How Mathematics Improves The World | Finding Fraud Hidden Inside Millions of Ordinary Transactions
Imagine one million payments moving through a system today.
Groceries.
Rent.
Salary.
Bus fares.
Online purchases.
Business invoices.
Transfers to family.
Almost all are legitimate.
Somewhere inside the ordinary traffic may be stolen-card use, account takeover, mule activity, synthetic identity abuse, invoice manipulation or another financial crime.
The easy response would be to stop everything unusual.
That would also stop travellers, new customers, large purchases, emergency transfers and thousands of legitimate exceptions.
So fraud detection has two jobs at once:
- find genuinely dangerous behaviour;
- avoid treating ordinary human variation as guilt.
This is not simply pattern recognition.
It is decision-making under extreme class imbalance, incomplete labels, adaptive adversaries and asymmetric costs.
Mathematics turns that tension into something institutions can measure.
Quick Read
Fraud and payment anomalies are rare compared with legitimate transactions. This creates a base-rate problem: even a detector with high accuracy can generate far more false alarms than true fraud cases if the false-positive rate is not extremely low. Useful systems therefore evaluate precision, recall, false-positive rates, expected loss and customer friction—not accuracy alone.
Transaction monitoring combines several kinds of Mathematics. Supervised models learn from previously labelled fraud. Unsupervised anomaly detectors look for behaviour that differs from normal patterns. Graph analytics examine networks of accounts and transfers rather than transactions one by one. Sequence models look for suspicious timing and behavioural changes. Bayesian and probabilistic methods combine uncertain evidence into risk scores.
The Bank for International Settlements published a 2024 machine-learning framework for anomaly detection in high-value payment systems that explicitly describes the task as finding a needle in a haystack. Its two-stage architecture first separates typical from unusual payments, then applies unsupervised anomaly detection to the unusual subset. In 2025, the BIS Innovation Hub’s Project Hertha explored network-level transaction analytics for identifying financial-crime patterns across real-time retail payment systems while seeking to use a minimal set of data points.
These systems do not determine guilt. A model score indicates statistical risk under a particular model. High-risk events may be blocked automatically in narrowly defined situations, challenged with additional authentication, or sent to human investigation depending on institution, regulation and consequence. The mathematical system supports judgement; it does not replace due process.
One-sentence answer: Mathematics improves the world by turning millions of ordinary transactions into probabilistic patterns, helping institutions focus scarce investigative attention on the small number of events and networks most inconsistent with legitimate behaviour while keeping false accusations measurable and controllable.
Fraud Is a Rare-Event Problem
Suppose 0.1% of transactions are fraudulent.
That means 1 in 1,000.
A million transactions contain roughly 1,000 fraud cases and 999,000 legitimate ones under that hypothetical rate.
A detector that labels everything “legitimate” achieves 99.9% accuracy.
It catches zero fraud.
Accuracy is therefore nearly meaningless by itself in highly imbalanced problems.
The relevant question is how the model behaves on the rare class without overwhelming operations with false alarms.
The Base-Rate Trap
Take 100,000 transactions.
Assume 0.1% are fraudulent.
Fraud cases: 100.
Legitimate: 99,900.
Suppose a detector catches 99% of fraud and falsely flags 1% of legitimate transactions.
True positives: 99.
False positives: 999.
Total alerts: 1,098.
Only about 9% of alerts are true fraud.
A detector can sound excellent and still produce ten false alerts for each true one.
Rare-event Mathematics forces us to respect the denominator.
Confusion Matrix: Four Outcomes, Four Different Consequences
Every binary fraud decision falls into one of four categories.
- True positive: fraud correctly flagged.
- False positive: legitimate activity incorrectly flagged.
- True negative: legitimate activity correctly allowed.
- False negative: fraud missed.
These are not symmetric.
A false negative can create direct financial loss and customer harm.
A false positive can block rent, strand a traveller or make a customer abandon a bank or merchant.
Good systems measure both.
