Fraud detection identifies fraudulent transactions, accounts or claims among a much larger volume of legitimate activity.
Why It's Hard
- Rarity: fraud is a tiny share of activity.
- Adversaries: fraudsters change tactics when detected.
- Delayed labels: confirmation that something was fraud may take weeks.
- Costs on both sides: missed fraud loses money; false alarms annoy genuine customers.
Useful Features
- Transaction amount relative to the customer's usual behaviour.
- Velocity: how many transactions in the last minutes or hours.
- New devices, locations or payees.
- Network features: shared devices, addresses or accounts linked to known fraud.
Approaches
- Rules for known patterns and regulatory requirements.
- Supervised models (gradient boosting is common) trained on confirmed fraud.
- Anomaly detection for new, unlabelled patterns.
- Graph analysis for fraud rings.
Most systems combine all of these into a risk score.
Setting Thresholds
Choose thresholds based on expected loss, investigation capacity and customer impact. Use tiers: approve, step-up verification, review, block.
Evaluation
Split data by time, use precision and recall at operating thresholds, and estimate money saved versus friction created.
Keeping Up
Retrain regularly, monitor for drift, feed investigator decisions back as labels, and watch for new attack patterns that the model hasn't seen.