Unsupervised Anomaly Detection for Fraud

Unlabeled transactions scored by two detectors, blended, then routed to a supervised model and a review queue

Unsupervised Anomaly Detection for Fraud Unlabeled transactions scored by two detectors, blended, then routed to a supervised model and a review queue 01 / Sources 02 / Features 03 / Detect 04 / Combine 05 / Consume Transactions · unlabeled stream · 01 / Sources · no labels Transactions unlabeled stream no labels Feature Build · vectors per txn · 02 / Features · engineered Feature Build vectors per txn engineered Isolation Forest · isolation depth · 03 / Detect · depth score Isolation Forest isolation depth depth score Autoencoder · reconstruction · 03 / Detect · recon error Autoencoder reconstruction recon error Combine Scores · blend + threshold · 04 / Combine · percentile Combine Scores blend + threshold percentile Supervised Model · score as feature · 05 / Consume · known fraud Supervised Model score as feature known fraud Review Queue · human analysts · 05 / Consume · novelty Review Queue human analysts novelty raw fields unlabeled feature vectors batch feature vectors batch isolation depth anomaly score reconstruction error anomaly score score as feature supervised input novel-attack fallback top percentile Legend primary data policy / PII async batch data store

No Labels Required

  • • Detectors learn what normal looks like, not what fraud looks like
  • • Isolation forest scores by how few splits isolate a point
  • • Autoencoder scores by reconstruction error on unseen patterns

Blend and Threshold

  • • Two independent signals merge into one blended score
  • • Threshold on a rolling percentile sized to review capacity
  • • The score prioritizes attention rather than issuing a verdict

Two Consumers

  • • Feeds the supervised model as a standing feature
  • • Routes novel high-anomaly cases to human review
  • • Confirmed cases become seed labels for the next retrain

Data-flow diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export