Ledgerline, a payments processor handling 2.1 million monthly transactions, was losing good customers to a fraud queue that took four hours to clear. After a six-week evaluation, they replaced their rules engine and a prompted-LLM pilot with Airmino — cutting median review time to 90 seconds, reducing false positives by 62%, and recovering$1.4M in annual revenue that had been leaking to over-blocking.
“We weren't choosing a model. We were choosing whether our analysts would still have a job in two years — and whether our good customers would still be here.”
Dana Whitfield · VP Risk Operations, Ledgerline
A queue that grew faster than the team
Ledgerline's risk team had 14 analysts working a queue of roughly 9,000 flagged transactions per day. Each review took a median of four hours end-to-end, and the backlog meant most cases were resolved long after the customer had already abandoned the purchase.
The cost wasn't just operational. Roughly one in five holds turned out to be a legitimate customer — and Ledgerline's own data showed that a customer who experiences a fraud hold is 3.4× more likely to churn within 90 days.
Four options, three criteria that mattered
The team spent six weeks evaluating four approaches. They were explicit about what would make them walk away:
- p99 latency under 200ms. Anything slower couldn't sit inline in the authorization path — it would have to stay async, which defeats the purpose.
- No hallucinated output formats. The downstream system parses a strict schema. A single malformed response at 3am pages an on-call engineer.
- Adding a new decline reason without retraining. Their fraud taxonomy changed roughly every six weeks. A model that needed a training cycle for each change was a non-starter.
A prompted LLM passed the flexibility test but failed on latency (p99 ~6.4s) and output reliability (71% parseable in their harness). Expanding the rules engine passed latency but failed the adaptability test — the rule tree was already 4,000 branches deep. A fine-tuned classifier passed latency and reliability but required a retraining cycle for every taxonomy change.
Airmino was the only option that cleared all three criteria in the pilot.
Ninety seconds, and a queue that clears itself
Ledgerline deployed Airmino inside their own VPC, inline in the authorization path. Low-confidence decisions still escalate to a human — but that's now roughly 8% of volume instead of 100%.
The team also stopped shipping rule changes through engineering. Risk analysts now modify the options array directly through a config surface — the fraud taxonomy has changed five times since launch with no model retraining and no deployment.
| Metric | Before | After |
|---|---|---|
| Median resolution time | 4h 12m | 1m 30s |
| False positive rate | 19.4% | 7.4% |
| Cost per decision | $0.86 | $0.04 |
| Taxonomy change cycle | 6 weeks | Same day |
| Analyst headcount on queue | 14 | 4 |
| p99 decision latency | 6,400ms | 140ms |
The 10 analysts who moved off the queue were redeployed to complex case investigation — work that had been perpetually deprioritized. Ledgerline reports that the team now closes roughly 3× more high-value investigationsper quarter than before the migration.
See how this works for fraud triage
Bring a sample of your own flagged transactions and define your option set. You'll get a calibration report before you talk to anyone.