Fraud Detection & Anomaly Learning — How AI Catches Financial Crime

When you tap a card at a checkout, a risk model usually scores the payment before the terminal shows "approved." It looks at the amount, the merchant, your recent history, the device, and the location, and it decides in a fraction of a second whether to approve, challenge, or decline. This is AI fraud detection in practice. This article explains how those systems are built, why rarity makes the problem hard, which models do the work, and why growing scams are changing what detection has to look for.

Educational only, not financial advice. This article describes how fraud-detection technology works. It does not recommend any product, bank, or financial decision.

Key takeaways

• Scale of the problem: US consumers reported $15.9 billion in fraud losses to the Federal Trade Commission (FTC) in 2025, and the FBI's Internet Crime Complaint Center (IC3) logged $20.877 billion in total reported losses for the same year.
• Rarity is the core difficulty: In a well-known public card dataset, only 0.172 percent of transactions are fraud, so a model that approves everything is 99.8 percent "accurate" and useless.
• Two families of models: Supervised models learn from labeled fraud cases. Unsupervised models, such as isolation forests and autoencoders, flag transactions that look unusual without needing labels.
• False positives are a design trade-off: Catching more fraud means challenging more legitimate customers. Where to set the threshold is a business and fairness decision, not a purely technical one.
• The target is moving: Card fraud is only part of the picture. Scams in which the customer authorizes the payment, such as investment scams and impersonation, produce transactions that look normal to a transaction model.

How big is the fraud problem?

Fraud numbers are hard to compare because every source counts something different: consumer reports, bank losses, card-network data, or law-enforcement complaints. The table below collects the main public series and says what each one measures.

Source	What it measures	Figure	Year
FTC Consumer Sentinel	Losses reported by US consumers	$15.9 billion, from 3 million reports	2025
FBI IC3	Losses reported to the FBI's cybercrime complaint center	$20.877 billion, from 1,008,597 complaints	2025
Nilson Report	Global card fraud losses	$33.83 billion, or 6.58 cents per $100 of card volume	2023
UK Finance	UK payment fraud losses (all types)	£1.28 billion, up 4%	2025

Sources: FTC testimony to the Joint Economic Committee, March 25, 2026; FBI Internet Crime Report 2025; Nilson Report; UK Finance.

Three details help put these numbers in context.

First, reported losses are a floor. The FTC says its reported losses are "just a fraction" of actual losses, and it has estimated that the overall cost of fraud to US consumers in 2024 could be as high as $195.9 billion once underreporting is taken into account. The statement cites academic research showing that only 4.8 percent of victims of mass-market fraud complained to a Better Business Bureau or a government entity.

Second, the trend is upward. The FTC reports that consumers reported losing more than $6 billion in 2021, nearly $9 billion in 2022, over $10 billion in 2023, and over $12 billion in 2024. IC3's reported losses rose 26 percent from 2024 to 2025, and its chart shows $16.6 billion in 2024.

Third, card fraud is no longer the main story in the consumer data. Nilson's global card fraud figure of $33.83 billion sounds large, but it equals 6.58 cents for every $100 of card volume, or roughly one dollar in 1,500 (author's arithmetic). In the FTC's 2025 data, the largest losses came from investment scams, at over $7.9 billion and about half of all reported losses, followed by imposter scams at over $3.5 billion. Consumers reported losing the most money by sending it to scammers through bank payments, followed by cryptocurrency, while credit cards were the most frequently identified payment method.

That distinction shapes everything below. A stolen card number used without the owner's knowledge is an unauthorized fraud, and transaction models are built to catch it. A victim who is talked into sending a bank transfer has authorized the payment, and the transaction itself can look entirely ordinary.

Why rare events break ordinary machine learning

Fraud detection is a needle-in-a-haystack problem. The most widely used public benchmark is a dataset of credit card transactions made by European cardholders over two days in September 2013. According to the dataset's Zenodo record, it contains 492 fraudulent transactions out of 284,807, so fraud is about 0.172 percent of the records. Most input features are anonymized principal components, a mathematical compression applied to protect confidentiality.

With a base rate that low, the usual accuracy metric misleads. A model that labels every transaction "legitimate" would be right 99.83 percent of the time while catching nothing. That is the accuracy paradox, explained further in why 99% accuracy can be useless. Fraud teams track precision (of the transactions flagged, how many were really fraud) and recall (of all fraud, how much was caught) instead.