Recall: How Much Fraud Did We Catch?
recall = true positives / all actual positives
If 100 fraud cases exist and the model finds 90, recall is 90%.
High recall reduces missed fraud.
Push recall toward 100% and false positives often rise.
Almost anything remotely unusual can be flagged.
Recall needs a companion.
Precision: How Many Alerts Were Actually Fraud?
precision = true positives / all predicted positives
If the model raises 1,000 alerts and 100 are fraud, precision is 10%.
An investigation team must examine roughly nine legitimate cases for every fraud case.
Raise the detection threshold.
Precision usually rises.
Recall falls.
The threshold controls a trade-off between missed fraud and customer friction.
ROC Curves Can Look Too Optimistic Under Extreme Imbalance
The receiver operating characteristic curve plots true-positive rate against false-positive rate across thresholds.
ROC-AUC is useful.
When negatives vastly outnumber positives, a small false-positive rate can still produce huge absolute false-alert counts.
Precision–recall curves are often more revealing for rare-event detection because precision directly reflects class prevalence and alert purity.
Metric choice should reflect operational reality.
Expected Loss: A False Negative Can Cost More Than a False Positive
Suppose blocking one legitimate transaction costs $5 in service friction.
Missing one fraud costs $500.
The economically optimal threshold will differ from a system where both errors cost the same.
Expected cost can be written conceptually as:
expected loss = CFNP(FN) + CFPP(FP) + other operational costs
Consequences turn classification into decision theory.
A Risk Score Is Better Than a Binary Guess
Instead of saying fraud/not fraud immediately, a model can estimate a probability or risk score.
0.02.
0.37.
0.94.
Different actions can correspond to different bands.
- low risk: allow;
- medium risk: request additional authentication;
- higher risk: review or temporarily hold according to policy;
- very high risk under narrowly defined rules: block.
The score separates statistical assessment from operational action.
Probability Calibration: 20% Should Mean About 20%
A model assigns 0.8 risk to one thousand transactions.
If only 100 later prove fraudulent, the score is badly calibrated.
A calibrated 0.8 group should contain fraud roughly 80% of the time under stable conditions and appropriate labels.
Calibration matters because thresholds, reserves and intervention decisions assume risk numbers have consistent meaning.
Ranking quality alone is not enough.
Supervised Learning: Learn From Known Fraud
Historical transactions can be labelled using confirmed fraud outcomes.
A supervised model learns which combinations of features predict those labels.
Methods include:
- logistic regression;
- decision trees;
- random forests;
- gradient boosting;
- neural networks.
The model learns from examples.
Its weakness is equally clear.
New fraud patterns may look unlike the past.
Logistic Regression: A Transparent Starting Point
A logistic model combines features linearly:
z = β0 + β1x1 + … + βpxp
Then maps z through the logistic function:
P(fraud)=1/(1+e−z)
Coefficients can be inspected.
Positive β increases log-odds of the modelled class.
Negative decreases it.
More complex models may improve prediction.
Logistic regression remains valuable because its mechanics are understandable and easy to audit.
Features: Behaviour Becomes Numbers
A transaction can be represented by features such as:
- amount relative to account history;
- time of day;
- merchant or transaction category;
- device continuity;
- geographic consistency;
- number of recent transactions;
- time since last transaction;
- relationship to recipient;
- historical account behaviour.
No one feature is “fraud”.
A $5,000 transfer can be ordinary.
A $5 transfer can be malicious.
Risk lives in combinations and context.
Velocity Features: Too Much Activity Too Quickly
Count transactions in the last minute.
Ten minutes.
Hour.
Day.
Rapid bursts can be informative because compromised accounts may behave differently from normal spending rhythms.
But legitimate bursts exist:
holiday shopping.
business payroll.
travel.
Velocity is evidence, not verdict.
Behavioural Baselines: Unusual for Whom?
$800 at midnight may be unusual for one account.
Normal for a restaurant.
