Bank Chatbots: Where Automation Must Stop

Three tiers, and only one is a chatbot problem

Bank conversations divide cleanly into three tiers, and confusing them is the source of nearly every failed implementation. The public tier needs no identity: rates, fees, branch hours, product conditions, how to apply for something. The authenticated tier needs verified identity: balances, transactions, card actions, statements. The regulated tier needs a licensed person: advice on what a customer should do with their money.

An unauthenticated chat widget can serve the first tier completely, cannot serve the second at all without a verified session, and must never serve the third. That sounds restrictive until you count the volume: in most retail banks the public tier is the majority of inbound questions and almost all of the out-of-hours ones.

The practical implication is to build for the public tier first and measure the result honestly. A bank chatbot that answers fee and branch questions correctly at eleven at night, and hands everything else to the right place, is a successful project — and it is achievable without touching a core banking system.

The public tier: safe to automate

• Product conditions: account types, card types, what each includes, eligibility criteria as published.
• Fees and charges, quoted from the published tariff rather than summarised. A paraphrased fee is a misquoted fee.
• Published rates, with the date they apply from and the caveat that they change.
• Branch and ATM locations, opening hours, holiday schedules and which branches offer which services.
• Documents required for an application, and the process steps in order.
• How to do something in the app or online banking — navigation help rather than account access.
• Card blocking procedure and the official number to call, which should be answerable instantly at any hour.
• Complaint procedure and the official channels, including the regulator where that is published.

The identity problem

This is the constraint that defines the whole design, and it is routinely underestimated. A phone number, a name, a date of birth and a card's last four digits are not identity verification — they are the exact information a fraudster collects first.

• Never disclose whether a person is a customer. 'I cannot find that account' confirms the account does not exist, which is information.
• Never disclose balances, transactions, limits or product holdings in an unauthenticated channel, regardless of how confident the match seems.
• Do not ask for full card numbers, PINs, passwords, one-time codes or document scans in chat. A bank that asks for these teaches customers to give them to whoever asks next.
• Treat a request to 'confirm my identity so you can check' as a prompt to move channel, not as a workflow to build.
• Where an authenticated session exists — inside the app, after a login — the second tier opens up, and that is the correct place for it.
• Assume any read is repeatable by someone hostile. If a reply reveals whether a phone number belongs to a customer, it is an enumeration tool.

The regulated tier: never automated

• Advice on which product a customer should choose for their situation. Listing products is information; recommending one is advice.
• Anything about creditworthiness, whether an application will be approved, or why one was declined.
• Investment, pension and insurance suitability, which is licensed activity in essentially every market.
• Debt, hardship and restructuring conversations, which require judgement and carry consumer-protection obligations.
• Tax treatment of any product or transaction.
• Statements about what a customer is legally obliged to do, or what the bank is obliged to do for them.

The line is simpler than it looks. If a sentence begins 'you should', it is advice. If it begins 'the published condition is', it is information. Writing that distinction into the material is more reliable than hoping a model observes it.

The fraud path deserves its own design

Fraud and card-loss conversations are the one category where speed matters more than anything else, and where a chatbot can add real value without touching an account.

• Make it reachable in one message, at any hour, without qualification questions. Somebody who has just been defrauded should not be asked which product they hold.
• State the official blocking number immediately and prominently, and make the bot able to say it from the first message.
• Provide the exact next steps in order, quoted from the bank's published procedure.
• Route to a person or the dedicated line with a flag, not into a general queue.
• Never ask for card details as part of this flow. A fraud conversation that requests a card number is indistinguishable from the fraud.
• Have this path written in every language the bank serves, because a customer in distress reverts to their first language.

What to measure

1. 1Public-tier containment with a quality checkQuestions answered completely without a person, sampled for accuracy. Containment alone rewards a bot that frustrates people into leaving.
2. 2Call deflection by categoryWhich call types fell after launch. Fees, branch hours and card blocking usually move first, and the breakdown tells you where to extend the material.
3. 3Out-of-hours volume and resolutionBanks are closed for most of the week. This is where the public tier earns its place, and it should be measured separately.
4. 4Escalation accuracyWhether authenticated and regulated questions reached the right place. A misrouted regulated question is a compliance event, not a service failure.
5. 5Identity-probe rateAttempts to extract account information from an unauthenticated channel. This should be monitored deliberately rather than discovered.

How Vexvon fits a regulated environment

The design points that matter here are the ones that constrain rather than extend. Each company's knowledge is isolated by partition key in the vector store, so retrieval cannot reach another organisation's material. Knowledge entries are typed into thirteen categories and can be activated or deactivated individually, which is how the published tariff can be replaced the day it changes without republishing anything else.

Answers are tied to retrieved material rather than improvised: six results by default, with a defined fallback when no context is found. Answer transparency records which entries produced a given reply — in a regulated environment this is the difference between a documented answer and an unexplainable one, and it is what makes an internal review possible.

Prompt versions are tracked with one active at a time and a path back to the previous one, so a change to the bot's behaviour is a recorded and reversible event rather than an edit nobody can reconstruct. AI usage is logged across seventeen distinct purposes with model, channel, latency and cost.

The escalation paths are explicit and logged: a request for an operator raises a notification, abusive language acts as a stop condition, an agent's stop character pauses the AI on a conversation for thirty minutes, and the AI can be switched off for a conversation entirely. The storage location, retention periods, subprocessors and vendor-side access logging that a bank's procurement will ask about should be requested in writing during procurement, as they should be from any vendor.

Frequently asked questions

1. 1What can a bank chatbot safely automate?The public tier: product conditions, published fees and rates, branch and ATM information, application documents, navigation help, the card-blocking procedure and the complaints process. In most retail banks this is the majority of inbound questions.
2. 2Can it show a balance or transactions?Not in an unauthenticated channel, regardless of how confident the match seems. Inside an authenticated session — in the app, after login — that tier opens up, and that is the correct place for it.
3. 3What must never be automated?Advice on which product to choose, creditworthiness and application outcomes, investment, pension and insurance suitability, debt and hardship conversations, and tax treatment.
4. 4What identity information should the bot never request?Full card numbers, PINs, passwords, one-time codes and document scans. A bank that asks for these in chat teaches customers to give them to whoever asks next.
5. 5How should a fraud or lost-card conversation work?Reachable in one message at any hour with no qualifying questions, the official blocking number stated immediately, the published next steps in order, and a flagged route to the dedicated line.
6. 6How do you tell information from advice?If a sentence begins 'you should', it is advice. If it begins 'the published condition is', it is information. Writing that distinction into the material is more reliable than hoping a model observes it.

Start by sorting a week of calls

Take a week of contact-centre calls and sort each into the three tiers. Most banks find the public tier is larger than expected and dominates the out-of-hours window entirely. That single classification defines the scope of the project, its compliance surface and its business case at the same time.