Real-time fraud detection pipeline (GDP Labs)

A high-volume payments platform faced three forms of fraud: account takeover, synthetic identities built with false KYC documents, and merchants inflating transactions through collusion. Each attack had different signals and timing, so one classifier could not cover them all.

The platform had less than a second to approve each transaction. Full graph inference was too slow for that window. Fraud also made up less than 0.1% of traffic, and attackers changed tactics in response to detection. Static models could become stale within weeks.

I designed three detection stages. Fast rules rejected known patterns such as unusual velocity, location, or blocked devices. XGBoost then scored engineered transaction features. A graph detector found colluding merchants and synthetic identity groups from their network structure.

Kafka ingested transaction events, while Redis served precomputed features such as rolling velocity and account baselines. Separating feature work from inference allowed complex signals within the latency limit.

Continuous retraining pipeline on labeled feedback from the fraud operations team (human-in-the-loop label generation from case resolution outcomes). Deployed with monitoring on feature distribution shifts and score distribution drift as early warning signals for concept drift between retraining cycles.