On a bank’s phone line, every call is a risk decision: who is this, what are they asking to change, and which clock just started. VoiceRun agents authenticate at the tier the request calls for, recognize a dispute without the magic words, and bring in a person with context attached. Every rule is code your team can read.
Built for SVPs of contact center operations, chief digital officers and CISOs at banks, and COOs and member experience leaders at credit unions.
Card services line
Sat 7:41 AM$2.9B+
lost in 2025 to call center fraud (tech support and government impersonation scams) reported to the FBI, across more than 80,000 complaints
FBI IC3, 2025 IC3 Annual Report, 20262.3%
of banked households use the phone as their main way into an account, against 48.3% on mobile, so the calls that remain tend to be the ones the app didn’t settle
FDIC, 2023 Unbanked and Underbanked Household Survey10 of 10
largest U.S. commercial banks had deployed chatbots in customer service by 2023, when the CFPB warned about “doom loops”
CFPB, Chatbots in Consumer Finance, 2023146.1M
members across 4,214 federally insured credit unions, 156 fewer than a year earlier, so fewer teams serve more members
NCUA, Quarterly Credit Union Data Summary, 2026 Q2The calls
Most calls are routine. Some start a legal clock. A few come from someone trying to get into an account that isn’t theirs. The agent treats each as what it is, in code your risk team can read and test.
Reads posted and pending activity from the core and explains a hold in plain terms, including why a deposit is not yet available. Asks for only as much verification as a balance needs.
Systems the agent works in: Core banking · Digital banking
Locks a card as soon as the member asks, orders the replacement, activates the new one, and explains a decline. Locking is reversible and sits at a lower tier than changing an address.
Systems the agent works in: Card processing · Core banking
Hears “I didn’t make that” as a notice of error, records when the member first said it, collects what the dispute team needs, and tells the member what happens next.
Systems the agent works in: Dispute platform · Card processing
Resets access only after a code or approval goes to a device or number already on file, the kind of control FFIEC guidance lists for call center resets. Everything else goes to a person.
Systems the agent works in: Digital banking · Identity provider
Calls members about suspicious activity inside the consent, content and call-count limits your counsel sets. A confirmed fraud answer locks the card and starts the reissue before the call ends.
Systems the agent works in: Fraud engine · Card processing · Consent records
Quotes a payoff with the per diem, moves or schedules a payment, and explains the due date and late fee. A card payment hands off to your existing payment flow.
Systems the agent works in: Loan servicing · Core banking · Payment system
Tells an applicant what is outstanding (a document, an identity check, a signature) and what happens next, then brings in a banker when a decision or an exception is needed.
Systems the agent works in: Account opening · Loan origination
Sends statement copies and tax forms straight through. An address change, a new payee or a card order to a new address triggers a step-up, a cool-off period or a person.
Systems the agent works in: Core banking · Digital banking
Holiday hours, ATM and shared-branch locations, notary availability and wire cutoffs, read from one maintained record per branch. A closure or an outage changes the answer in one place.
Systems the agent works in: Branch data
Why it's hard
Fraudsters work the phone, examiners sample the calls, and the core was built before voice agents existed. The hard parts are identity, legal clocks and integration.
The reality
FinCEN’s 2024 alert on deepfakes warns of synthetic audio, and FFIEC guidance names tricked call center reps as a route to credential resets. A caller who sounds exactly right still has to prove it.
How VoiceRun handles it
The agent never counts a voice as a factor. Identity comes from the signals your risk team picks (an app approval, a code to a number on file, a call-back), enforced in code, and a score from your fraud service can count as one signal among several.
Authentication in code
FinCEN’s 2024 alert on deepfakes warns of synthetic audio, and FFIEC guidance names tricked call center reps as a route to credential resets. A caller who sounds exactly right still has to prove it.
The agent never counts a voice as a factor. Identity comes from the signals your risk team picks (an app approval, a code to a number on file, a call-back), enforced in code, and a score from your fraud service can count as one signal among several.
Authentication in code
Tested before launch
Your risk team’s worst calls become scripted callers: the social engineer, the panicked victim, the member who never says “dispute.” AI callers place real voice calls to the agent, evaluators grade each run, and a failing run holds the release.
Simulated callers place real voice calls to the agent, evaluators grade every conversation against what should have happened, and a release that regresses never reaches your callers.
$ vr simulate staging --name fraud-and-dispute-line --wait
7/7 simulated calls passed · evaluator: judge
The platform
Start with the calls that carry the least risk and the most volume. Authentication, disclosure and scoring share one record, so your risk team reads one set of rules and one set of results.
