How PicPay automated fraud triage with Databricks Genie Agents

PicPay, one of Brazil's leading digital banks, runs a multi-layered fraud prevention program. Within it, its fraud detection team relies on statistical anomaly triggers to flag unusual transaction behavior in near real time — a layer that, by design, favors sensitivity and therefore generates a high volume of alerts for human review. As monitoring expanded to more products, that review became a bottleneck: triage is inherently sequential, and the queue grew faster than it could be cleared. PicPay's fraud detection team turned to Databricks Genie Agents to build a coordinated multi-agent system that automatically assesses risk on every flagged anomaly. This cut false positives reaching analysts by 60% and made peak response times up to 10x faster, enabling near real-time action on potential fraud.

Challenges of manual fraud triage at PicPay

PicPay aims to make financial services in Brazil simpler and more accessible. As PicPay expanded its use of AI, the fraud prevention team saw an opportunity to improve its evaluation of anomalous transactions.

Before adopting Genie Agents, PicPay’s fraud detection relied on statistical anomaly triggers. These triggers compared past transaction behavior to a predicted baseline. When the volume or value for a given time window exceeded expectations, the system generated an alert. But because the triggers evaluated statistical deviation rather than broader behavioral context, they produced a high number of false positives. Each flagged case required a human analyst to open a dashboard and manually decide whether to intervene.

"Manual triage is inherently sequential, one case at a time, no matter how experienced the analyst is," said Flávio Arena, Tech Manager at PicPay.

This created three compounding limitations: slow response times; variability in the analysis process due to differing case contexts and available signals; and a scaling challenge as monitoring expanded. Expanding monitoring to new products would have required scaling the team proportionally, pulling analysts away from higher-value investigative work. As monitoring expanded, the volume of anomalies became unsustainable, and PicPay’s fraud team started looking for an autonomous alternative.

PicPay initially prototyped an autonomous agent internally. As the team refined the approach for production deployment, it adopted Genie's Agent mode and migrated its rule and validation framework to Genie Agents.

Implementing a four-agent system for real-time fraud detection

To enhance fraud detection while keeping its existing anomaly triggers, PicPay designed a coordinated four-agent architecture. The architecture evaluates each flagged transaction in near real time and returns a consistent risk assessment for the detection team.

PicPay’s fraud team designed two Genie-based use cases, both focused on transactions in the PicPay wallet. One covers the full active base, and the other focuses specifically on risk groups, which carry the highest risk due to their lack of transaction history. When a statistical anomaly is detected in transaction volume or value, the alert is routed to a Genie Agent for evaluation.

"We have one common objective across both use cases, which is the preventive detection of fraud attacks," said Michell Costalonga, Data Analyst at PicPay. "The agent analyzes risk variables tied to how the user behaves on PicPay as well as variables tied to transactions themselves, then compares everything against history to see how far that anomaly sits from the normal pattern."

Coordinated agents for comprehensive analysis

Rather than relying on a single agent, the team built four coordinated agents for each use case:

• One agent analyzes transactions associated with the flagged window.
• A second agent retrieves and analyzes historical behavior.
• A third agent consolidates those findings into a risk score.
• A fourth agent standardizes the output before the case reaches a human analyst.

"We saw that consistency with a single agent was compromised by the size of the prompt and instructions," Michell said. Splitting the workload into four simpler, more focused agents standardized responses. It also cut processing time from 15–20 minutes to 3–7 minutes by running parts of the analysis in parallel.

Efficient processing and error handling

The system also handles failure gracefully. "If the two agents that run the actual queries fail three times, we retry, and on a fourth failure, the anomaly still goes straight to the human detection team, so we never lose a case," Michell explained.

The architecture processes up to 10 anomalies simultaneously. Each case takes 7–10 minutes and consumes roughly 12,000 tokens, at an estimated cost of R$32 for every 100 alerts analyzed.

Development moved quickly because the underlying fraud rules had already been mapped out in an earlier prototype. "We only needed four days to prepare and stand up the entire architecture," Michell said, building on three weeks of rule design work done previously. "The most time-consuming part was figuring out how to divide the work across agents and get that working well with Genie Agents."

Flávio noted that the Genie Agents’ connection to data already governed in Databricks made the build process transparent and simple. The agents were rolled out to the fraud detection team as an automated pre-triage layer, preparing each anomaly before it reaches an analyst. It required no additional training, because the analysts’ day-to-day workflow didn't change — cases simply arrive already contextualized.

The fraud team's Genie Agents workflow sits within a broader shift in PicPay's use of the Databricks Platform. Across the company, teams use AI/BI Dashboards for self-service monitoring and analysis. Interactive notebooks also remain part of daily work for both exploratory analysis and building data pipelines. That foundation, paired with the confusion-matrix dashboard the team built to monitor Genie Agents’ performance, meant the fraud team wasn't introducing a new platform. It was adding a new layer of automation on top of tools already embedded in its workflow.

Transforming response times from hours to minutes with Genie Agents

With automated risk scoring layered onto existing anomaly detection, PicPay improved both speed and precision in its fraud triage workflow, especially during peak alert volume.

The most significant result was a 60% reduction in false positives reaching the human detection team, a meaningful gain for an institution operating at PicPay's scale. A single manual analysis took about 10 minutes per case. That meant a queue of 10 anomalies took 100 sequential minutes to clear. Genie Agents now process the same 10 anomalies simultaneously.

Among the anomalies routed to the agents, 93% of the value later disputed by customers had already been classified as high risk at triage, validating the agents’ risk assessment against a real business outcome. The remaining 7% represented a comparatively small financial value. "We built a Databricks dashboard to monitor classification performance, tracking the confusion matrix, mismatch rate and disputed value associated with false positives and false negatives," Michell said.

Genie Agents’ native auditability further reinforced trust in the system. "Genie lets you go into the agent's conversation, look at the exact query that ran against the database and check the response it got," Michell added, giving supervisors visibility into every automated decision.

Looking ahead, PicPay plans to expand Genie usage through dedicated Genie rooms. These rooms will enable business teams across the company to query specialized knowledge bases without relying on technical teams.

Flávio said the platform improved the team's ability to operationalize AI for fraud prevention. "Genie Agents made our risk management more agile and efficient," he said, "expanding our ability to identify and prioritize potentially fraudulent transactions."