The base-rate arithmetic

The most counterintuitive consequence is that even a very good detector produces mostly false alarms. The table below uses the dataset's 0.172 percent base rate and assumes the detector catches 90 percent of fraud. The numbers are the author's arithmetic for illustration, applied to 1 million transactions, not measurements from any bank.

False-positive rate	Fraud caught (of 1,720)	Legitimate transactions flagged	Share of flags that are real fraud (precision)
1%	1,548	9,983	13.4%
0.5%	1,548	4,991	23.7%
0.1%	1,548	998	60.8%
0.01%	1,548	100	93.9%

At a 1 percent false-positive rate, roughly seven of every eight flagged transactions are legitimate, even though the model catches 90 percent of the fraud. This is why fraud teams push false-positive rates down by orders of magnitude, and why a model's headline detection rate says little without the false-positive rate next to it.

An analogy helps. Imagine a smoke alarm that goes off whenever the kitchen is warm. It will never miss a fire, and you will stop trusting it within a week. A fraud model has the same problem at industrial scale. Each false alarm costs a customer's time and the bank's goodwill, and enough of them make customers change banks.

What happens when a payment is scored

A modern fraud system is a pipeline. Each payment triggers a sequence of steps that must finish in milliseconds because the shopper is waiting.

1. Collect the event. Amount, merchant, merchant category, channel (in person or online), device, time, and location.
2. Enrich it with history. Past behavior of this card or account, and aggregate behavior of this merchant or device across many customers.
3. Compute features. Raw fields are turned into signals such as transaction counts in the last hour, distance from the last purchase divided by elapsed time, and whether the merchant is new to this customer.
4. Score with one or more models. The output is a risk score, usually between 0 and 1.
5. Apply decision logic. Business rules, regulatory checks, and thresholds convert the score into an action.
6. Act and learn. The result is logged, and later confirmed outcomes, such as a customer dispute, become training labels.

The decision logic usually has more than two outcomes. A typical design has an approve band, a "step-up" band that asks for extra verification such as a one-time code, a review band where an analyst looks at the case, and a decline band. The exact cutoffs vary by institution and are tuned to the cost of fraud against the cost of friction.

Features that carry the signal

Feature engineering, the craft of turning raw data into informative inputs, often matters more than the choice of model. Common examples include:

• Velocity: how many attempts occurred recently. Criminals often test stolen card numbers with a burst of small purchases.
• Geographic plausibility: a purchase in one city, followed minutes later by another in a distant city.
• Deviation from the customer's own pattern: unusual merchant category, unusual hour, or an amount far from the customer's typical range.
• Device and session signals: new device, mismatched billing details, or automated-looking input behavior.
• Network signals: a device or address linked to many accounts.

What makes each of these useful is context. A $2,000 electronics purchase is routine for one customer and alarming for another, which is why the best features compare a transaction against the customer's own baseline. For a broader look at the engineering step, see what feature engineering means.

Supervised models: learning from labeled fraud

When a bank has labeled history, meaning transactions later confirmed as fraud or legitimate, it can train a supervised model. The usual choices are gradient-boosted decision trees, such as XGBoost, and neural networks. Trees remain popular for tabular data like transactions because they train quickly, handle mixed feature types, and offer a natural route to explanation; XGBoost explained covers how they work.

Neural networks come into their own when the input is a sequence. Visa's March 2024 announcement of Visa Deep Authorization, a risk-scoring tool for online card payments, says the model is powered by a deep learning recurrent neural network and "petabytes of contextual data." A recurrent network reads a sequence of events, such as a customer's recent transactions, and keeps a running summary of what it has seen, much as you read a sentence word by word while remembering the start.

Supervised learning has three well-known weaknesses in this domain:

• Delayed labels. The truth about a transaction often arrives days or weeks later, when a customer disputes it. The model is always learning from the past.
• Censored feedback. If the system declines a transaction, nobody ever learns whether it was actually fraud. Labels exist only for transactions that were approved, which biases the training data toward the cases the old model already trusted.
• Novel attacks. A model can only learn patterns that appear in its labeled history. Tactics that are new since the last training run look like ordinary activity.

Unsupervised models: finding what looks unusual

Unsupervised methods look for transactions that do not fit the pattern of the rest, without needing labels. They are valuable at the start of a new product, for new attack types, and for crimes such as money laundering where confirmed labels are scarce.

