AI fraudulent transaction detection in mobile app

AI-Powered Fraud Detection for Mobile Transactions

Fintech fraud doesn't look like movies. It's not one suspicious large transfer—it's a pattern: several small transactions at non-standard times, non-standard locations, to non-standard recipients. Static rules ("block >50k transfers at night") deliver high false positive rate and frustrate honest users. ML models work with context.

Why This Is Harder Than Scoring

Class imbalance. Fraudulent transactions—0.1–1% of total. A model always answering "normal transaction" has 99% accuracy and is useless. Need special techniques: SMOTE oversampling, cost-sensitive learning, F1/AUC-PR threshold optimization, not accuracy.

Real-time. Borrower scoring is offline—can compute for minutes. Fraud detection is online, decision needed in 200–500ms before transaction confirmation. Limits model complexity.

Concept drift. Fraud schemes change faster than economic patterns. Model degrades quickly—needs frequent monitoring and retraining.

Feature Engineering for Fraud Detection

def extract_transaction_features(
    transaction: Transaction,
    user_history: UserHistory,
    real_time_context: RealTimeContext
) -> dict:
    return {
        # Amount deviation from user's historical norm
        "amount_zscore": (transaction.amount - user_history.avg_amount) / user_history.std_amount,

        # Time of day (0-23) — fraud peaks at night
        "hour_of_day": transaction.timestamp.hour,
        "is_unusual_hour": transaction.timestamp.hour not in user_history.active_hours,

        # Speed: time since last transaction
        "minutes_since_last_tx": (transaction.timestamp - user_history.last_tx_time).seconds / 60,

        # Geolocation
        "is_new_country": transaction.country not in user_history.known_countries,
        "distance_from_last_tx_km": geo_distance(transaction.location, user_history.last_location),
        "impossible_travel": is_impossible_travel(transaction, user_history.last_tx_location, user_history.last_tx_time),

        # Recipient
        "is_new_recipient": transaction.recipient_id not in user_history.known_recipients,
        "recipient_fraud_score": real_time_context.recipient_risk_score,  # From external source

        # Device and session
        "is_new_device": transaction.device_id not in user_history.known_devices,
        "session_age_minutes": real_time_context.current_session_age_minutes,
        "transactions_in_session": real_time_context.session_tx_count,
    }

Impossible travel—one of strongest features: transaction in Moscow at 2 PM and London at 2:30 PM physically impossible. Implemented via Haversine distance between locations and time delta.

Model and Inference

CatBoost and LightGBM—practical choice: fast inference (< 5ms), good categorical feature handling, built-in SHAP.

import catboost as cb

model = cb.CatBoostClassifier(
    iterations=500,
    learning_rate=0.05,
    depth=6,
    loss_function="Logloss",
    eval_metric="AUC",
    class_weights={0: 1, 1: 50},  # Compensate class imbalance
    random_seed=42
)

def predict_fraud_score(features: dict) -> dict:
    feature_vector = prepare_features(features)
    proba = model.predict_proba(feature_vector)[0][1]

    # Multi-level thresholds instead of binary decision
    if proba > 0.85:
        action = "block"
    elif proba > 0.60:
        action = "challenge"  # Request additional confirmation (biometrics, OTP)
    else:
        action = "allow"

    return {
        "fraud_probability": float(proba),
        "action": action,
        "risk_factors": get_shap_explanations(feature_vector)
    }

Three action levels instead of binary "allow/block" reduces false positive rate: most suspicious transactions get additional authentication, not blocking.

Mobile App Integration

Fraud scoring is synchronous call at moment user initiates transaction:

// iOS — Swift
func initiateTransfer(_ transfer: TransferRequest) async throws -> TransferResult {
    // 1. Get fraud score (target < 300ms)
    let fraudScore = try await fraudDetectionService.evaluate(
        amount: transfer.amount,
        recipientId: transfer.recipientId,
        userLocation: locationManager.currentLocation
    )

    switch fraudScore.action {
    case "block":
        throw TransferError.blockedByFraudProtection(
            reason: localizeRiskFactors(fraudScore.riskFactors)
        )
    case "challenge":
        // Request additional authentication before continuing
        try await authenticateAdditionally()
        return try await processTransfer(transfer)
    case "allow":
        return try await processTransfer(transfer)
    default:
        return try await processTransfer(transfer)
    }
}

Production Monitoring

Fraud detection without monitoring—degrading system. Key metrics:

False Positive Rate more important than Detection Rate for user experience: blocked honest transaction—direct loyalty loss. Balance adjusted via threshold.

Development Process

Collect and label transaction history (with risk team) → feature engineering → baseline (logistic regression) → gradient boosting with threshold tuning → A/B test → online monitoring PSI and FPR → monthly retraining.

Timeframe Estimates

MVP with rules + simple ML model—4–6 weeks. Complete system with real-time inference, monitoring, automatic retraining—2–3 months. With ready labeled dataset—accelerates by 3–4 weeks.