A useful detector compares activity with an entity’s own history as well as population norms.
This creates personalised baselines.
Mathematically:
anomaly score = distance from expected behaviour under context
Expectation should adapt slowly enough to notice change and quickly enough to learn legitimate new habits.
Unsupervised Anomaly Detection: Look for What We Have Never Labelled
Some suspicious patterns have no historical label.
Unsupervised methods model normal structure and identify outliers.
Examples include:
- isolation forests;
- clustering;
- autoencoders;
- density estimation;
- nearest-neighbour distances.
The difficulty is that unusual does not mean fraudulent.
A first-time home purchase is unusual.
A business changing suppliers is unusual.
Anomaly detection is best understood as triage.
BIS Two-Layer Detection: First Find Unusual, Then Find Anomalous
A 2024 BIS working paper proposes a layered framework for high-value payment systems.
First, supervised learning separates typical payments from unusual payments.
Second, only the unusual subset enters an unsupervised anomaly detector.
This narrows the haystack before looking for the needle.
In tests using manipulated transactions and Canadian high-value payment data, the first layer achieved a 93% detection rate for the test anomalies, while the second layer scored the manipulated transactions as substantially more suspicious than originals.
The broader lesson is architectural:
one model does not have to solve every detection job.
Graph Analytics: Fraud Can Be a Network Property
Look at one transfer.
It seems ordinary.
Look at the network.
Twenty new accounts send small payments into one account.
The funds move rapidly onward through several intermediaries.
Individual edges look small.
The graph pattern is unusual.
Financial-crime detection increasingly examines entities and their relationships because coordinated behaviour may be invisible transaction by transaction.
Project Hertha: Use the Payment Network’s Wider View
The BIS Innovation Hub’s Project Hertha, conducted with the Bank of England, explored transaction analytics for identifying financial-crime patterns in real-time retail payment systems.
The project’s premise is important.
Criminal activity can span many accounts and institutions.
A payment system can see cross-participant transaction relationships that one institution may not see alone.
Network-wide data can therefore reveal coordinated patterns.
The privacy challenge grows at the same time.
Nodes, Edges and Motifs
In a payment graph:
- accounts or entities are nodes;
- transactions are directed edges;
- amount and time are edge attributes.
Algorithms can measure:
- degree;
- centrality;
- community structure;
- cycles;
- rapid flow-through;
- shared counterparties;
- unusual network motifs.
A suspicious motif is a recurring network shape associated with risk.
Again, association is not guilt.
Graph structure prioritises investigation.
Entity Resolution: Are These Two Accounts the Same Person?
Fraud networks hide behind identity fragmentation.
One person may control several accounts or devices.
Two legitimate people may share an address or household device.
Entity resolution uses probabilistic matching across names, contact information, device identifiers and other permitted data.
False merges are dangerous.
False splits hide networks.
Identity inference needs uncertainty too.
Sequences: Order Can Matter More Than Individual Transactions
A new device login.
Password reset.
New payee created.
Large transfer.
Each event can be legitimate.
The sequence may carry more risk than any event alone.
Hidden Markov models, recurrent neural networks and transformer-style sequence models can represent temporal dependencies.
Fraud detection becomes grammar:
which sequences of actions are normal for this account and which are not?
Time Is a Feature
Two transfers of the same amount to the same recipient can carry different risk if one occurs after years of normal relationship and the other seconds after an account recovery event.
Elapsed time since:
- login;
- password change;
- payee creation;
- previous transfer;
- device registration
can be informative.
Context lives in temporal distance.
Concept Drift: Legitimate Behaviour Changes
Customers change jobs.
Move country.
Start businesses.
Adopt mobile wallets.
Inflation changes transaction sizes.
A model trained three years ago may treat normal modern behaviour as anomalous.
This is concept drift.
Detection systems monitor feature distributions, calibration and alert outcomes through time.
The model needs maintenance because society changes.
Adversarial Adaptation: Fraudsters React to Defences
Unlike weather, fraud has an opponent.
