Rules and Models — Why Fraud Systems Need Both
Every few years someone declares rules dead — just let the model learn everything — and every production fraud team quietly keeps both, because rules and models are good at different, complementary things: rules deploy in minutes against the attack happening right now, encode hard policy exactly, and explain themselves completely; models find the subtle multidimensional patterns no human would write down. The engineering question isn't which — it's how the two compose into one decision.
Rules deploy in minutes against live attacks, encode policy exactly, explain themselves completely, and hold the blind spots; models (GBDTs as the tabular workhorse) own the unstateable patterns. Composition makes them one decision: policy first, scores next, cost-thresholded logic last — versioned and golden-tested.