Anomaly and Fraud Detection

Anomaly detection finds observations that do not fit the pattern of the rest: a failing bearing in a turbine, an intrusion in network logs, a spike in cloud spend, a stolen card being used. Fraud detection is its most commercially important use, and the hardest, because the "anomalies" are people who adapt to whatever you deploy. This lesson covers the unsupervised toolbox (statistics, isolation forests, one-class SVMs, autoencoders), the supervised reality of fraud (extreme imbalance and cost-sensitive thresholds), and the operational parts that decide whether a system works: graphs, drift, adversaries and human review.

Intuition: the odd one out in a crowd

Picture a stadium crowd seen from above. Most people sit in dense clusters. Someone standing alone in an empty aisle is easy to spot, because few people are near them. A pickpocket moving through the crowd is harder: locally they look like everyone else, and they only stand out by their path over time or by who they keep bumping into. These are the three ideas behind most detectors: density (how many neighbours do you have?), context (is this normal here and now?) and relationships (who are you connected to?).

Types of anomalies

A second distinction matters for method choice. Outlier detection looks for anomalies inside contaminated training data. Novelty detection trains on clean, normal data and asks whether new points differ from it.

Statistical methods: z-score and IQR

For a roughly Gaussian feature with mean $\mu$ and standard deviation $\sigma$, the z-score is $z = (x - \mu)/\sigma$, and $|z| > 3$ is a common flag (about 0.27% of a true normal distribution lies outside $\pm 3\sigma$). The weakness is that outliers inflate $\sigma$ and hide themselves. The robust z-score replaces mean and standard deviation with the median and the median absolute deviation $\text{MAD} = \text{median}(|x_i - \text{median}(x)|)$:

where the constant 0.6745 makes the scale comparable to $\sigma$ for normal data; $|z_{\text{robust}}| > 3.5$ is a standard cut-off.

The interquartile range rule (Tukey's fences) uses the first and third quartiles $Q_1, Q_3$ and $\text{IQR} = Q_3 - Q_1$, flagging points outside $[Q_1 - 1.5\,\text{IQR},\; Q_3 + 1.5\,\text{IQR}]$.

Worked example. Daily logins: $12, 14, 15, 15, 16, 17, 18, 60$. The quartiles (using the median-of-halves method) are$Q_1 = 14.5$ and $Q_3 = 17.5$, so $\text{IQR} = 3$ and the fences are $14.5 - 4.5 = 10$ and $17.5 + 4.5 = 22$. The value 60 is flagged. Now the plain z-score: the mean is $167/8 = 20.875$ and the population standard deviation is about $14.9$, so $z(60) \approx 2.63$, which is below 3. The outlier inflated the standard deviation enough to hide itself. That is why robust statistics are the default.

These methods are univariate. They miss a transaction whose amount and location are each normal but whose combination is not. Multivariate statistics (Mahalanobis distance under a fitted covariance) handle linear correlations; the methods below handle more.

Isolation forest

Liu, Ting and Zhou (2008) turned the density idea upside down: rather than modelling normal data, isolate points. Build many random trees; each node picks a random feature and a random split value between that feature's min and max. Anomalies are few and different, so they get separated from everyone else in very few splits, while points inside dense clusters need many. The anomaly score for a point $x$ with average path length $E[h(x)]$ over trees, each built on a subsample of $n$ points, is

where $H(i) \approx \ln i + 0.5772$ is the harmonic number and $c(n)$ is the average path length of an unsuccessful search in a binary search tree, used to normalise. Scores near 1 indicate anomalies; scores well below 0.5 indicate normal points. Isolation forests are fast (linear time, small subsamples such as 256), need no distance metric, and work well on tabular data with tens of features. They struggle when anomalies are only visible in feature interactions that axis-aligned random splits rarely cut, and with many irrelevant features.

One-class SVM

The one-class SVM (Schölkopf et al., 2001) maps data through a kernel, typically the RBF kernel, and finds a boundary that encloses most of the training data with maximum margin from the origin in feature space. The hyperparameter $\nu \in (0, 1]$ is an upper bound on the fraction of training points treated as outliers and a lower bound on the fraction of support vectors. It is suited to novelty detection on clean, moderate-sized data with good feature scaling; it scales roughly quadratically or worse with sample size and is sensitive to the kernel width $\gamma$.

