Shrinkage Control In Retail

Fraud wasn’t supposed to be a core product challenge. But for most businesses operating online today, it has staunchly become one. In 2024, Indian businesses lost ₹22,842 crore to cybercrime. That’s a 206% increase over the previous year. The first few months of 2025 have already added another ₹7,000 crore in losses. This isn't just a compliance or security concern anymore. It shows up as frozen accounts, locked working capital, rising chargebacks, and misuse through stolen cards, fake UPI payments, and promo abuse. What surprised us most was how quickly chargebacks became part of the everyday reality for merchants: 1. More than half involve deliberate abuse 2. Smaller businesses aren’t spared - around 30 percent of Indian SMEs now report direct losses from fraud, with revenue hits of up to 5 percent. The nature of fraud has changed. Attacks are faster, more coordinated, and more sophisticated. The usual playbook of reacting after the damage doesn't hold up anymore. We decided to rebuild our approach from first principles. RiskShield is what came out of it. It’s a fraud detection engine that runs within the payment flow. It scores every transaction in real time using machine learning, detects fraud rings using graph intelligence, syncs with government risk data like I4C, DoT blacklist, NCRB, and blocks bad actors mid-transaction. It also flags early signs of promo abuse, card testing, and UPI manipulation. So far, RiskShield has helped block over ₹1,700 crore in fraud attempts. It has flagged 2 crore high-risk signals and protected more than 6,600 merchants. The system operates quietly in the background, with an F1 score of 87 percent which is a measure that balances precision (how often fraud alerts are correct) and recall (how much fraud we actually catch) and recall close to 95 percent. Most issues are prevented before anyone files a complaint. There’s still more work to do, but one thing is clear to us now: Fraud cannot be treated as an after-effect. It has to be designed against from the beginning. PS. Here's the flow we have built ⬇️

𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝘀𝗶𝗴𝗻 𝗼𝗳 𝗮 𝘀𝗲𝗻𝗶𝗼𝗿 𝗠𝗟 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿? 𝗧𝗵𝗲𝘆 𝗱𝗼𝗻’𝘁 𝗵𝗮𝘃𝗲 𝗮 𝗺𝗼𝗱𝗲𝗹. 𝗧𝗵𝗲𝘆 𝗵𝗮𝘃𝗲 𝗮 𝘀𝘆𝘀𝘁𝗲𝗺. Fraud detection isn’t about training an algorithm. It’s about building a pipeline that survives drift, latency, scale, noise, and human behavior that keeps changing. A model alone can detect fraud. A system can detect fraud fast enough to stop financial loss. So let’s break the architecture. 1/ 𝗜𝗻𝗴𝗲𝘀𝘁𝗶𝗼𝗻 → 𝗦𝘁𝗿𝗲𝗮𝗺𝘀 𝗼𝘃𝗲𝗿 𝗯𝗮𝘁𝗰𝗵. Banks don’t wait minutes. Fraud happens in milliseconds. That’s why systems use: Kafka Kafka Streams Spark Streaming They collect real-time transactions and push them instantly into feature processing. 2/ 𝗙𝗲𝗮𝘁𝘂𝗿𝗲 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 → 𝗣𝗮𝘁𝘁𝗲𝗿𝗻𝘀 𝗼𝗻 𝘁𝗵𝗲 𝗳𝗹𝘆. Location change Unusual amount Midnight transaction New device Fraud isn’t detected by raw data. It’s detected by signals hidden inside behavior. Here preprocessing converts messy banking data into features that models understand. 3/ 𝗙𝗲𝗮𝘁𝘂𝗿𝗲 𝗦𝘁𝗼𝗿𝗲 → 𝗠𝗲𝗺𝗼𝗿𝘆 𝗳𝗼𝗿 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀. You can’t recompute features every time. You store them. Tools like Feast Hopsworks Tecton keep both: Real-time feature store Offline feature store This ensures training data and prediction data stay consistent, otherwise the model lies. Real-Time Events ↓ Kafka Stream ↓ Feature Engineering Layer ↓ 𝗙𝗲𝗮𝘁𝘂𝗿𝗲 𝗦𝘁𝗼𝗿𝗲 ↙ ↘ Offline Training Data Live Inference Data 4/ 𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴 & 𝗘𝘃𝗮𝗹𝘂𝗮𝘁𝗶𝗼𝗻 → 𝗧𝗵𝗲 𝘀𝘆𝘀𝘁𝗲𝗺 𝗹𝗲𝗮𝗿𝗻𝘀. Offline training uses historical labels to detect: Fraud patterns User behavior Velocity checks Device fingerprints Pipelines automated with: Kedro Metaflow Prefect And everything is tracked in MLflow or Comet. 5/ 𝗠𝗼𝗱𝗲𝗹 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝘆 → 𝗪𝗵𝗮𝘁’𝘀 𝗶𝗻 𝗽𝗿𝗼𝗱? A mature team never deploys a model manually. They version it. Store metrics. Roll back instantly if drift hits. 6/ 𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗣𝗶𝗽𝗲𝗹𝗶𝗻𝗲 → 𝗧𝗵𝗲 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻. The live model predicts: Fraud Not Fraud Confidence score Risk category Then the system routes actions: Freeze card Notify user Block transaction Ask for OTP Real-time decisions. Not batch dashboards. 7/ 𝗙𝗲𝗲𝗱𝗯𝗮𝗰𝗸 + 𝗗𝗿𝗶𝗳𝘁 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 → 𝗧𝗵𝗲 𝘀𝘆𝘀𝘁𝗲𝗺 𝗮𝗱𝗮𝗽𝘁𝘀. Fraud changes every month. So the system must detect when the model is: Losing accuracy Reacting incorrectly Missing new patterns And retrain automatically. 𝗧𝗵𝗶𝘀 𝗶𝘀 𝘄𝗵𝘆 𝗳𝗿𝗮𝘂𝗱 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗶𝘀𝗻’𝘁 𝗮 𝗣𝘆𝘁𝗵𝗼𝗻 𝘀𝗰𝗿𝗶𝗽𝘁. 𝗜𝘁’𝘀 𝗮 𝗳𝘂𝗹𝗹 𝗲𝗻𝗱-𝘁𝗼-𝗲𝗻𝗱 𝗲𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺. --- 📸/ @ML Academy

