Real-time fraud detection pipeline (GDP Labs)

A high-volume payments platform faced 3 forms of fraud. Attackers took over accounts, created synthetic identities with false identity-check documents, and inflated merchant transactions through collusion. Each attack had different signals and timing. Therefore, the platform needed several detection methods.

The platform had less than a second to approve each transaction. However, full analysis of account and merchant connections took too long. Moreover, fraud made up less than 0.1% of traffic. Attackers also changed tactics in response to detection. Therefore, models using fixed patterns could become stale within weeks.

I designed 3 detection stages. First, fast rules rejected known patterns in transaction rates, locations, or blocked devices. Then XGBoost scored features derived from transactions. Finally, a graph detector analysed connections between accounts and merchants. It found colluding merchants and groups of synthetic identities from this network structure.

Kafka ingested transaction events, while Redis served features calculated in advance. These included rolling transaction rates and each account’s usual behaviour. Therefore, separating feature calculations from inference allowed complex signals within the response-time limit.

The pipeline retrained continuously on labelled feedback from the fraud operations team. Staff supplied labels from resolved fraud cases. Moreover, monitoring tracked shifts in input features and model scores. These changes warned of shifts in fraud patterns between retraining cycles.