Autoencoders and reconstruction error

An autoencoder is a neural network trained to reproduce its input through a narrow bottleneck: an encoder $f_\theta$ compresses $x$ to a code $z$ and a decoder $g_\phi$ reconstructs $\hat{x} = g_\phi(f_\theta(x))$. Trained only (or mostly) on normal data with loss $\lVert x - \hat{x} \rVert^2$, it learns to reconstruct normal patterns well and unusual ones poorly. The reconstruction error becomes the anomaly score, thresholded at, say, the 99.5th percentile of errors on validation data. Autoencoders shine on high-dimensional or structured data: sensor windows, images of manufactured parts, log sequences (with recurrent or Transformer encoders). Failure modes: an overly powerful autoencoder learns to reconstruct anomalies too, and contamination in training data teaches it fraud as "normal".

Comparing the detectors in code

import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.metrics import average_precision_score, roc_auc_score

rng = np.random.default_rng(42)
normal = rng.normal(0, 1, size=(5000, 4))
anomalies = rng.uniform(-6, 6, size=(25, 4))          # 0.5% contamination
X = np.vstack([normal, anomalies])
y = np.r_[np.zeros(len(normal)), np.ones(len(anomalies))]

med = np.median(X, axis=0)
mad = np.median(np.abs(X - med), axis=0)
z_score = np.abs(0.6745 * (X - med) / mad).max(axis=1)   # worst feature per row

iso = IsolationForest(n_estimators=200, random_state=0).fit(X)
iso_score = -iso.score_samples(X)                      # higher = more anomalous

for name, s in [("robust z", z_score), ("isolation forest", iso_score)]:
    print(f"{name:17s} ROC-AUC={roc_auc_score(y, s):.3f}  "
          f"PR-AUC={average_precision_score(y, s):.3f}")

Both detectors reach ROC-AUC near 0.99 here, but PR-AUC (average precision) separates them: about 0.95 for the robust z-score and 0.85 for the isolation forest. With such extreme anomalies, simple statistics are competitive, which is a useful reminder to always run the simple baseline. Notice also how different ROC-AUC and PR-AUC look at 0.5% prevalence; the next section explains why.

Fraud: extreme class imbalance

In fraud you usually do have labels (chargebacks, confirmed cases), so supervised models such as gradient-boosted trees on engineered features are the workhorse, often combined with unsupervised scores as extra features. The difficulty is imbalance. The widely used public credit-card dataset from the Université Libre de Bruxelles machine learning group contains 284,807 transactions of which 492 are fraud, about 0.17%. At that prevalence:

• Accuracy is useless. Predicting "legitimate" for everything scores 99.83%.
• ROC-AUC flatters. The false-positive rate divides by hundreds of thousands of negatives, so thousands of false alarms look like a tiny rate.
• Precision–recall is what operations feel. Precision is the fraction of alerts that are fraud; recall is the fraction of fraud caught. The PR curve and its area (average precision) are the right summary (Saito and Rehmsmeier, 2015, make this case in detail).

Handling imbalance: use class weights or a focal loss; resample with care (undersampling the majority class is common and cheap, but it distorts predicted probabilities, so recalibrate afterwards); and, above all, choose the decision threshold from costs, not from 0.5.

Worked example: picking a threshold with a cost matrix

A card issuer processes 100,000 transactions a day, of which 200 are fraud (0.2%). Assume:

Three candidate thresholds from the model's validation PR curve:

Doing nothing costs $200 \times 250 = 50{,}000$. The medium threshold minimises cost even though its precision is only 10%. Chasing 90% recall more than doubles cost because of the alert volume.

The decision rule behind this: if the model outputs a calibrated fraud probability $p$, flagging costs $C_{\text{alert}}$ and not flagging has expected cost $p \cdot C_{\text{FN}}$. Flag when

So the right threshold is 4%, not 50%. In reality $C_{\text{FN}}$ varies per transaction (it is roughly the amount at risk), so the threshold should too: flag when $p \cdot \text{amount} > C_{\text{alert}}$. Capacity is the other constraint: if analysts can review only 1,000 alerts a day, rank by expected loss $p \cdot \text{amount}$ and take the top 1,000.

import numpy as np
from sklearn.datasets import make_classification
from sklearn.linear_model import LogisticRegression
from sklearn.model_selection import train_test_split

X, y = make_classification(n_samples=200_000, n_features=20, n_informative=6,
                           weights=[0.998], flip_y=0, random_state=0)
X_tr, X_te, y_tr, y_te = train_test_split(X, y, test_size=0.5, stratify=y, random_state=0)
p = LogisticRegression(max_iter=1000).fit(X_tr, y_tr).predict_proba(X_te)[:, 1]

