CASE STUDY / FINANCIAL SERVICES
Real-time fraud detection that cut false positives 63%
A streaming fraud-scoring platform combining gradient-boosted and graph models — 63% fewer false positives, $8.2M in prevented losses, and full model-risk validation.
63%
reduction in false-positive alerts
$8.2M
fraud losses prevented in the first year
31ms
p99 scoring latency, well inside the auth window
2x
analyst capacity redirected to complex investigations
THE CLIENT
Context
The client issues 30+ million credit and debit cards and processes roughly 900 transactions per second at peak. Fraud detection ran on a vendor rules engine accumulated over fifteen years: 4,000+ rules, many undocumented, tuned by adding more rules whenever losses spiked.
The economics had inverted. False positives outnumbered true fraud 14 to 1, each declined-but-legitimate transaction cost measurable customer attrition, and the fraud-operations team of 170 analysts spent most of its capacity clearing alerts that should never have fired. Meanwhile, coordinated mule-network fraud — invisible to per-transaction rules — was growing 40% year over year.
THE CHALLENGE
What was at stake
The bank needed model-based detection, but two previous ML initiatives had died in model-risk validation: undocumented feature pipelines, no explainability story, and training data the validators couldn't reproduce. Anything we built had to clear SR 11-7 review by the bank's independent validation group — a harder gate than the technology itself.
Latency was the second constraint: scoring had to complete inside the authorization window, leaving a 50ms budget for feature retrieval and inference combined. And the rollout could not disturb the existing rules engine until the new system had proven itself on live traffic.
Engagement at a glance
- Client
- A top-20 US card issuer
- Region
- United States
- Duration
- 7 months
- Team
- 9-person team: ML engineers, streaming platform, model-risk documentation specialist
Services applied
THE SOLUTION
What we built
We built a real-time scoring platform with two complementary models. A gradient-boosted ensemble scores each transaction against 380 engineered features — velocity patterns, merchant risk, device and geo signals — retrieved from a Redis-backed online feature store in under 12ms. A graph model, run near-real-time on an entity graph of cards, devices, merchants, and accounts, detects the mule networks and bust-out patterns that per-transaction scoring cannot see, feeding network-risk scores back into the online feature set.
Validation was designed in, not bolted on. Every feature has documented lineage from raw event to model input; training datasets are versioned and reproducible; SHAP-based reason codes accompany every score so analysts and validators can interrogate any decision. We produced the full SR 11-7 documentation package alongside development and worked directly with the bank's validation group through two review cycles.
Deployment ran champion/challenger: three months of shadow scoring against the rules engine on 100% of traffic, then graduated authority — first on lower-risk decline decisions, then across the portfolio, with the rules engine retained as a guardrail layer for regulatory-mandated controls.
// ARCHITECTURE
Transactions stream through Kafka into a Flink feature-computation layer maintaining rolling aggregates; the online store serves features from Redis with a Feast-managed offline mirror in Snowflake for training-serving consistency. Inference runs XGBoost models behind a Go scoring service (p99 latency 31ms end to end). The entity graph lives in Neo4j with nightly community-detection jobs and streaming edge updates.
The platform runs in the bank's AWS landing zone under its existing IAM, KMS, and network controls, with every score, feature vector, and reason code retained for the seven-year audit horizon.
Core stack
- Kafka
- Flink
- XGBoost
- Neo4j
- Feast
- Redis
- Snowflake
- SHAP
- Go
- AWS
HOW IT WAS DELIVERED
Implementation approach
Value delivered in phases with go/no-go evidence at each gate — never a big-bang bet.
- 01
Loss and alert analysis (weeks 1–5)
Analyzed 18 months of fraud outcomes and alert dispositions to baseline precision, recall, and the true cost of false positives with the fraud-strategy team.
- 02
Feature platform and models (months 2–4)
Built the streaming feature pipelines and both models with documented lineage; validation documentation written in parallel by a dedicated specialist.
- 03
Shadow mode (months 4–6)
Scored 100% of live traffic in parallel with the rules engine; weekly precision/recall reviews with fraud strategy and monthly checkpoints with the validation group.
- 04
Graduated cutover (months 6–7)
Champion/challenger promotion by decision tier, with analyst feedback loops wired into the monthly retraining pipeline.
“The model performance got our attention, but the validation package is what got it into production. Ilmora understood that in a bank, the documentation is the product too. Our independent validators called it the cleanest submission they'd reviewed.”
Priya Raghavan
Chief Risk Officer — Top-20 US card issuer
KEEP READING
More case studies
Want results like these?
Bring us the metric you need to move. Our architects will map how a comparable engagement would work in your environment — systems, timeline, and expected impact.