Solutions · Banking & Payments

When the transaction is legitimate but the customer isn't free.

PSR PS24/7 made affective evidence load-bearing for UK retail banks: when a customer claims they were scammed, the sending and receiving PSPs split liability 50/50 unless they can document that the customer authorized freely and with full understanding. RTP, FedNow, Pix, and SEPA Instant make the same truth real-time everywhere else. RTScale captures what your fraud stack can't: documented evidence that the customer authorized the payment with intact understanding, free of coercion — at the moment they pressed send.

£85k cap
Per-claim reimbursement ceiling under PSR PS24/7 since October 2024.
50/50
Liability split between sending and receiving PSPs unless the customer's free-authorization can be evidenced.
7day
Standard window for the customer to raise the claim. Whatever you can document, you must have captured by then.
01 · A worked example

Seven minutes that decide who's liable.

Sarah, 67, authorizes a £14,200 Faster Payment to her "bank's fraud team." She'll realize it was a scam by lunchtime. Whether her PSP is on the hook for the £85,000-cap reimbursement depends on what was documented during this window.

Time
Customer & bank
RTScale signal
09:42AM
Phone rings Caller introduces themselves as the bank's fraud team. Claims a flag on Sarah's account. Instructs her to move funds to a "safe holding account" — urgent, no time to discuss with family.
Not yet engaged Banking app not open. No capture. By design — affective sensing only inside authenticated banking sessions.
09:45open app
Authenticates with Face ID Bank's mobile app launches. Standard biometric authentication completes. Sarah navigates toward Faster Payments.
Quick Scan · baseline On-device, ~180 ms inference. Establishes Sarah's individual affective baseline for this session. Result: within normal envelope. Baseline · OK
09:46compose
Enters £14,200, new payee Recipient is a previously unseen sort code and account. Sarah types account name as dictated by the caller. CoP returns a name mismatch warning — Sarah dismisses it.
Risk threshold crossed High-value · new payee · CoP mismatch dismissed. Risk score from bank's existing engine triggers RTScale Deep Scan request. Deep Scan · armed
09:4730s scan
Standard confirmation page · payment review The PSP's "Are you being asked to send this money by someone else?" friction screen displays. Sarah reads it. Pauses three seconds. Taps "No, this is for me." 30-second Deep Scan runs in the background — Sarah is unaware of being scanned beyond the standard biometric.
Sustained distress detected Three independent indicators above cohort baseline: sustained micro-distress (facial); scripted-speech prosody markers in her muttered confirmations; gaze instability inconsistent with reading. All three indicators decomposed, individually scored. Confidence · high
09:48sign
Sarah taps "Confirm payment" Payment instruction is composed by the bank's mobile app and prepared for submission to FPS.
Signature sealed SoM Signature signed by the phone's Secure Enclave · SHA-256 · EdDSA · TPM-rooted attestation · bound to the payment instruction's transaction reference. Signature, not raw frames, transmitted to RTScale Trust Cortex. Sealed
09:48+30s
Bank's fraud platform receives the instruction Payment instruction arrives at the bank's existing fraud screening (in this example: bank's Featurespace-equivalent ensemble) with the RTScale signature attached as side-channel metadata.
Trust Cortex composes Affect indicators + intent context (new payee + CoP mismatch + risk score) + bank's policy. Output: HOLD recommended · 45-minute reflection. Decision is the bank's; RTScale recommends.
09:49hold
Hold applied · customer notified In-app banner: "We've paused this transfer for 45 minutes to give you time to check. Here's how to verify your bank's fraud team contacted you." Pay.UK Stop Scams contact card. SMS to Sarah's nominated trusted contact, per her standing instructions.
Awaiting outcome Signature retained, encrypted at rest under bank's tenant key. Reviewer-facing report compiled in parallel.
10:30+45 min
Daughter calls back · payment cancelled Sarah's trusted contact calls. They check the bank's actual fraud number on the back of Sarah's card. The "fraud team" call was a scam. Sarah cancels the payment in-app.
Outcome recorded Dual-template report generated. PSR reasonable-grounds language pre-populated for the bank's case file.
T+30derasure
Standard data lifecycle Per the bank's retention policy and Sarah's GDPR rights, the signature can be cryptographically erased on request — keys revoked, making the capture unverifiable forever.
GDPR Article 17 satisfied by design No re-derivation possible. No "deleted but recoverable." Cryptographic erasure is mathematical, not procedural.
Two reports, one signature

For Sarah

Plain-language explainer: what the bank saw, why the hold happened, what she can do if she disagrees. No deception accusation. No clinical claims. Respect for her authorship of the moment.

For the reviewer

Decomposed affect indicators with cohort-normalized baselines. Signature provenance and verification chain. PSR PS24/7 reasonable-grounds language ready to file. Audit trail to T+5 years.

02 · Five use cases

Same signal. Different latency budgets.