When institutions deploy a control, criminals may change tactics.
This makes fraud detection non-stationary and strategic.
Defenders therefore avoid relying on one rigid rule forever.
They combine models, rules, graph signals, authentication and human review.
The safest lesson is general rather than operationally specific:
an adaptive threat requires adaptive measurement.
Labels Arrive Late
A cardholder reports fraud days later.
A merchant dispute takes weeks.
An investigation takes months.
The system must make a decision in milliseconds while the true label arrives later.
This creates delayed supervision.
Models trained only on recently resolved cases may lag behind emerging patterns.
Online learning and unsupervised signals help bridge the delay, but increase validation complexity.
Labels Are Incomplete
Not every fraud is discovered.
Some small losses go unreported.
Some anomalies have legitimate explanations.
Some confirmed fraud is attributed to the wrong mechanism.
The training labels are therefore noisy observations of a hidden state.
Fraud detection is not only a classification problem.
It is classification with imperfect ground truth.
Positive–Unlabelled Learning
Confirmed fraud cases are positive.
The remaining transactions are not necessarily confirmed negative.
Some hidden fraud may sit among them.
Positive–unlabelled learning treats this explicitly.
Rather than assuming every unreported transaction is legitimate, the model recognises uncertainty in the negative class.
Missing labels become part of the statistical model.
Human Investigation: Models Prioritise Scarce Attention
An investigation team can review 5,000 alerts per day.
The system could produce 100,000.
Ranking matters.
Sort cases by expected risk or expected preventable loss.
High-value high-confidence cases rise.
Low-risk anomalies remain lower.
Fraud analytics protects investigative bandwidth in the same way search ranking protects user attention.
The first job is not to replace analysts.
It is to decide what they should look at first.
Active Learning: Ask Humans About the Most Informative Cases
Some cases are obvious.
Some ambiguous.
Active learning selects cases whose labels would most improve the model.
Analysts label those first.
Human expertise becomes a scarce training resource allocated mathematically.
The system learns faster from fewer reviewed cases.
Explainability: Why Was This Payment Flagged?
A customer deserves more than:
the model did not like it.
Investigators also need reasons.
Feature attribution tools can identify which inputs most influenced a score.
Rule-based reason codes provide interpretable triggers.
But explanation methods can be approximate and unstable.
Interpretability should be validated rather than treated as decoration.
Fairness: Suspicion Can Be Unevenly Distributed
A model may flag international transactions more often.
That can reflect genuine historical fraud patterns.
It can also disproportionately burden migrants, travellers or cross-border businesses.
Fairness analysis compares false-positive and false-negative rates across relevant groups while respecting legal and privacy constraints.
The goal is not to force identical risk everywhere.
It is to detect when model errors impose unjustified unequal harm.
Proxy Variables: The Model Can Infer Sensitive Information Indirectly
Remove a sensitive attribute.
Postcode, language, merchant geography or device patterns may still correlate with it.
Fairness cannot be guaranteed by deleting one column.
Model auditing examines outcomes, proxies and interaction effects.
Statistical neutrality requires more than feature blindness.
Privacy: More Data Is Not Automatically Better
Fraud detection benefits from context.
Context can become surveillance.
Project Hertha explicitly frames financial-crime detection alongside privacy and the use of a minimum set of data points.
Data minimisation asks:
What is the least information required to achieve this legitimate detection purpose?
More variables can improve model fit and increase privacy risk.
Good system design optimises both.
Federated and Privacy-Preserving Analytics
Fraud patterns can cross institutions.
Sharing raw customer data widely is undesirable and often legally constrained.
Privacy-preserving approaches include:
- federated learning;
- secure multiparty computation;
- privacy-preserving record linkage;
- differential privacy for some aggregate uses.
These methods aim to extract shared signals while reducing direct data exposure.
They also create computational and accuracy trade-offs.
Real-Time Latency: The Decision Must Finish Before the Payment Does
A card authorisation may need a decision in fractions of a second.