𝗛𝗼𝘄 𝗕𝗜𝗡 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 𝗔𝗿𝗲 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗶𝗻𝗴 𝗣𝗮𝘆𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 Payments fraud is evolving, and BIN attacks are one of the fastest-growing threats. By exploiting weaknesses in how card transactions are authorized, fraudsters can test thousands of stolen or algorithm-generated card numbers, often undetected until significant losses occur. So, how do BIN attacks work, and what can merchants do to stop them? Let’s break it down👇 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗮 𝗕𝗜𝗡 𝗔𝘁𝘁𝗮𝗰𝗸? → A Bank Identification Number (BIN) refers to the first 6–8 (soon 10) digits of a card number, which identify the issuing bank and card type. In a BIN attack, fraudsters: 🔹 Use software to generate potential full card numbers. 🔹 Test small transactions (pennies to a few dollars) to see which numbers are valid. 🔹 Sell the successfully tested cards or use them for larger fraud purchases. → These attacks can happen rapidly and at scale, overwhelming merchants with fraudulent declines and chargebacks. 𝗧𝗵𝗲 𝗜𝗺𝗽𝗮𝗰𝘁 𝗼𝗻 𝗠𝗲𝗿𝗰𝗵𝗮𝗻𝘁𝘀 & 𝗜𝘀𝘀𝘂𝗲𝗿𝘀 ▪️High authorization decline rates damage approval rates for legitimate customers. ▪️Chargeback spikes result in added costs and potential penalties. ▪️Fraud monitoring disruptions → Increased failed attempts can flag legitimate transactions as suspicious, frustrating real customers. 𝗖𝗮𝘀𝗲 𝗦𝘁𝘂𝗱𝘆: 𝗘-𝗰𝗼𝗺𝗺𝗲𝗿𝗰𝗲 𝗨𝗻𝗱𝗲𝗿 𝗦𝗶𝗲𝗴𝗲 📌 One global e-commerce platform saw a 400% increase in fraudulent authorizations within 24 hours due to a coordinated BIN attack. Their fraud detection tools initially missed the spike, leading to: 🔹 Over $1.2M in chargebacks from unauthorized transactions. 🔹 A 5% drop in legitimate transaction approvals as banks tightened fraud rules. 🔹 Emergency implementation of velocity checks to block excessive failed attempts. 𝗛𝗼𝘄 𝗠𝗲𝗿𝗰𝗵𝗮𝗻𝘁𝘀 𝗖𝗮𝗻 𝗣𝗿𝗲𝘃𝗲𝗻𝘁 𝗕𝗜𝗡 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 ▪️𝗩𝗲𝗹𝗼𝗰𝗶𝘁𝘆 𝗟𝗶𝗺𝗶𝘁𝘀 → Set limits on how many failed transactions a single card or IP can attempt. ▪️𝗠𝗮𝗰𝗵𝗶𝗻𝗲 𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗙𝗿𝗮𝘂𝗱 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 → Use AI-powered fraud tools to detect unusual transaction patterns in real-time. ▪️𝟯𝗗𝗦 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 → Challenge suspicious transactions with additional verification layers. ▪️𝗕𝗜𝗡-𝗟𝗲𝘃𝗲𝗹 𝗥𝗶𝘀𝗸 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 → Flag and block high-risk BINs associated with known fraud activity. 𝗧𝗵𝗲 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆 BIN attacks exploit weaknesses in payments security, but proactive fraud prevention can minimize the risk. Merchants and issuers must work together to improve real-time detection and response strategies. Sources: Visa, Mastercard, Stripe 🚨Follow Jason Heister for daily #Fintech and #Payments guides, technical breakdowns, and industry insights.

