Learning Objectives

• Apply ML techniques to fraud detection
• Build and evaluate fraud detection models
• Handle imbalanced datasets
• Machine learning fundamentals
• Weeks 1-6: Financial forensics context

1. Anomaly Detection Methods

• Z-scores: Flag transactions beyond 3 standard deviations
• IQR: Flag outside 1.5x IQR below Q1 or above Q3
• Moving averages: Flag deviations from trend Machine Learning:
• Isolation Forest: Isolates anomalies by randomly splitting. Anomalies are easier to isolate (fewer splits).
• One-Class SVM: Learns boundary of normal data. New points outside = anomaly.
• Autoencoders: Neural network learns normal patterns. High reconstruction error = anomaly.

2. Supervised Fraud Models

• Class Imbalance: Fraud is rare (0.1-2% of transactions). Accuracy paradox: 99% accuracy by predicting "no fraud" for all.
• Cost Sensitivity: False negative (missing fraud) costs more than false positive (flagging legitimate)
• Concept Drift: Fraud patterns change over time (adversarial adaptation) Solutions:
• Resampling: SMOTE (Synthetic Minority Oversampling), undersampling
• Cost-sensitive learning: Assign higher misclassification cost to fraud
• Ensemble methods: Combine multiple models
• Threshold tuning: Optimize based on business cost

3. Evaluation Metrics

• Precision: TP/(TP+FP) - of flagged frauds, how many are real?
• Recall: TP/(TP+FN) - of real frauds, how many caught?
• F1 Score: Harmonic mean of precision and recall
• AUC-ROC: Model's ability to discriminate fraud/non-fraud

Q1: Why is class imbalance a challenge in fraud detection?

Fraud < 1% of transactions. A model predicting "no fraud" for all achieves >99% accuracy but catches zero fraud. Accuracy is misleading. Solutions: resampling, cost-sensitive learning, threshold tuning. Q2: How does Isolation Forest detect anomalies?

Randomly selects feature and split value. Anomalies are isolated in fewer splits (shorter path) because they're different from normal points. Creates a forest of random trees, averages path length. Q3: What is precision vs recall in fraud context?

Precision: % of flagged cases that are actually fraud (cost of false positives). Recall: % of actual fraud that is caught (cost of false negatives). Trade-off: increasing one decreases the other. Q4: What is concept drift in fraud detection?

Fraud patterns change over time as fraudsters adapt to detection methods. A model trained on 2022 data may not detect 2024 fraud patterns. Requires regular retraining and monitoring. Q5: What is SMOTE?

Synthetic Minority Oversampling Technique. Creates synthetic fraud examples by interpolating between existing fraud cases. Balances the dataset without simple duplication. Q6: What cost-sensitive learning means?

Assign different misclassification costs: false negative (missed fraud) costs $X, false positive (blocked legitimate) costs$Y. Train model to minimize total cost rather than error rate. Join Discord PreviousDigital Forensics for Financial CrimeNextNetwork Analysis for Fraud