Your systems
The agent reads and writes where your reps do, through the interfaces your team exposes, so no second record needs reconciling at the end of the day.
Core banking
Reads balances, holds and loan data, and writes the changes a member asks for, through whatever interface your processor exposes.
Common Fiserv, FIS, Jack Henry, Symitar
Card & disputes
Locks and reissues cards, reads transactions, and opens disputes with the date of the member’s first report.
Common Marqeta, Visa Resolve Online, Mastercom
Digital banking
Sends the step-up approval to the member’s registered device and reads whether the app is enrolled.
Common Q2, Alkami, Jack Henry Banno, Backbase
Fraud & risk
Reads open alerts and risk scores before the agent acts, and writes the outcome of a confirmed fraud call.
Common Verafin, NICE Actimize, Feedzai
Telephony
Keeps your numbers and carrier, and transfers a member to your contact center, where the agent can pass context with the transfer.
Common Twilio, Telnyx, Bring your own carrier
Named products are examples of what’s common in each category; none of them is a prebuilt connector. VoiceRun agents call any API or database your team exposes, and every connection is code your team can read. Your carrier, numbers and contact center stay where they are.
Control
None of these depends on a model remembering to behave. Each is a rule your risk team can read, test in simulation and change through review.
Each action is assigned a tier in code, from hours and rates up to payees, wires and credential resets. The agent cannot act above the tier the member has reached.
The greeting that identifies an automated assistant and a recorded call is spoken from code, word for word, with the variants your counsel specifies for states that require all-party consent.
A report of an unrecognized charge is logged with the time of the member’s first words and carried to your dispute platform. Reg E accepts oral notice, so the date matters.
A member who asks, fails verification, or raises fraud or hardship is transferred with a summary. The rule runs in code, outside the model, so a prompt change cannot remove it.
Loan and card payments go through your existing payment flow. Card numbers stay out of the conversation and the transcript.
The transcript, every system action and the evaluation sit under one call ID, so QA, compliance and an examiner’s sample read the same record. Recording, redaction and tracing are per-environment settings, off until you turn them on.
Your code remains your code, your data remains your data, and the models we train for you serve only you.
Deployment options: our SOC 2 managed cloud, your VPC, your cloud, or on-premises with VoiceRun Edge, available under enterprise agreement.
Perspective
VoiceRun CEO Nick Leonard’s July 2026 essay on voice AI in banking. Lock-in and concentration risk are the real cost of a one-way door, and the answer is a control plane that leaves a bank dependent on no single model or vendor.
FAQ
It does not treat a voice as proof. Each action carries a tier in code, and the agent asks for the step-up that tier needs: an approval in your banking app, a code to a number on file, or a call-back to one. If you run a fraud-scoring or voice-security service, the agent can call it and weigh the result as one signal. A member who cannot complete a step-up reaches a person.
The agent is built to treat any report of an unrecognized or incorrect charge as a notice of error: it records the time of the member’s first words, collects the facts your dispute team needs, and opens the case in your dispute platform. Which rule applies (Reg E or Reg Z), when written confirmation is requested and what is credited when are your policies, written in code your compliance team reviews. Ambiguous calls go to a person.
Yes, inside the limits your counsel sets. The FCC treats an AI-generated voice as an artificial voice, so calls to wireless numbers need prior express consent unless an exemption such as the one for financial institution fraud alerts applies. We write your limits into the agent as code, covering consent status, call counts per event, content and opt-outs, and a member who says stop is not called again.
No. Numbers can be provisioned through VoiceRun or brought from your own Twilio or Telnyx account, and you keep your carrier contracts and rates. The agent calls the APIs and middleware your team already exposes and can pass context with a transfer to your contact center. We would start with the lowest-risk call types behind your current IVR and add step-up flows and disputes as simulations pass.
Expect questions on subcontractors, data location, change control and testing. The answers sit in the architecture: speech and language providers are named and swappable, agent code and release history live in your repo, every release runs against your simulations first, and every call leaves a transcript, its system actions and an evaluation under one ID. We answer diligence questionnaires directly.
Deployment options are VoiceRun’s managed cloud, your VPC, your cloud, or on-premises with VoiceRun Edge, available under enterprise agreement. Recording, redaction and tracing are per-environment settings, off until you turn them on. Under our enterprise agreements, VoiceRun does not use customer data to train or improve models for itself or anyone else without your express written authorization.
A consultation is a working session on your call mix, your authentication tiers and your dispute path, with the shortest route to a first release your risk team has already read. Bring the questions your examiners ask.