Here's how Stripe detects frauds with a 99.9% accuracy in 100 milliseconds (that too by checking over 1000 parameters for one transaction) Fraud detection in online payments isn’t just about stopping bad transactions it’s about doing it fast, at scale, and without blocking legitimate users. Stripe’s fraud prevention system, Radar, evaluates 1,000+ signals within 100 milliseconds to make decisions. Here’s how it works and why it’s so effective: 1. ML Models That Learn and Scale Stripe started with simple ML models (logistic regression) but quickly scaled to hybrid architectures combining: –XGBoost for memorization (catching known patterns). –Deep Neural Networks (DNNs) for generalization (handling unseen patterns). –Key Problem: XGBoost couldn’t scale or integrate modern ML techniques like transfer learning and embeddings. –The Solution: Stripe moved to a multi-branch DNN-only architecture inspired by ResNeXt. This setup allowed it to memorize patterns while staying scalable. It reduced training times by 85%, enabling multiple experiments in a single day instead of overnight runs. 2. Learning From Real Fraud Patterns Radar doesn’t just rely on static rules, it learns from data across Stripe’s network. –Engineers analyze fraud attacks in detail, e.g., patterns of disposable emails or repeated card testing. –Features like IP clustering and velocity checks were added to detect suspicious activity. –Fraud insights are shared across the network, so lessons learned from one business protect others automatically. Example: Analyzing IP patterns helped detect high-volume attacks where fraudsters used multiple stolen cards from the same source. 3. Scaling With More Data, Not Just Smarter Models Stripe realized that more training data could unlock better performance, similar to modern LLMs like GPT models. It tested scaling datasets by 10x and 100x. Result? Performance kept improving, confirming that larger datasets and faster training cycles work better than complex rules alone. Key Insight: Bigger datasets help uncover rare fraud cases, even if they occur in only 0.1% of transactions. 4. Explaining Fraud Decisions Clearly Fraud systems often act like black boxes, leaving businesses guessing why a payment failed. Stripe built Risk Insights to provide clear explanations: –Shows features contributing to fraud scores like mismatched billing and shipping addresses. –Displays maps and transaction histories for visual context. –Enables custom rules to fine-tune fraud checks for specific business needs. Result: Businesses trust Radar’s decisions because they can see why a payment was flagged. 5. Constant Adaptation to Stay Ahead Fraud patterns evolve, so Stripe built Radar to adapt in real time: Uses transfer learning and multi-task learning to generalize better. Incorporates insights from the dark web and emerging fraud tactics. Continuously retrains models without disrupting performance.

