk alert, for example, needs a clear label and signals that explain what it means, regardless of the color used.
It is also important for the same concepts to be represented consistently across different sections.
If the visual meaning of a status changes from one screen to the next, the analyst has to reinterpret something they should recognize instantly.
Alert fatigue is also a user experience problem
When someone reviews a large number of similar alerts, they can grow used to certain patterns and start resolving cases almost automatically.
This is particularly sensitive when decisions have significant consequences.
UX can help reduce that risk by setting exceptional cases apart, making evidence easier to review and using confirmations when the importance of an action justifies it.
But we also need to avoid the opposite extreme: warnings, confirmation windows and messages that appear constantly, even when they add no information.
If everything requires confirmation, those confirmations can also become part of the routine.
The goal is to direct attention to the moments that truly need it, without needlessly interrupting the work.
What design brings to the fraud team
These decisions can translate into concrete benefits for the operation, although their impact needs to be validated through usability testing and real metrics.
| What the analyst needs | What design provides | What we aim to improve |
|---|---|---|
| Identify priority cases | Visual hierarchy and clear prioritization criteria | How attention is distributed |
| Understand an alert | Accessible risk signals and reasons | Risk interpretation |
| Check related information | Connected navigation across transactions, identities and sessions | Investigation continuity |
| Compare evidence | Consistent structures and patterns | Ease of spotting differences |
| Work for extended periods | Appropriate contrast, legibility and meaningful use of color | Less effort to interpret information |
| Justify a decision | Clear actions and contextual records | Traceability and later review |
The value of these improvements shows most clearly when they are considered together.
A platform can hold very complete information, but if finding, interpreting and using it takes too much effort, part of its potential is lost.
Decisions that can be explained
In a fraud investigation, reaching a conclusion matters, but so does being able to reconstruct how it was reached.
For risk, compliance and audit teams, this means knowing what evidence was considered, what actions were taken and what the reasons behind a decision were.
Traceability also poses a UX challenge.
If analysts have to document every step manually or repeat information that is already available, recording a decision can become an extra burden.
That is why it makes sense to design flows that make it easy to record the actions taken and add the necessary justifications at the right moment.
Artificial intelligence can also help organize information and assist during an investigation, as long as its role is understandable and it is clear who makes the decision, something we explored in depth when looking at how design shapes AI as a copilot.
Design also shapes how we interpret risk
There is something I consider especially important when we design tools related to fraud: interfaces are never completely neutral.
The way we organize information influences what a person notices first, which signals catch their attention and which ones may go unnoticed. That carries a responsibility.
Our UX team at Facephi has been working on different flows and interactions within Facephi Intelligence Platform, assessing how information is presented and how we support users as they move through the platform.
To do this, we combine the knowledge of different specialist profiles with testing that allows us to review behaviors, detect potential friction and refine our design proposals.
This work helps us tackle one of the most important challenges in this kind of product: finding the balance between simplifying the experience and keeping the information needed to make well-founded decisions.
We cannot remove all the complexity from a fraud investigation. Nor would it be right to try, if that meant hiding relevant information.
What we can do is design tools that make that complexity understandable, so people can explore it with judgment and act with greater confidence.
Designing for fraud investigation also means taking responsibility for how we help people interpret information and make decisions.
FAQ
Because it influences how analysts interpret alerts, find evidence and make decisions. A clear interface makes risk easier to understand, reduces unnecessary effort and helps keep criteria consistent throughout the investigation.
An interface does not eliminate the false positives generated by detection systems. It can, however, make them easier to identify and review by presenting the signals, history and context needed to tell legitimate activity apart from suspicious activity.
The information needed to understand and prioritize the case: the suspicious activity, its risk level, the relevant signals and the available actions. The rest of the data should be accessible as the investigation requires, without overloading the initial view.
Connected navigation, consistent patterns and a clear organization of data can reduce repetitive searches and screen switching. This lets analysts focus more of their effort on analyzing cases and less on finding or interpreting information.
Because it makes it possible to reconstruct what happened, what evidence was considered and why a particular action was taken. It supports internal review, collaboration between teams and the justification of decisions to auditors or supervisors.
