Appendix B. Comprehensive fraud typology and modeling reference

This appendix is a practical reference for building AI-driven fraud defenses by connecting fraud types, engineered features, and model choices. Its central message is that effective detection depends on matching the threat pattern to the right signals in the data and then selecting an architecture that fits the operational setting, rather than relying on any single model to solve every problem.

It reviews major fraud categories and the behavioral clues that typically reveal them, including card-not-present fraud, account takeover, synthetic identity abuse, organized fraud rings, money laundering, insider misuse, cryptocurrency scams, and deepfake-enabled attacks. For each, it emphasizes the indicators most worth monitoring, such as transaction velocity, device and IP inconsistencies, thin or mismatched identity histories, shared attributes across accounts, rapid fund movement, unusual access patterns, on-chain wallet behavior, and failures in liveness or multimedia verification.

The appendix also organizes the most useful feature families for fraud modeling, ranging from time-windowed velocity measures and historical risk scores to identity-device linkage, cross-entity propagation, behavioral anomaly signals, and macro-sensitive indicators. It closes by comparing supervised models, unsupervised anomaly detection, and graph-based methods: tree-based supervised models are fast and highly explainable for known fraud, autoencoders help surface novel deviations but can raise false positives, and graph methods are best for uncovering hidden networks and coordinated schemes, though they are heavier to run and less straightforward to explain.

• Inline Blocking Layer (Millisecond Latency): This is the front line. Lightweight rule engines and highly optimized supervised models (like XGBoost) evaluate transactions in real-time, instantly declining known fraud patterns and minimizing immediate financial loss.
• Escalation Layer (Near Real-Time): Running parallel to or slightly behind the inline layer, unsupervised models (Autoencoders) score transactions for behavioral anomalies. High-risk deviations that bypass the blocking layer are escalated to human analysts for manual review.
• Investigative Graph Layer (Batch/Asynchronous): Because fraudsters often work in coordinated groups, Graph Neural Networks and community detection algorithms process historical transaction data overnight or intra-day. This layer uncovers hidden mule networks, synthetic identities, and complex AML structuring that are invisible at the individual transaction level.
• Monitoring & Feedback Loop: Fraud is an adversarial game. Operations teams must continuously monitor model drift (using tools like Evidently) and feed the verified outcomes of analyst investigations back into the supervised models to combat concept drift and adapt to shifting tactics.

FAQ