Jennifer Thornton / Portfolio / Platform Integrity Agent

Platform Integrity
Investigation Agent

An end-to-end AI-powered investigation system built to detect NPO fraud, match harvesting, and donation abuse in the corporate social responsibility space. Designed, built, and deployed as a team of one.

Claude API Agentic AI OSINT Fraud Operations Risk Scoring CSR / Nonprofit Human-in-the-loop

Background

The problem

Built from scratch, as a team of one

When I joined Benevity as their first Senior Fraud Operations Analyst in January 2026, there was no fraud program, no tooling, and no playbook. Benevity operates at the intersection of corporate clients, their employees as donors, and the nonprofits receiving funds — a uniquely complex ecosystem where fraud can hide in plain sight.

Data was fragmented across systems with no active monitoring. I was being asked to determine whether NPOs were legitimate and whether donations were fraudulent. Manually. With no structured process and no dedicated tools.

The solution

An end-to-end investigation agent

I started by learning the CSR fraud landscape: match harvesting, impossible volunteer hours, conflict of interest, shell NPOs. From there I built a risk-based scoring framework from first principles, a multi-stage OSINT prompt using AI web search, a forensic data analysis prompt for transaction patterns, and a set of platform integrity guidelines to make every decision consistent and defensible.

Once I had access to Claude, I unified everything into a single agentic pipeline: structured case intake, CSV pre-processing for anomaly detection, 7-stage OSINT investigation, AI-powered risk scoring, escalation logic, and human analyst sign-off. All in one tool.

7
OSINT stages per investigation
4
Risk tiers with mapped actions
1
Analyst. No prior tooling. Built this.
0→
Fraud program built from the ground up
01 Case intake Structured input triggers the agent pipeline
platform-integrity / investigations / new

New Investigation: Case Intake

Draft
NPO information
Intake form: built for the agent's needs
Every field maps directly to what the OSINT pipeline needs to operate. EIN feeds stage 1 (legal status), website and social links feed stage 4 (digital presence), address feeds stage 2 (governance). No field is decorative — each one is a structured input for a downstream agent prompt.
Case context
Match harvesting Impossible volunteer hours Account takeover Identity fraud Conflict of interest Shell NPO Terms of use violation
Why fraud type tags matter
CSR fraud isn't one-size-fits-all. Match harvesting looks completely different from impossible volunteer hours or a shell NPO. Tagging the suspected type upfront lets the agent weight its analysis toward the right risk indicators, and makes the output more defensible when escalating to leadership.
LowMediumHighUrgent
Data inputs
Drop CSV file or click to upload
Accepts .csv, .xlsx. Max 50MB.
meridian_brightfutures_txns_Q1Q2_2024.csv  ·  312 rows  ·  2.1MB
Transaction analysis
CSV pre-processing: optimised for speed and cost
The agent doesn't pass raw transaction rows to the AI. It pre-processes the CSV first, computing donation velocity, threshold clustering, donor diversity, and timing patterns, then feeds only the derived signals into the forensic analysis. This reduces token usage significantly and speeds up the pipeline while improving accuracy.
$24,180
312
14
4.2×
Anomalies detected
89% of donations are $25, consistent with match harvesting at minimum threshold
11 of 14 donors share corporate email domain (meridian.com)
Donation velocity spike: 140 transactions in a 72-hour window (Apr 3–5)
No recurring donors; all one-time gifts with no follow-on engagement
Self-certified volunteer hours (480 hrs) inconsistent with 14-donor base
Auto-check: Board member "Maria Holden" shares surname with Chair, flagging a potential conflict of interest. Volunteer hours claimed (480 hrs) inconsistent with 14-donor base. Will be flagged in analysis.
Pre-processing before the agent runs
The self-cert auto-check runs before the main agent. It does lightweight pattern matching that catches obvious red flags instantly (name overlaps, implausible numbers), so the OSINT pipeline starts with context already flagged rather than discovering conflicts mid-investigation.
Agent configuration
OSINT stages to run
Full pipeline
Intake→ CSV pre-process→ 7× OSINT→ Risk scoring→ Escalation check→ Report draft→ Analyst sign-off
Configurable by design
Not every case needs all 7 stages. A quick legitimacy check on a new NPO doesn't need transaction analysis. Making stages toggleable means the agent can run faster and cheaper for lower-stakes cases, and be dialled up to full depth when the risk warrants it.
02 OSINT investigation pipeline 7-stage agent running live
platform-integrity / investigations / PI-2024-0847 / osint
Why 7 stages, not one big prompt
Breaking OSINT into 7 discrete, sequential stages was deliberate. Each stage has a focused scope and its own source list, producing more thorough results than a single broad search and making findings auditable. Running stages sequentially is also significantly more token efficient: each prompt is smaller and purpose-built. Later stages can be skipped if earlier ones already produce a clear-cut outcome.

