did you know your bank spots fraud in milliseconds?
every payment is scored against your own history — where, when, how much, how often — before it’s approved.
the idea
between the card reader beeping and the payment approving, a model scores how normal the transaction looks for you. suspicious enough, and it’s blocked before you’ve pocketed the card.
how it works
each payment is converted into features: amount, merchant type, location, time, how it compares to your history, what the device looks like.
go deeper
your spending has a fingerprint
you buy coffee in the same neighbourhoods, fill up at similar stations, and rarely spend £900 on electronics at 3am.
fraud detection is mostly a model of you. transactions that break your pattern get a high suspicion score; transactions that fit sail through.
signals become a score
each payment is converted into features: amount, merchant type, location, time, how it compares to your history, what the device looks like.
a classifier — trained on millions of past transactions labelled fraud or genuine — turns those features into a probability. above a threshold, the payment is challenged or declined.
risk = P(fraud | amount, place, time, device, history…)
a simplified sketch. real systems layer many models and rules.
a very lopsided problem
fraud is rare — often well under 1% of transactions — so a model that says “genuine” every time is over 99% accurate and completely useless.
success is measured differently: of the fraud that happened, how much did we catch (recall), and of the payments we blocked, how many were actually fraud (precision).
moving the decision threshold trades one against the other, and the cost of a wrong answer is wildly asymmetric.
precision = TP ÷ (TP + FP) recall = TP ÷ (TP + FN)
things to wonder about next
- criminals adapt, so models are retrained constantly — an arms race measured in weeks.
- a false positive is your card declined at dinner; a false negative is someone else’s holiday on your account.
- the same score-every-event pattern guards logins, insurance claims and tax returns.
sources & further reading
concepts: classification · anomaly detection · features
5 minute read