C_FN, C_ALERT = 250.0, 10.0
def total_cost(thr):
    flag = p >= thr
    missed = np.sum(~flag & (y_te == 1))
    return missed * C_FN + flag.sum() * C_ALERT

grid = np.linspace(0.001, 0.5, 500)
best = grid[np.argmin([total_cost(t) for t in grid])]
print("do nothing:", y_te.sum() * C_FN)
print(f"best threshold {best:.3f}: cost {total_cost(best):,.0f}")
print(f"theory threshold 0.040: cost {total_cost(C_ALERT / C_FN):,.0f}")

On this synthetic data, the do-nothing cost is $50,000. The empirically best threshold (about 0.05) costs about $30,700, and the theoretical 0.04 costs about $31,400. They are close because logistic regression is reasonably calibrated. In practice, pick the threshold on a validation set and confirm it on a later, held-out time period.

Graph-based fraud detection

Fraudsters reuse resources: devices, IP addresses, shipping addresses, phone numbers, merchant accounts. Model the data as a graph, with accounts, cards, devices and addresses as nodes and edges for "used", "paid" or "shares". Patterns invisible row by row become obvious:

• Rings: dozens of new accounts sharing two devices and one address.
• Mule chains: money moving through a path of accounts in quick succession.
• Bipartite cores: a set of fake reviewers who all review the same set of products.

Techniques range from simple graph features fed to a tabular model (degree, number of distinct cards per device, connected-component size, the share of known-fraud neighbours, PageRank) to community detection and graph neural networks that learn node embeddings by aggregating neighbour features. Label propagation is powerful but leaky: when you compute "fraud neighbours" features for a backtest, use only labels known as of the event time.

Concept drift and adversarial behaviour

Concept drift means the relationship between features and labels changes over time. Seasonality (holiday shopping), new products and economic shifts cause natural drift. Fraud adds adversarial drift: when you block one pattern, attackers probe the threshold and move to the next. Consequences and responses:

• Label delay. Chargebacks arrive weeks later, so today's performance is unknown. Monitor proxy signals (score distributions, alert rates, feature drift with population stability index) and evaluate on matured labels.
• Retraining cadence. Retrain frequently on recent data, validate out-of-time, and keep a champion–challenger setup.
• Robust features. Velocity counts (transactions per card per hour), deviations from the customer's own history and graph features are harder to fake than raw amounts.
• Feedback loops. Blocked transactions never get labels, so the model never learns whether they were fraud. Hold out a small random sample from intervention or use reject-inference techniques to keep training data unbiased.
• Probing. Rate-limit, avoid exposing exact scores or reasons to attackers, and add some randomisation in step-up challenges.

Human review loops

Production fraud systems are layered: hard rules (sanctioned countries, impossible travel), a model score, automated actions by score band (approve, step-up authentication such as a one-time passcode, decline), and a case management queue for human analysts. Design the loop deliberately:

• Give analysts the score and the reasons: top feature contributions, linked entities on the graph, the customer's history.
• Capture analyst decisions as labels, with reason codes; these are the freshest labels you have.
• Measure queue precision, time to decision and analyst agreement; the alert budget should match staffing.
• Use active learning: route a share of uncertain cases to review, because they teach the model most.
• Keep an audit trail and an appeal path; in lending, payments and insurance, decisions about people can carry regulatory duties for explanation and non-discrimination.

Common pitfalls

• Reporting accuracy or ROC-AUC alone on data with 0.1% positives.
• Random train/test splits that put the same fraud ring, device or customer in both sets; use time-based and group-aware splits.
• Using the default 0.5 threshold instead of a cost- and capacity-based one.
• Resampling the training data and then reading the model's probabilities as real-world fraud rates without recalibration.
• Training an unsupervised detector on data already contaminated with the fraud you want to find, then setting contamination to a guess and treating it as truth.
• Ignoring label delay, so last week looks fraud-free.
• Leaky features such as "chargeback flag" or graph features built with future labels.
• Treating the model as static in an adversarial setting.

In practice

Start by defining the cost of each outcome with the business, the review capacity, and the latency budget (card authorisations need a decision in tens of milliseconds). Build robust statistical baselines and an isolation forest for unlabelled problems; for labelled fraud, train gradient-boosted trees on velocity, behavioural-deviation and graph features, with unsupervised scores as inputs. Evaluate with PR curves and expected cost on an out-of-time test set. Calibrate probabilities, set thresholds by expected loss, and serve decisions in bands. Wrap it in monitoring for drift and label maturity, retrain on a cadence, and treat analyst feedback as the most valuable data stream you have.