A brilliant model that takes thirty seconds cannot sit in the primary transaction path.
Production fraud systems therefore optimise:
- prediction quality;
- latency;
- availability;
- throughput;
- fallback behaviour.
Some complex graph analysis runs asynchronously and feeds compact risk features to faster online models.
Architecture is part of the Mathematics.
Streaming Statistics: Update Without Recomputing the World
To know how many transactions occurred in the last ten minutes, the system maintains rolling windows.
Online algorithms update counts, means, variances and sketches as events arrive.
Approximate data structures can estimate unique counterparties or frequencies with bounded memory.
When millions of events arrive per second, exact recomputation is impossible.
Approximation becomes infrastructure.
Drift Monitoring: The Detector Needs a Detector
A fraud model is deployed.
Who watches the fraud model?
Monitor:
- feature distributions;
- score distribution;
- alert rate;
- approval rate;
- confirmed fraud rate;
- precision;
- calibration;
- false-positive complaints.
If scores suddenly rise across all customers, perhaps behaviour changed.
Perhaps an upstream feature broke.
Model monitoring separates fraud drift from system failure.
Data Quality: A Missing Zero Can Look Like Fraud
A transaction amount arrives in cents instead of dollars.
A location field is null for one region.
A clock is shifted by one hour after daylight-saving change.
The model sees anomalies.
They are data-pipeline failures.
Fraud systems therefore validate input ranges, schema changes and timestamp integrity.
Bad measurement can create convincing false suspicion.
Feedback Loops: Blocking Changes the Data You Learn From
The model blocks a transaction.
We never observe whether it would have become confirmed fraud if allowed.
This creates selective labels.
Future training data is shaped by past model decisions.
Likewise, fraudsters avoid patterns that trigger controls.
The detector changes the population it later measures.
Causal evaluation and controlled experiments are therefore difficult and important.
Champion–Challenger Testing
One model handles production decisions.
A challenger runs silently in parallel.
Compare scores and later outcomes.
If the challenger improves fraud capture at acceptable false-positive cost, it can be promoted after validation.
This creates continuous improvement without changing customer decisions blindly.
The model must earn deployment through evidence.
A/B Testing Is Harder in Fraud Than Advertising
Randomly allowing suspicious transactions to measure fraud outcomes can expose customers to harm.
Experiments need ethical and risk constraints.
Safer alternatives include shadow scoring, threshold experiments in lower-risk ranges, retrospective replay and simulation.
Experiment design must respect the cost of being wrong.
Synthetic Data: Create Rare Fraud Scenarios Carefully
Real confirmed fraud examples can be scarce.
Synthetic transactions can test whether a monitoring framework reacts to defined anomalies.
The BIS 2024 anomaly-detection work uses artificially manipulated transactions as part of evaluation.
Synthetic data is useful for stress testing.
It can also be too easy.
If artificial anomalies are unrealistic, a model may score well without detecting genuine financial crime.
Simulation needs adversarial realism.
Graph Neural Networks: Learn From Neighbours
A transaction’s risk can depend on the accounts around it.
Graph neural networks pass information along edges and learn representations combining local transaction attributes with neighbourhood structure.
An account linked to several confirmed risky entities may receive a different representation from an otherwise similar isolated account.
The danger is guilt by association.
Legitimate accounts can transact with risky ones unknowingly.
Graph signals should therefore support investigation rather than become automatic moral judgement.
Community Detection: Find Unusual Clusters
Payment networks contain communities.
Families.
Businesses.
Supply chains.
Fraud rings can also form dense or patterned subgraphs.
Community-detection algorithms identify clusters whose internal connectivity is stronger than expected.
Then analysts ask whether the cluster has a legitimate economic explanation.
Structure generates a question.
It does not answer it alone.
Centrality: One Account Can Be a Hub Without Being Criminal
High-degree accounts interact with many others.
A payment processor is a hub.
