A multi-modal assistant with bot defence for a fintech support chat

A support assistant for a fintech platform where text and voice share one session, so a user can type a query, say an address out loud, then type a PIN without the conversation losing its place or asking them to authenticate again. The bot defence sits underneath rather than in front: instead of a CAPTCHA everybody meets, the system watches interaction velocity, input patterns and device fingerprints, and raises a challenge only when a session starts behaving like a script inside a high-risk flow — a password reset, a change of email, a transfer.

A financial services platform

99%

Bot Defence Accuracy

Automated abuse caught at the funnel, with no extra step for real users

60%

Voice Latency Improvement

Voice replies return around 60% faster than the setup it replaced

87%

Onboarding Completion

Share of users who finish onboarding with the assistant in place

The client

A financial services platform

Industry
FinTech & financial services
Size
Mid-market

Challenge

Every way of stopping the bots was also stopping real customers

A fintech platform experienced a 400% surge in account takeover attempts via their support chat, while mobile user engagement simultaneously dropped 20% due to cumbersome text-only interfaces. Static CAPTCHAs frustrated 15% of legitimate users and were easily bypassed by advanced headless browsers — creating a security-UX deadlock where tightening protection actively drove away real customers.

In fintech, every friction point in the support flow directly impacts conversion and compliance. The client needed a system that let a user move between voice and text mid-flow during sensitive operations (password resets, fund transfers) while ensuring 100% of high-risk actions were protected by non-intrusive bot defence — targeting 80% automation of routine verification tasks.

Solution

One session that keeps its place when you switch from typing to talking

We implemented a 'Unified Context' architecture where conversation state is shared between a WebSocket-based voice stream and a React-based text UI. Users can start a query via text, provide an address via voice, and enter a PIN via text — all within a single continuous session without losing context or requiring re-authentication.

Security was integrated at the network edge, not bolted on as an afterthought. A behavioural analysis layer monitors interaction velocity, input patterns, and device fingerprints in real time. When bot-like behaviour is detected during a high-risk flow, the system dynamically triggers step-up verification — challenging only suspicious sessions instead of blocking all users with a login wall.

Calls we would still defend

  • Edge-Inference Routing — Deployed LLM inference at regional edge nodes to achieve 0.4s text latency, minimising round-trip time for mobile users across 12 geographic regions.

  • Just-In-Time Verification — Implemented 'Step-Up Authentication' that only challenges users entering high-risk intent zones (fund transfers, password changes), maintaining an 87% session completion rate versus 72% with traditional global CAPTCHAs.

  • Biometric Voice Analysis — Integrated spectral analysis in the voice pipeline to distinguish between synthesised deepfake voices and genuine human speech — adding a security layer invisible to legitimate users.

Results

Only the suspicious sessions ever meet a challenge

Before

Rigid text-only bot with static CAPTCHAs. 15% legitimate user frustration rate. Easily bypassed by advanced headless browsers. No voice support. 72% session completion.

After

Fluid multimodal experience with invisible behavioural security. 99.2% bot block rate. Voice and text in one session, switchable mid-flow. 87% session completion. User trust scores up 42%.

99%

Bot Defence Accuracy

Automated abuse caught at the funnel, with no extra step for real users

60%

Voice Latency Improvement

Voice replies return around 60% faster than the setup it replaced

87%

Onboarding Completion

Share of users who finish onboarding with the assistant in place

FAQ

The questions this one raises

What was actually built, the constraints it had to meet, and what we would do differently.

  • The system uses Intent-Based Security. It monitors for high-risk actions (withdrawals, email changes, password resets) and combines this with behavioural telemetry — mouse movement patterns, typing cadence, and session timing. CAPTCHAs are triggered only when risk signals converge, so legitimate users rarely see them while bots are caught 99.2% of the time.

  • Yes. The Unified Context architecture maintains a single session state across both modalities. A user can dictate a shipping address via voice to avoid typing, then switch to text to enter sensitive details like a PIN or reference code — all within the same conversation thread with full context preserved.

  • It screens for them. An anti-spoofing layer reads the acoustic features of incoming audio — spectral patterns, pitch consistency, the micro-pauses a real speaker leaves — and flags the anomalies that tend to come with synthesised speech. Nobody should describe this as solved, ours included: detection and generation improve against each other, so the layer is one signal feeding the same risk score as the behavioural telemetry rather than a gate that decides on its own.

  • Text responses average 0.4 seconds end-to-end, achieved through edge-deployed LLM inference across 12 regional nodes. Voice responses average 0.9 seconds including STT processing, LLM generation, and TTS synthesis — a 60% improvement over the client's previous system.

  • The architecture uses auto-scaling inference pods with request queuing and priority routing. High-risk sessions (active transactions) receive dedicated compute resources, while routine queries use shared pools. During load testing, the system maintained sub-second responses at 5x normal traffic volume.

Keep reading

Other builds, taken apart the same way

Want to talk about yours?