Class Imbalance: Only 0.1% of transactions are fraud. Naive model achieves 99.9% accuracy by predicting "not fraud" always. Use: class weights, SMOTE oversampling, or focal loss.
Real-Time Fraud Pipeline
Total: ~80ms (SLA: <100ms)
Transaction Arrives0ms
HTTP POST /score
Rule Engine<5ms
Velocity / blocklist / amount limits
Feature Extraction<20ms
Billing/shipping mismatch, Device fingerprint...
ML Scoring<50ms
Gradient Boost / Neural Net → risk score
Decision Engine<5ms
Threshold: 70% → approve / review / decline
Approve
Human Review
Decline
ROC Curve - Operating Point
Precision: 86.0%
Recall: 93.0%
Feature Importance - Card-Not-Present
Billing/shipping mismatch28%
Device fingerprint22%
Transaction velocity18%
Merchant category16%
Time since last tx12%
Feedback loop: Confirmed fraud labels → incremental retraining → updated model deployed. Delay between fraud and label confirmation: 3-30 days (chargeback cycles). Use temporal cross-validation - never train on future data.
Controls
Fraud Type
Decision Threshold70%
Lower = catch more fraud, more false positives. Higher = fewer false positives, miss more fraud.
Options
Rule engine: blocks obvious fraud in <5ms before ML model runs. Saves GPU compute on known-bad patterns.
Focal loss: downweights easy negatives, forces model to focus on hard fraud cases. Better than plain cross-entropy for imbalanced data.
Fraud Detection System Design - Interactive Visualization
Fraud detection systems must score every payment transaction in under 100 milliseconds while operating on datasets where fraud represents fewer than 0.1% of events. The architecture layers a deterministic rule engine (blocklists, velocity checks, amount thresholds) before the ML model to handle obvious fraud without burning GPU time. The ML stage uses gradient-boosted trees or neural networks trained with SMOTE oversampling, class weights, or focal loss to handle extreme class imbalance. The decision engine applies a threshold to the risk score, routing transactions to approve, human review, or decline. Confirmed fraud labels flow back for incremental model retraining, but with a 3-30 day delay from chargeback cycles.
Rule engine: blocks obvious fraud in <5ms via velocity limits, geographic anomalies, and blocklists - no ML needed
Class imbalance: 0.1% fraud rate means naive model gets 99.9% accuracy predicting "not fraud" for every transaction
SMOTE: Synthetic Minority Oversampling TEchnique generates interpolated fraud examples to balance training data
Focal loss: reduces loss weight for easy negatives, forcing model to focus on hard-to-classify borderline fraud cases
ROC curve: adjust threshold to trade precision (fewer false positives, less customer friction) vs recall (catch more fraud)
Temporal validation: always split train/test by time - never shuffle, because fraudsters adapt to detected patterns
Part of the EngineersOfAI Interactive 3D - free interactive visualizations covering every major concept in machine learning and AI engineering. Hover any element for a plain-English explanation. No code required.