Connect the signals. Give risk ops the evidence.
Trusted by teams running mission-critical operations.
Channels
Apps
Jordan 3:40 PM
18 new 13.1 disputes from Northwind Outfitters. Deadline is Tuesday.
APP 3:43 PM
14 have carrier proof of delivery to the billing address, so they are strong to represent. 4 shipped to a new address, so I suggest accepting those.
Evidence packets ready for the 14.
Approval needed
Submit evidence for 14 disputes
DK1 replyLast reply today
Message #chargebacks
Risk agents that work every alert
Agents triage monitoring alerts and dispute spikes in Slack or Teams, assemble the evidence, and leave the decision to your team.
@mention an agent in any channel or thread. Click a channel or an agent in the window to explore.
Turn scattered signals into an investigation.
Put specialized agents on the pattern checks and evidence collection behind your fraud and risk reviews.
Trace the activity
Follow the transactions behind an alert across time, payment outcomes, and affected accounts.
Find related patterns
Compare approved device, merchant, and transaction attributes to identify links worth reviewing.
Prepare the response
Give analysts the findings, uncertainty, and proposed next steps before account or payment controls change.
From the first alert to the wider pattern.
Investigate beyond the single event
Correlate the alert with recent authorizations, merchant activity, and prior investigations using scoped records.
Sardine
Marqeta
SnowflakeEvidence before enforcement
Prepare recommendations for your analysts. Blocks, limit changes, and monitoring-rule updates require the authority you define.
Unit21
SlackPossible card-testing activity for review
Risk case R-318 · 3 merchant accounts linked by observed activity
Connect risk signals with transaction context.
Work from your existing fraud stack and approved payment records, with a reviewable trail across the investigation. Systems shown are examples; connector availability, API access, and permissions are confirmed during setup.
Where the review begins
Read alerts, merchant signals, and relevant payment events from your permitted monitoring sources.
SardineUnit21
ChainalysisMarqetaWhere patterns become visible
Compare activity with your internal history and return findings to the team’s existing workspace.
StripeSnowflakeSlackHow Runtime works
Start with a known alert type and define the research an agent should perform before your analysts decide.
Create a risk agent
Add the investigation playbook, permitted comparisons, and escalation rules.
Connect the evidence
Scope access to alerts, merchant records, and tokenized transaction data.
Trace the pattern
Investigate the event and related activity, recording queries and source references.
Review the response
Approve any enforcement action or rule change through your existing risk process.
Risk research with bounded authority.
Read about our securityScoped transaction data
Use restricted account views and tokenized identifiers where available. Apply PII and cardholder-data controls.
Human-led enforcement
Separate research permissions from account blocks, payment controls, and rule changes.
Evidence you can revisit
Keep the queried records, observed patterns, recommendations, and approved next steps linked to the run.
Fraud and transaction monitoring: common questions
01Can agents investigate possible card-testing attacks?
02Can we use the monitoring rules we already have?
03Can an agent automatically block a merchant?
04How are linked merchants or accounts identified?
05Can reviews run on a schedule?
06What should we measure in a pilot?
Implementation guide
How to Investigate Fraud Alerts with Codex and Claude Code
A practical walkthrough with example prompts, scoped access, and human approvals.
Read the guideExplore more for payment and risk ops
See a risk investigation in action.
Watch an agent trace an alert across transaction history and prepare the findings for your risk ops team.