Every card payment on Stripe goes through a machine learning system that makes a fraud decision in under 100 milliseconds. $400 million in fraud blocked last year. 1,000+ features evaluated per transaction. And you never see it happen. Here's the architecture: → Payment request arrives → Feature extraction: card metadata, device fingerprint, behavioral signals, network signals, velocity patterns → 80% of first-time cards have already been seen elsewhere on Stripe's network → Payments Foundation Model: a transformer trained on billions of financial transactions — not text, but payment sequences → Risk score generated → Decision: block, allow, or review → All in <100ms The Foundation Model is the breakthrough. Detection rate jumped from 59% to 97% overnight. It reads financial behavior the way GPT reads English. But the most elegant part? Similarity learning for fraud rings. Individual fraudsters are easy. Fraud RINGS are hard. Stripe's ML generates similarity scores between accounts — email domain overlap, shared card numbers, text similarity. Graph analysis finds connected clusters. One caught → entire ring exposed. And the network effect: fraud pattern on merchant A instantly protects merchant B. Every merchant on Stripe makes every other merchant safer. I decoded the full architecture — from payment request to fraud decision — in a visual breakdown. Swipe through. This is ML at its most consequential. Which Stripe pattern could you apply to your product? 👇 ### Sources - [The Engineering Behind Stripe's Fraud Detection (Quastor)](https://lnkd.in/gabvgG63) - [How We Built It: Stripe Radar (Stripe Dev Blog)](https://lnkd.in/gDs62-pT) - [Stripe's Payments Foundation Model (Medium)](https://lnkd.in/gXJGJGWA) - [A Primer on ML for Fraud Detection (Stripe Blog)](https://lnkd.in/gM5wUkT7) - [Stripe Built a Payments LLM to Fight Fraud (AI Street)](https://lnkd.in/ghPp-pzY)

How Small Transactions Slip Past Detection Instead of draining accounts all at once, many use a “low-and-slow” approach — making small, frequent transactions just below the detection threshold to quietly evade fraud systems. In the screenshots below, a fraud seller instructs buyers to stay within certain limits when using stolen cards, even sharing chats with customers who successfully performed the fraud. This clearly shows their awareness of how financial institutions detect suspicious activity. In the past, I’ve identified such patterns by aggregating small transactions over short time windows and flagging repeated micro-payments to the same merchants. To mitigate: ✅ Use rolling-window velocity rules ✅ Implement step-up authentication ✅ Alert customers for unusual small-value transactions Even subtle patterns can expose major fraud operations — we just need to look closer. Stay vigilant and enhance your detection strategies to identify these fraudsters early.

Revolutionizing Fraud Detection: The Power of Agentic AI for a Safer Financial Ecosystem Agentic AI is transforming the fight against financial fraud. This isn't just about faster alerts; it's about building an autonomous, intelligent defense system that can reason, investigate, and act with unprecedented precision. Traditional fraud detection often relies on static rules or single-model predictions. Agentic AI elevates this by orchestrating a team of specialized 'agents,' each contributing to a dynamic, closed-loop workflow to identify and mitigate threats in real-time. Here’s a simplified look at how an Agentic AI workflow can detect a fraudulent transaction: 1. Initial Anomaly Detection & Flagging Our journey begins the moment a transaction occurs. A dedicated Surveillance Agent continuously monitors all incoming transaction streams. It uses advanced machine learning models to identify deviations from normal behavior – large sums, unusual locations, frequent transactions, etc. If something looks suspicious, it's immediately flagged. 2. Deep Dive Investigation & Contextualization Once flagged, a Forensic Agent springs into action. This agent doesn't just look at the transaction in isolation. It pulls in a wealth of contextual data Customer's historical spending patterns Geo-location data and previous travel history Device fingerprinting Known fraud indicators and blacklists Social media footprint (if permitted and relevant) The Forensic Agent correlates these disparate data points, building a comprehensive picture to determine the likelihood of fraud. 3. Autonomous Decision & Action With a high likelihood of fraud established, the Governance Agent takes over. This agent is pre-programmed with our organization's risk policies, regulatory requirements, and decision matrices. It autonomously decides on the most appropriate action: Block the transaction Place a temporary hold on the account Request immediate multi-factor authentication from the customer Initiate a human review for complex cases (Human-in-the-Loop) This is where the 'action' in Agentic AI truly shines, enabling real-time mitigation.