A marketplace is a hub.
A fraud mule collector can be a hub too.
Centrality requires context.
Graph metrics are features, not criminal labels.
Change-Point Detection: The Account Became Different
An account behaves normally for five years.
Then spending geography, device, payee network and transfer frequency all shift abruptly.
Change-point algorithms test whether the statistical process changed at a particular time.
This can detect account takeover or legitimate life events.
The change is real.
Its cause still requires evidence.
Counterfactual Questions: Would We Still Flag It Without This Feature?
A model assigns high risk.
Change only the transaction amount.
Does risk fall?
Change geography.
Change account age.
Counterfactual analysis reveals which features drive decisions and can expose unreasonable sensitivity.
It helps debug models before customers discover the failure mode.
Rule Systems Still Matter
Machine learning receives attention.
Simple rules remain valuable.
A legal sanction requirement is a rule.
A known impossible state is a rule.
A hard transaction limit can be a rule.
Rules are interpretable and deterministic.
Models handle statistical ambiguity.
Strong systems use both where appropriate.
Rules and Models Fail Differently
A rule is brittle.
If behaviour falls just outside its condition, the rule does nothing.
A model generalises.
It can also generalise wrongly.
Combining independent mechanisms creates defence in depth.
One component’s blind spot need not become the system’s blind spot.
False Positives Are a Customer-Experience Metric
A blocked legitimate payment is not merely one incorrect row in a confusion matrix.
It can be:
- a declined medical payment;
- a missed hotel booking;
- an embarrassed customer at checkout;
- a supplier not paid on time.
Fraud models should therefore measure customer friction per prevented loss.
Operational quality is human.
False Negatives Are Often Uneven Too
A model may detect one fraud type extremely well and miss another.
Average recall can hide subtype weakness.
Evaluation should break performance down by:
- fraud mechanism;
- transaction channel;
- amount band;
- customer segment;
- time since attack begins.
Coverage matters as much as headline accuracy.
Extreme Value Thinking: The Tail Can Matter Most
Most transactions are small.
A rare enormous transfer may dominate expected loss.
Risk scoring can weight amount and probability:
expected loss ≈ probability of fraud × exposure × recoverability adjustment
A 2% risk on a $1 million payment can deserve more attention than a 40% risk on $20, depending on context and controls.
Rank by consequence, not probability alone.
A Classroom Thought Experiment: The Alarm That Is “99% Accurate”
Tell students:
1 in 1,000 transactions is fraud.
The detector catches 99% of fraud.
It falsely flags 1% of legitimate transactions.
Test 100,000 transactions.
Students calculate:
- 100 fraud;
- 99 caught;
- 99,900 legitimate;
- 999 falsely flagged.
Then ask:
If the alarm fires, what is the probability it found fraud?
About 9%.
Students discover base rates more powerfully than from a definition.
A Second Thought Experiment: Thresholds Create Trade-Offs
Give ten transactions risk scores:
0.95, 0.82, 0.70, 0.61, 0.55, 0.48, 0.31, 0.20, 0.10, 0.04
Reveal which later proved fraudulent.
Try thresholds 0.8, 0.6, 0.4.
Calculate precision and recall.
No threshold dominates automatically.
Students discover classification as a policy choice.
Primary Mathematics: Fraud Detection Begins With Fractions
Primary students can understand:
- fractions;
- percentages;
- rare events;
- tables;
- graphs;
- conditional questions.
99 out of 1,098 alerts are real cases.
That fraction tells a story accuracy does not.
The advanced system begins with careful counting.
Secondary Mathematics: Risk Becomes Probability
Secondary students add:
- conditional probability;
- Bayes’ theorem;
- logistic functions;
- matrices;
- statistics;
- graph theory;
- optimisation.
Base rates become Bayes.
Risk scores become logistic functions.
Payment networks become graphs.
Thresholds become decision theory.