OSINT Investigation Pipeline

PI-2024-0847
  Agent running Stage 4 of 7 · Est. 40s remaining
Pipeline progress4 / 7 stages complete
Agent stages
✓
1 · Legal & regulatory status Critical
IRS Tax Exempt Org Search · Arizona Corporation Commission · ProPublica
IRS 501(c)(3) exemption revoked May 2023. 3 consecutive years of non-filing. Arizona state registration lapsed Q1 2024. Organization is currently operating without valid charitable status.
IRS TEOSAZ Corp CommissionProPublica
Stage 1: the foundation of any NPO check
Legal status is checked first because a revoked 501(c)(3) is an automatic critical flag. It means donations may not be tax-deductible and the corporate client has liability exposure. Finding this early prevents wasted effort on remaining stages if the case is already clear-cut.
✓
2 · Governance & leadership High
GuideStar · LinkedIn · Secretary of State filings
3-member board; 2 share a residential address. Executive director has no verifiable nonprofit history. No audited financials or annual reports publicly filed.
GuideStarLinkedInAZ SOS
✓
3 · Adverse media High
News search · BBB Wise Giving Alliance · Google News
Phoenix New Times (Mar 2024): allegations of grant fund misappropriation. BBB Wise Giving: fails 3 of 20 accountability standards. No criminal proceedings found at this time.
Phoenix New TimesBBB Wise GivingGoogle News
Adverse media: why it's a separate stage
Adverse media can't be inferred from regulatory databases alone. News coverage, watchdog reports, and BBB ratings reveal reputational risk that doesn't show up in official filings. This is especially important when escalating to ELT, where brand exposure is as significant as legal exposure.
4
4 · Digital & web presence Running
Domain WHOIS · Wayback Machine · Social media audit
"Bright Futures Foundation Phoenix" site:linkedin.com OR site:facebook.com OR site:instagram.com
Domain registered 14 months ago. Website sparse with no program photos or impact stories. Social accounts created within 30 days of first donation. Social audit in progress…
WHOISWayback MachineLinkedInFacebook
5
5 · Program & impact verification Pending
Queued · GuideStar, Charity Navigator, Google Maps, program evidence search
6
6 · Financial & funding transparency Pending
Queued · Form 990 lookup, Candid, Open990, funding source analysis
7
7 · Conflict of interest & network analysis Pending
Queued · EIN cross-reference, board member network, platform history lookup
Stage 7: the one that catches the most
Network analysis (cross-referencing EINs, board members, and platform history) was added after noticing that fraudulent NPOs rarely operate alone. Shell organizations and repeat offenders often share board members or addresses. This stage catches coordinated fraud that individual NPO checks would miss entirely.
03 Investigation report Risk score, findings, escalation & analyst sign-off
platform-integrity / investigations / PI-2024-0847 / report

Platform Integrity Investigation Report

PI-2024-0847
Pending analyst review Generated Jun 10, 2026
Risk assessment
Red: High Risk
Score: 78 / 100
Recommended action
Terminate
The risk scoring model
The Green / Yellow / Orange / Red scale maps directly to recommended actions: No action → RFI → Suspend → Terminate. This framework was built from scratch. There was no existing model when the fraud program launched. The goal was to make every decision consistent and defensible, especially when escalating to legal or ELT.
GreenYellowOrangeRed
Legal/governance: critical Adverse media: high Donation pattern: high Self-cert: inconsistent
OSINT findings summary
IRS 501(c)(3) status revoked May 2023. State registration lapsed Q1 2024.
2 of 3 board members share a residential address. No audited financials on record.
Adverse media: fund misappropriation allegations (Phoenix New Times, Mar 2024).
Domain registered 14 months ago. Social accounts created within 30 days of first donation.
No verifiable program delivery. Mission statement mirrors a legitimate local NPO.
Shared board member cross-references with 2 other flagged NPOs; 1 previously suspended on platform.
Escalation
ELT escalation required
Revoked tax-exempt status and active adverse media create regulatory and reputational exposure for Benevity and Meridian Technologies. Shared board member network links this case to a prior platform suspension. Legal and compliance teams should be looped in prior to any client-facing communication.
Escalation logic: built for blast radius
The escalation trigger isn't just risk score. It factors in blast radius (how many corporate clients or donors are affected), brand risk (adverse media that could reach the press) and legal/regulatory exposure. A medium-risk case with a Fortune 500 client and live media coverage escalates faster than a high-risk case with no external visibility.
Analyst review & sign-off
Human review required before action Awaiting sign-off
SR
Assigned analyst
Senior Fraud Operations Analyst
Human-in-the-loop: by design, not as a fallback
The agent cannot take action on its own. Every investigation requires a human analyst to review findings, add notes, and explicitly confirm before any action is taken. This was a deliberate governance decision, not a technical limitation, to ensure accountability and defensibility, especially when terminating a nonprofit's access to the platform.
Back to portfolio