Business Problem
Bank B is a major Australian bank with global presence. As most of banks, B processes about 2 million online transactions per day. Approximately 10~20 frauds might hide in the huge number of genuine transactions. An efficient fraud detection system is highly expected to protect their customers from fraudulent attack earlier, faster and more accurately.
B has been employing a rule-based expert system in online banking fraud monitoring for 10 years. Some prominent disadvantages are found in the existing rule system. First of all, high false positive rate was found especially where rules are manually tuned to cover newly emerging frauds. A rule is usually built to simulate risky scenarios, with which alerts are triggered on suspicious transactions. Some critical disadvantages are obviously found: (1) Balancing the detection rate and false positive rate are increasingly challenging due to the rapid development of fraud techniques by fraudsters. (2) Maintaining complex detection rules are costly and inefficient. The rules generated by the domain experts are considerably long so as to obtain good trade-off, as a result, they are hard to understand and maintain. (3) The rule tuning is usually difficult due to the emerging new techniques applied for fraudulent activities. (4) The expert system is a fake real time monitoring approach. In every 30 minutes, the transactions go through the checking process executed by detection rules in batch. A real time fraud detection system is essential to detect suspicious cases and recover the money instantly. (5) Refreshing detection rules has to be conducted manually via tuning the rules by domain experts, which is time consuming and low efficient.

Our Solution
To solve the problems challenging the real time fraud detection, we applied advanced behavior analytics and predictive modeling to build a real time detection system. Contrast patterns, which are rules matching fraudulent transactions with high matching rate and extreme small matching rate among genuine ones, were mined to filter genuine transactions thereby enormously cutting down the false positive rate. Automatic training process incorporates fresh transactions to upgrade the models with new knowledge guaranteeing a stable performance in detection. The monitor system upgrades the detection power by extracting emerging suspicious transactions into the retraining. The models can be easily refreshed on a daily/weekly basis. On the other hand, the algorithms are specially designed to automatically maximize the detection rate with specified low false positive rate. Upgrading the detection system can be conducted within a couple of minutes through an overnight scheduling job. Unsupervised classification is used to detect outlier without prior knowledge, which captures emerging behaviors of frauds which do not appear in historical behaviours.