Advanced Mathematics: Fraud as Rare-Event Network Inference
Modern transaction monitoring draws on:
- Bayesian inference;
- classification theory;
- anomaly detection;
- graph theory;
- time-series analysis;
- hidden-state models;
- optimisation;
- causal inference;
- machine learning;
- decision theory.
The hidden state is fraudulent intent or compromise.
The observations are transactions, relationships and behavioural changes.
The model estimates risk.
Policy chooses an action under uncertainty.
Why This Improves the World
1. It makes rare fraud detectable at scale
Statistical models scan transaction volumes far beyond human review capacity.
2. It protects investigative attention
Risk ranking sends analysts the cases most likely to deserve human scrutiny.
3. It sees networks rather than isolated payments
Graph analytics reveals coordinated patterns distributed across many individually ordinary transactions.
4. It makes customer friction measurable
Precision, false-positive rates and cost functions stop institutions treating legitimate declines as invisible collateral damage.
5. It supports privacy-aware design
Data minimisation and privacy-preserving analytics let institutions ask which information is genuinely required for detection.
6. It adapts as behaviour changes
Drift monitoring, layered models and continual validation let defences evolve rather than rely on permanent static rules.
What Mathematics Does Not Do
A high risk score does not prove a crime occurred.
An anomaly is not automatically fraud.
A graph connection does not imply guilt by association.
Machine learning does not repair poor labels or bad data.
A model with excellent historical accuracy does not guarantee performance against new criminal tactics.
Optimising fraud loss alone does not justify unlimited surveillance or customer friction.
And no automated detector should replace legal process, investigation and human accountability where consequential decisions are involved.
Frequently Asked Questions
Why is fraud detection difficult?
Fraud is rare, labels are delayed and incomplete, legitimate behaviour varies widely, attackers adapt to controls and false positives harm real customers. A useful detector must manage all of these simultaneously.
Why is accuracy a poor fraud metric?
When fraud prevalence is very low, predicting every transaction as legitimate can achieve extremely high accuracy while detecting no fraud. Precision, recall, false-positive rate and expected cost are more informative.
What is anomaly detection?
Anomaly detection identifies observations that differ substantially from learned normal patterns. It is useful for discovering new or rare behaviour, but anomalies still need contextual interpretation because unusual behaviour can be legitimate.
Why use graph analysis for fraud?
Financial crime can involve networks of accounts whose individual transactions appear ordinary. Graph analysis captures relationships, communities and flow patterns that transaction-by-transaction models may miss.
Does AI decide whether someone is guilty of fraud?
No. AI and statistical models produce risk assessments or anomaly scores under specific models. Investigation, institution policy, law and due process determine consequential conclusions and actions.
Sources and Further Reading
- Bank for International Settlements, Finding a Needle in a Haystack: A Machine Learning Framework for Anomaly Detection in Payment Systems, BIS Working Paper No. 1188, 2024.
- BIS Innovation Hub and Bank of England, Project Hertha: Identifying Financial Crime Patterns in Real-Time Retail Payment Systems, 2025.
- Irving Fisher Committee / BIS, Machine Learning for Anomaly Detection in Money Services Business Outlets Using Data by Geolocation, 2024.
Continue Through eduKateSG
Continue with How Mathematics Works. Compare this article with Making Digital Trust Possible Between Strangers: cryptography protects the integrity and authenticity of digital transactions, while fraud analytics asks whether otherwise valid transactions fit legitimate behaviour. It also connects to Finding Useful Pages in a Web Too Large to Read, because both systems rank a tiny subset of a massive information stream for scarce human attention.
Final Thought: The Best Detector Does Not Treat the World as Suspicious
A million transactions pass.
Most should remain boring.
The system learns what ordinary looks like.
It notices a change.
Checks the account’s history.
Looks at the transaction network.
Calculates risk.
Compares the cost of intervention with the cost of being wrong.
And perhaps asks a human to look.
Mathematics improves the world here not by making suspicion universal.
It improves the world by making suspicion selective, measurable and correctable.
That difference matters.