Machine Learning in Fraud Detection

Traditional fraud detection relied on fixed rules, such as flagging any transaction above a set amount, but criminals learn the rules and stay just below them. Machine learning changes the approach by learning what normal looks like for each customer and flagging behaviour that deviates from it. A model might learn that a customer usually shops in one city, uses one device, and spends within a certain range, and then score a transaction higher if it comes from a new country, a new device, and an unusual amount all at once. The score is calculated in milliseconds while the payment is being processed, so a high risk payment can be challenged with extra authentication or held for review before the money moves. Supervised models are trained on labelled data, where past transactions are marked as fraud or genuine, and the model learns which features predict fraud. Unsupervised models look for anomalies without labels, which is useful for new fraud patterns that have never been seen before. Network analysis adds another layer, by looking at the relationships between accounts, so that a group of accounts passing money between each other can be identified as a ring even if each individual transaction looks normal. The best systems combine rules, models and network analysis, because each approach catches things the others miss. A BA should understand that no single model is the answer, and that the combination is what produces results. Machine learning brings its own risks that a BA must plan for. Models can drift as customer behaviour changes, so they need regular retraining and performance monitoring. They can also produce biased outcomes if the training data is biased, for example by flagging certain customer groups more often than others. Explainability matters too, because when a customer's payment is blocked, the bank must be able to explain why, and a regulator may ask how a model reached its decision. Requirements should therefore cover model governance, performance metrics such as precision and recall, the process for challenging a model decision, and the fallback when a model is unavailable. A fraud model that cannot be explained or monitored is a liability, however accurate it looks in testing. A fraud detection model uses features, and the features are the inputs that predict fraud. The most predictive features are the amount, the beneficiary, the time of day, the device, the location, and the customer's history. A payment of 25,000 pounds to a new beneficiary, at 3am, from a new device, in a country the customer has never sent money to, is a high-risk payment. A payment of 50 pounds to a beneficiary the customer pays every month, at 10am, from their usual phone, is a low-risk payment. The model combines the features into a score, and the score decides whether the payment is allowed, held, or blocked. The features must be chosen carefully, because a feature that is correlated with a protected characteristic, such as nationality, will produce a discriminatory model. The false positive trade-off is the central tension in fraud modelling. A model that blocks 1 percent of legitimate payments will anger 1 percent of customers, and a model that lets 1 percent of fraud through will lose money. The trade-off is set by the threshold: a low threshold blocks more payments, including more legitimate ones, and a high threshold blocks fewer, including fewer frauds. The threshold must be set by the business, not by the data scientists, because it is a business decision about how much customer friction is acceptable to prevent how much fraud. The threshold must be reviewed regularly, because the fraud patterns change, and the customer tolerance changes. Model governance is the control that makes a fraud model safe to use. The model must be documented, with the features, the training data, the performance metrics, and the limitations. It must be validated by a team that did not build it, using data the model has not seen. It must be monitored in production, with the accuracy, the false positive rate, and the drift measured daily. And it must be explainable, because the fraud analyst must be able to say why a payment was blocked, and the customer must be given a reason. A model that cannot be explained cannot be used, however accurate it is.