Fraud Detection Fundamentals

Fraud detection is a real-time decision under uncertainty: in roughly 100 milliseconds, decide whether to approve, challenge or decline a transaction. This lesson covers the fraud types, the system around the model, and how to choose the decision thresholds.

Common fraud types

• Card-not-present (CNP) fraud: stolen card details used online.
• Account takeover (ATO): a fraudster logs in as the customer (phishing, SIM swap, credential stuffing) and moves money.
• Authorised push-payment (APP) / social-engineering scams: the real customer is tricked into paying, as in UPI "collect request" scams or fake KYC calls.
• First-party fraud: the customer themselves borrows or spends with no intention of repaying.
• Synthetic identity: a fake identity built from real and invented details.
• Merchant fraud and collusion: fake merchants or transaction laundering.

The fraud system, not just the model

Transaction → Feature service (real-time aggregates) → Rules engine + ML score → Decision policy
          → approve | step-up (OTP / 3-D Secure) | decline | queue for review
          → Case management (analysts) → Labels (confirmed fraud, chargebacks) → Retraining

• Rules catch known patterns quickly and give explainable hard stops ("card used in two countries within 10 minutes").
• The ML score catches complex, subtle patterns.
• The decision policy combines the score, the amount, customer value and risk appetite.
• Analysts review the grey zone and produce the labels that improve the model.

Thresholds are a business decision

For each threshold you get a precision (how many alerts are real fraud) and a recall (how much fraud you catch). Pick the threshold by expected cost:

• Cost of a false negative = the fraud amount lost, plus operational cost.
• Cost of a false positive = review cost, plus customer friction or churn.

A common pattern is tiered actions:

Metrics that matter

• Fraud detection rate (recall by count, and by value).
• False positive ratio: false alerts per true fraud (e.g. 5:1).
• Fraud basis points: fraud loss per ₹10,000 of transaction value.
• Customer impact: the share of genuine transactions declined or challenged.
• Alert-queue capacity: analysts can only review so many cases a day, so the threshold must respect it.

A minimal model in Python

import pandas as pd
from sklearn.metrics import average_precision_score, precision_recall_curve
from lightgbm import LGBMClassifier

df = pd.read_parquet("transactions.parquet").sort_values("ts")
cut = df.ts.quantile(0.8)                          # out-of-time split
tr, te = df[df.ts < cut], df[df.ts >= cut]
feats = ["amount_log", "txn_count_1h", "amt_vs_user_avg", "new_device", "merchant_risk", "hour", "geo_km_from_home"]
m = LGBMClassifier(n_estimators=600, learning_rate=0.03, num_leaves=63, scale_pos_weight=50)
m.fit(tr[feats], tr.is_fraud)
p = m.predict_proba(te[feats])[:, 1]
print("PR-AUC", average_precision_score(te.is_fraud, p))
prec, rec, thr = precision_recall_curve(te.is_fraud, p)

Check yourself