RTScale captures the same affective signature across these flows. What differs is where it sits in your stack, what counts as a reasonable response, and which regulator is asking the question.

01

APP scam protection

UK PSR PS24/7 · Pay.UK CRM

The flagship case. Customer is conscious, biometrics match, device is theirs — but a coached caller is reading them a script. Reimbursement liability falls on the sending PSP unless free-authorization can be evidenced. Deep Scan during the standard friction screen captures the documented record.

Trigger High-value, new payee, CoP warnings dismissed
Latency 30s Deep Scan — fits friction screen
Response Pay.UK-aligned 45-minute reflection hold
Stack fit Parallel signal to your existing risk engine
02

Instant payment fraud

FedNow · RTP · Pix · SEPA Instant

Once funds settle on an instant rail, recovery is functionally impossible. The fraud decision happens in the authorization window — typically <1 second end-to-end. Quick Scan inference fits inside that budget; Deep Scan reserves itself for step-up flows where the rail tolerates added friction.

Trigger Real-time payment authorization
Latency ~200 ms Quick Scan p95
Response Pre-rail-submission hold or step-up
Stack fit Pre-authorization gate, before rail submission
03

High-value wire transfers

BSA / AML SAR · OCC supervisory

Business email compromise, vendor impersonation, coerced wires. These are not real-time decisions — the bank's existing wire approval workflow tolerates a 30-second Deep Scan and a senior banker call-back. Affect indicators are presented to the call-back banker; documented signature lives in the audit trail.

Trigger Wires over internal threshold ($25K+ typical)
Latency 30s Deep Scan — no rail constraint
Response Affect-aware senior banker call-back
Stack fit Augments existing wire approval workflow
04

Card-not-present step-up

PSD2 SCA · EMV 3DS 2.2 / 2.3

3DS challenges already happen at the moment of truth — they are the most concentrated authentication signal in card payments. RTScale's Quick Scan during the 3DS challenge attaches as an extension data field to the ACS response, letting the issuer's frictionless-vs-challenge decision become affect-aware.

Trigger PSD2 SCA challenge, threshold exemption decisions
Latency <200 ms inside 3DS challenge window
Response Issuer-side step-up or frictionless allow
Stack fit EMV 3DS extension data on the ACS server
05

In-branch teller alerts

BSA SAR · State elder-abuse statutes · Bank SOP

A customer arrives with a companion to withdraw $20,000 in cash for "an investment." The teller's training says something's off; their SOP gives them no documented basis to act. The Desktop SDK captures from the teller-facing camera with consent, generates the same signature, and gives the branch manager documented grounds.

Trigger Teller-initiated review · branch SOP threshold
Latency 30s Deep Scan — in-person flows
Response Branch manager alert · SAR-ready documentation
Stack fit Desktop SDK on teller workstation
03 · Where it sits in your stack

Built to slot in, not to replace.

The signature is a signal, not a decision engine. RTScale runs parallel to your existing identity, risk, and screening layers and delivers via webhook or queue into the platform you already trust. You decide policy. We add evidence.

Customer device MOBILE · WEB · DESKTOP Identity verification EXISTING Onfido / Persona / Mitek RTScale State of Mind NEW · PARALLEL SIGNAL Signed signature Transaction risk EXISTING Featurespace / Actimize Bank decision engine EXISTING · YOUR POLICY Allow Hold Step-up
Existing fraud stack
RTScale (new parallel signal)

A signal layer, not a decision layer.

RTScale doesn't compete with your fraud platform. The signed signature flows alongside the payment instruction into whatever decision engine you already run — Featurespace, Actimize, SAS, or your own ensemble.

Your policy decides what to do with affect indicators. Hold for reflection. Trigger step-up. Add to an ensemble score. Pass through with documentation. These are your choices, not ours.

Integration is REST + webhook for cloud-deployed banks; on-premises VPC peering and message-queue (Kafka, IBM MQ) handoffs for the rest.

04 · Regulatory readiness

What you can show a regulator on day one.

RTScale isn't a compliance shortcut — it's an evidence layer. Each major regulation has a specific question; the signature, paired with the right reporting template, answers it.

Regulation
Jurisdiction
What RTScale provides
Retention
PSR PS24/7 Authorized push payment reimbursement
UK
Reasonable-grounds documentation that the customer authorized freely and with intact understanding — or evidence to the contrary that triggers a defensible hold.
≥ 6 years
EU AI Act Article 14 · human oversight
EU
Decomposed affect indicators a natural person can effectively oversee. Article 11 technical-documentation set available at procurement.
10 years
BACEN Res. 6/2023 Pix integrity
Brazil
Integrity signal at the moment of capture, before rail submission. Fits inside the Pix authorization budget.
Per BACEN circular
PSD3 / PSR EU proposal status
EU
Forward-compatible with the EU's consumer-friendly reimbursement framework. Watching final text.
TBD on enactment
GDPR Article 17 · right to erasure
EU + UK
Cryptographic erasure on request — key revocation renders captures unverifiable. Not procedural deletion. Mathematical.
T+30 days default
BSA / FinCEN SAR Suspicious activity reporting
US
Affect-aware narrative inputs for SAR Part V. Pairs with FinCEN FIN-2022-A002 elder-exploitation advisory.
5 years
05 · Review questions

Frequently asked review questions.

