payments

Fraud Detection

Real-time rules, ML scoring, and velocity checks

Fraud Detection — Overview

Real-time rules, ML scoring, and velocity checks

Fraud engines combine rules (velocity, geo-impossibility, device fingerprint) with ML models (XGBoost, neural nets on transaction features). Kafka Streams maintains per-card windows for real-time scoring before authorization decision.

// Kafka Streams — velocity rule
KTable<Windowed<String>, Long> velocity = txns
  .groupByKey()
  .windowedBy(TimeWindows.ofSize(Duration.ofMinutes(5)))
  .count();

velocity.toStream()
  .filter((k, count) -> count > 10)
  .mapValues(count -> new FraudAlert("VELOCITY", count))
  .to("fraud-alerts");

// ML feature vector
FeatureVector v = FeatureVector.builder()
  .amount(txn.getAmount())
  .merchantMcc(txn.getMcc())
  .hourOfDay(now.getHour())
  .distanceFromLastTxn(geo.distance())
  .deviceAge(device.getAgeDays())
  .build();
double score = model.predict(v); // 0.0 - 1.0

Tip: Balance false positives (customer friction) vs false negatives (losses) — tune threshold per merchant vertical.