From Data to Defense: Solving Fraud Detection in Interviews Case: “You are a data scientist at a payments app (like Paytm/PhonePe). The company wants to detect fraudulent transactions in real time. How would you approach this?” 1. Clarify the problem • What types of fraud are we targeting? (stolen cards, identity theft, money laundering, fake accounts). • Is the goal to block transactions instantly (real-time) or flag them for review? • What data is available? (transaction logs, device info, geo-location, user history). 2. Define success metrics • Precision → minimize false positives (don’t block genuine users). • Recall → catch as much fraud as possible. • Business KPIs → fraud loss prevented, user trust maintained, minimal customer drop-offs. 3. Hypothesize causes of fraud • Sudden spike in high-value transactions from a new device. • Same card used in two different cities/countries within minutes. • Multiple failed login/payment attempts (brute-force). • Many small, rapid-fire transactions (“smurfing”) to bypass limits. 4. Plan the analysis • EDA → study transaction distributions, outliers, velocity, device/IP patterns. • Segmentation → compare normal vs suspicious users. • Graph analysis → link accounts, devices, cards to uncover fraud rings. • Unsupervised ML → anomaly detection when labels are scarce. 5. Design solutions • Start with rule-based checks (geo-location mismatch, unusual amounts). • Add supervised ML models (logistic regression, tree-based models, neural nets) trained on labeled fraud data. • Use unsupervised/anomaly detection (Isolation Forest, Autoencoders) for new fraud patterns. • Combine into a hybrid real-time scoring system → every transaction gets a “fraud probability” score. 6. Deployment & Monitoring • Integrate models with real-time APIs (flag/block transactions instantly). • Send suspicious cases to a manual review queue. • Continuously monitor → fraud tactics evolve, so models must retrain frequently. 7. Measure impact • Reduction in fraud losses 💰. • Maintain <1% false positive rate (keep genuine customers happy). • Track uplift in user trust & platform reliability. 💡 Interview Tip: Always highlight the trade-off → Catching fraud vs. Blocking genuine customers. This is the discussion interviewers want to hear in fintech-related case studies. -> Must-Know Interview Questions : 1. How would you balance precision vs recall in fraud detection? 2. What are the pros & cons of rule-based systems vs ML models for fraud? 3. How do you handle imbalanced datasets in fraud detection problems? 4. Can you explain real-time model serving challenges? 5. How do you prevent concept drift when fraud patterns change over time? 6. How would you use graph/network analysis in fraud detection? 7. What’s the impact of a false positive vs false negative in this scenario? #DataScience #MachineLearning #CaseStudy #FraudDetection #FinTech #Interviews #WomanInTech

A few years ago, I helped a digital payment platform that was struggling with increasing transaction fraud. Despite having decent security measures in place, they were facing a surge in fraudulent transactions, especially from new users. The main challenge was detecting and preventing fraud in real-time, without affecting the overall user experience. The company needed a more effective, data-driven solution. Detecting and Preventing Transaction Fraud Using Data Analytics 1️⃣ Analyzing Transaction Patterns We began by diving into historical transaction data to identify suspicious patterns. We focused on factors such as transaction frequency, amounts, geographical locations, and device types. Using SQL, we aggregated and analyzed the data to find potential fraud indicators. SELECT user_id, AVG(transaction_amount) AS avg_transaction_amount, COUNT(transaction_id) AS transaction_count, COUNT(CASE WHEN fraud_detected = 1 THEN 1 END) AS fraud_count FROM transactions GROUP BY user_id; 🔹 Insight: We found that certain users were making unusually frequent and large transactions from unfamiliar locations, which raised concerns about possible fraudulent behavior. 2️⃣ Building a Fraud Detection Model Next, we built a fraud detection model using machine learning. We included features such as transaction volume, transaction type, user history, and location. This model was trained on the historical data to predict fraudulent transactions more effectively. # Pseudocode for Fraud Detection Model def fraud_detection(transaction_data): model = train_fraud_model(transaction_data) predictions = model.predict(transaction_data) return predictions 🔹 Insight: Using machine learning allowed us to accurately flag fraudulent transactions before they were processed, minimizing financial risk. 3️⃣ Real-Time Fraud Prevention To maintain a smooth user experience, we implemented real-time fraud detection directly in the payment gateway. Suspicious transactions triggered a verification prompt for users, such as two-factor authentication (2FA), to confirm their identity. # Pseudocode for Real-Time Fraud Prevention def real_time_fraud_prevention(transaction): if model.predict(transaction) == 'fraud': prompt_user_for_2FA(transaction) else: process_transaction return transaction_status 🔹 Insight: This approach helped us prevent fraud without delaying transactions for legitimate users. Challenges Faced False positives where legitimate transactions were flagged as fraud, causing unnecessary friction for users. Limited data for new users, making it harder to detect fraud accurately. Balancing security and user experience, ensuring real-time fraud detection didn’t disrupt the transaction process. Business Impact ✔ The number of fraudulent transactions decreased, helping to reduce overall financial losses.