Pulled from actual conversations with bank security, model risk, procurement, and DPO teams. If your reviewer asks something not here, ask us — we'll add it.

Q1 Does this trigger a DPIA under UK GDPR or a fundamental-rights impact assessment under the EU AI Act?

Yes to both. Affect data derived from facial and vocal capture is special-category personal data; payment-authorization use is Annex III high-risk under the EU AI Act. We provide a starter DPIA template and a FRIA template populated with our system characteristics. The cryptographic-erasure model materially reduces residual risk because retention is mathematically reversible rather than procedurally promised.

Q2 We're on Featurespace / NICE Actimize / SAS / our own platform. Where does RTScale fit?

Parallel signal, not replacement decision engine. The signed signature flows into your existing fraud platform via webhook or message queue (REST, Kafka, IBM MQ) and joins your ensemble score — or sits as a side-channel attestation if you want to keep the existing ensemble untouched. Your policy decides what to do with the signal. Several of our design partners run RTScale alongside their incumbent platform as a co-equal signal in their hold/step-up logic.

Q3 What about customers who refuse the affective scan?

A refusal is itself a documented event — captured under the Presence signature class with the customer's explicit choice signed and timestamped. Your bank's policy then decides whether a refusal triggers step-up review, manual processing, or proceeds with a documented decline-to-scan. We don't make that policy choice for you. We do recommend that refusal does not by itself trigger denial of service, both for fairness reasons and because some refusals are legitimate distress responses to coercion.

Q4 How do you handle false positives for older customers, customers with Parkinson's, customers with anxiety disorders, or accent variance?

Three structural commitments. First, the demographic-parity gap target is ≤5 percentage points across age, gender, ethnicity, and accent cohorts, continuously measured. Drift triggers retraining. Second, the system does not output a single "deception score" — it outputs decomposed indicators a reviewer can read. A trembling voice is not a coerced voice; the indicator surfaces facial-affect, prosodic, and gaze components separately so the reviewer can weight them. Third, individual baselines are established at session start (Quick Scan) so deviation is measured against the customer's own envelope, not a generic population mean.

Q5 What's the technical-evaluation pack we can run before procurement signs?

Standardized eval pack, available under NDA: 500 labeled multimodal samples across cohorts; reproducible accuracy, fairness, and robustness metrics; SOC 2 Type II report; SBOM and dependency provenance; threat model and red-team summary; the Article 11 EU AI Act technical documentation set; signed signature reference vectors so your team can verify the cryptographic chain independently. We expect a typical bank's model-risk team to take three to five weeks with this pack before signing.

Q6 How does the signature survive an audit five years from now?

Signatures are signed by hardware-rooted keys (TPM 2.0, Apple Secure Enclave, Android StrongBox) with verifiable signature chains. Verification is offline-possible from the public key infrastructure — you do not need a live connection to RTScale to verify a signature five years out. The keys themselves are governed by your tenant; cryptographic erasure on a specific customer's request revokes their keys, not the bank's infrastructure. Backwards-compatibility commitment is documented in the SLA: signatures signed today will be verifiable through 2036 at minimum, with a defined deprecation runway thereafter.

Q7 What's your p95 latency for RTP / FedNow / Pix, and how does that fit our rail's authorization window?

Quick Scan: ≤200 ms p95 on-device, measured across the device matrix in our published device-compatibility table. Deep Scan: 30 s, used only on threshold-crossing transactions where the rail tolerates added friction (APP scams, high-value wires, branch). The Quick Scan budget fits inside the RTP authorization window with room to spare; we'd be happy to walk through your specific rail's timing budget in the demo and show you the on-device benchmarks.

Q8 If RTScale's signal disagrees with our existing fraud score, who wins?

You do. Your policy. The whole point of an explainable, decomposed signature is that your fraud-strategy team can decide how to combine signals — additive, multiplicative, dominant-when-affect-confidence-is-high, or supplied-but-ignored-by-policy. Several of our design partners run the signature in passive mode for the first 60-90 days to calibrate their ensemble weights before letting it influence holds. We support that calibration period with shadow-mode reporting and disagreement analysis.

Bring your hardest case

The demo uses the APP scam your reimbursement team is fighting right now.

Walk us through the case keeping your team up. Real claim, real customer profile (anonymized), real reimbursement exposure. We'll show capture, signature, adjudication, and both the customer-facing and reviewer-facing reports the moment would have produced. Thirty minutes. No deck.