1. Introduction
Financial institutions face fraud typologies including account takeover (ATO), card and QRIS abuse, mule-assisted transfers, and merchant compromise. Unlike anti–money-laundering (AML) analysis—which focuses on the provenance of funds—fraud detection asks whether a specific activity is illegitimate theft or misuse and what immediate control action should follow. Research systems must therefore optimize both ranking quality (placing true fraud near the top of a review queue) and decision utility (balancing false alarms against missed fraud).
This paper documents the methodology implemented in the Nexius Fraud Detection module: a supervised pipeline from master-data feature construction through model training, evaluation, and serving. The contribution is not a novel architecture per se, but a transparent, bank-oriented research protocol that makes experimental choices explicit—especially under severe class imbalance and temporal dependence.
2. Problem Formulation
Let each transaction t be represented by a feature vector xt constructed from transactional, account, customer, device, and graph-related signals. We estimate a score st = P(fraud | xt) ∈ [0, 1]. A policy function π(st) maps scores to actions in {APPROVE, CHALLENGE, HOLD, BLOCK}. Research evaluation emphasizes ranking metrics on a temporally held-out set; operational evaluation additionally reports confusion-based metrics at the HOLD threshold.
3. Data and Feature Engineering
3.1 Data sources
Features are engineered from relational master tables (transactions, accounts, customers, logins, devices, beneficiaries, blacklist / watchlist, fraud labels, and disputes). The design assumes an institution can materialize analogous warehouse extracts.
3.2 Feature groups
Amount & ratios: nominal amount, log-amount, ratios versus balance, income, and historical means. Temporal context: hour-of-day, day-of-week, night and weekend indicators. Channel / product: transfer, QRIS, and channel encodings. Velocity: same-day counts and amounts; historical means per account. Beneficiary risk: destination age, novelty, and absence from beneficiary lists. ATO signals: failed logins (24h), sensitive profile changes, OTP failures, rooted devices. List & KYC overlays: blacklist / watchlist hits; PEP and customer risk level.
3.3 Label construction
Positive labels are the union of curated fraud labels and disputes. Remaining transactions are treated as negatives. When positives are scarce (<30 in seed corpora), weak labels based on high-precision rules (e.g., blacklist / coarse ATO patterns) may be mixed in to stabilize training—documented as a research compromise, not a substitute for investigator-confirmed labels in production studies.
4. Learning Algorithm
We train a binary classifier with LightGBM when available, otherwise HistGradientBoosting (scikit-learn). Class imbalance is addressed via class_weight=balanced (or equivalent sample weighting). Tree ensembles remain competitive for tabular banking features, train quickly for iterative research, and admit permutation-importance analysis for feature attribution. The currently deployed artifact in this environment reports model type HistGradientBoostingClassifier.
5. Experimental Protocol
5.1 Temporal split
When timestamps are reliable, we use chronological 80/20 holdout so that test transactions occur after training transactions—reducing leakage from future information. If timestamps are unsuitable, we fall back to stratified random holdout and report the split type explicitly (active run: time, n_train=800, n_test=200).
5.2 Metrics
Under rarity of fraud, accuracy is a poor research summary statistic. We prioritize PR-AUC (sensitivity to precision at useful recall operating regions) and ROC-AUC (global ranking). At a selected HOLD threshold—optimized toward F1 with a precision preference—we report Precision, Recall, and F1 for the fraud class, plus confusion matrices for operational communication. Latest holdout snapshot in this deployment: PR-AUC=0.176, ROC-AUC=0.498.
5.3 Decision policy
Continuous scores are not exposed raw to customers. Cutoffs define APPROVE (low score), CHALLENGE (step-up authentication), HOLD (manual review), and BLOCK (hard decline). Separating scoring from policy enables research on model quality independently from business risk appetite.
5.4 Interpretability overlays
Permutation importance summarizes which engineered signals most affect predictions on holdout data. Rule-based reason codes (e.g., blacklisted destination, night spike, ATO indicators) accompany high scores so analysts receive actionable narratives rather than opaque probabilities alone.
6. Research Use Cases
Benchmarking imbalance-aware metrics: compare PR-AUC vs ROC-AUC when fraud prevalence changes across cohorts. Ablation of feature families: remove ATO, velocity, or beneficiary groups to quantify lift for investigation hypotheses. Policy stress tests: sweep decision cutoffs to map precision–recall operating curves to staffing capacity for HOLD queues. Weak-label sensitivity: measure degradation when confirmed labels are replaced by rule-based proxies. Temporal robustness: retrain on rolling windows to study concept drift in channel mix and attack tactics.
7. Deployment Notes
Trained artifacts persist as model bundles with metrics metadata. Batch scoring materializes scored transactions for dashboard monitoring; online serving exposes score APIs for case management. Dashboards should present full-population aggregates computed server-side, while detail tables remain paginated. Human-in-the-loop review remains mandatory for HOLD/BLOCK in regulated environments.
8. Limitations
Results on synthetic master data are not external validity claims for any bank. Label noise, delayed dispute resolution, and adversarial adaptation can inflate research metrics. Graph and device signals may be incomplete. The methodology deliberately excludes accuracy as a headline KPI because it is misleading under imbalance.
9. Conclusion
We formalized a transaction-level fraud research pipeline aligned with banking operations: engineered tabular features, imbalance-aware boosting, chronological evaluation, PR-centric metrics, and an explicit decision-policy layer with reason codes. The protocol supports reproducible experimentation and incremental productionization within an enterprise AI risk platform.
References
- Davis, J., & Goadrich, M. (2006). The relationship between Precision-Recall and ROC curves. ICML. Ke, G., et al. (2017). LightGBM: A highly efficient gradient boosting decision tree. NeurIPS.
- Dal Pozzolo, A., et al. (2015). Calibrating probability with undersampling for unbalanced classification. IEEE SSCI. Whitrow, C., et al. (2009). Transaction aggregation as a strategy for credit card fraud detection. Data Mining and Knowledge Discovery.