Isolation forests

An isolation forest works from a simple observation: unusual points are easy to separate from the crowd. The method, introduced by Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou at the 2008 IEEE International Conference on Data Mining, builds many random trees. Each tree picks a random feature and a random split value, then repeats until a point is alone. Per the scikit-learn documentation, random partitioning produces noticeably shorter paths for anomalies, so points that are isolated after only a few splits receive high anomaly scores.

A useful picture is a game of Twenty Questions. If you are looking for one person in a stadium, "Is the person on the field?" isolates the person quickly if they are a player in a crowd of spectators. Ordinary spectators need many more questions before you are down to one. The number of questions is the path length, and a short path means "unusual."

Each tree in scikit-learn's implementation is built on a small random subsample, capped at 256 points by default, which keeps the method fast on large datasets. The main limitation is conceptual. Isolation forests find points that are statistically rare, and rare is not the same as fraudulent. A customer's once-a-year jewelry purchase is rare and legitimate.

Autoencoders

An autoencoder is a neural network trained to compress an input into a small internal representation and then reconstruct it. Trained mostly on normal transactions, it learns what normal looks like. When it meets an unusual transaction, the reconstruction is poor, and a high reconstruction error becomes the anomaly score.

The idea is similar to an artist who has drawn thousands of faces. Ask them to sketch a typical face from a few remembered features and the result is close. Ask them to sketch something unusual from the same few features and the sketch drifts. The size of the drift is the signal. Like isolation forests, autoencoders flag the unusual, not the fraudulent, and they need careful thresholds and monitoring.

Peer groups and clustering

Another family compares a customer with similar customers. Clustering groups accounts that behave alike, and a transaction that is normal for the whole population but strange for a customer's peer group can be flagged. The appeal is explainability: an analyst can be told that a case is unusual relative to a stated comparison group.

Comparing the approaches

Approach	Needs labels?	Good at	Weak at
Gradient-boosted trees	Yes	Known fraud patterns on tabular data; speed; explanation	New attack types; delayed or biased labels
Neural networks (including recurrent)	Yes	Sequences of behavior; complex interactions	Explanation; data and compute requirements
Isolation forest	No	Fast screening for statistically rare points	Rare but legitimate behavior
Autoencoder	No (mostly normal data)	Complex patterns of "normal"	Threshold choice; drift in what normal means
Graph models	Often	Rings of linked accounts; money flows	Data completeness; heavy engineering

In practice, institutions combine them. A supervised model handles known patterns, an anomaly detector watches for the unfamiliar, and rules enforce hard policy.

Graph methods and money laundering

Fraud detection looks at single transactions. Money laundering, which disguises the origin of criminal proceeds, is about relationships: who sends money to whom, how fast, and through how many hops. Investigators draw this as a graph, with accounts as nodes and payments as edges.

The most cited public benchmark for this task comes from the cryptocurrency world. In 2019, Mark Weber and colleagues described the Elliptic Data Set on arXiv: a time-series graph of over 200,000 Bitcoin transactions, 234,000 directed payment flows, and 166 features per node, which the authors believed to be the largest publicly available labeled transaction dataset in any cryptocurrency. They compared logistic regression, random forests, multilayer perceptrons, and graph convolutional networks at classifying illicit transactions. Random forest performed best, and the authors suggested combining it with graph methods.

That result is worth remembering. Graph neural networks are fashionable, but on this benchmark an older, simpler method won, which is a reminder that more complex models do not automatically perform better. The same paper notes that anti-money-laundering rules are expensive for institutions and can shut out people on economic or international margins, a reminder that false positives have a human cost beyond the bank. For more on how machine learning supports compliance work, see AI and blockchain in financial crime compliance.

Graph methods also help with fraud rings. If many new accounts share a device, an address, or a payout destination, the link between them can be more telling than any single transaction. Detecting a ring early, before it has spent the accounts, is one of the clearest wins for graph analysis.

Reading vendor claims about AI fraud prevention

Card networks and vendors publish impressive figures, and they deserve careful reading. In its March 27, 2024 press release, Visa said that it "helped block $40 billion in fraudulent activity, nearly double from the year prior," with a footnote specifying the period from October 1, 2022 to September 30, 2023. The release also cited "$10 billion over the last five years alone in technology and innovation" to reduce fraud and strengthen network security. The figures come from Visa's own announcement.

That is a useful data point, but several questions are left open by a figure like this:

• "Blocked" is not "prevented loss." The figure counts the value of attempted fraudulent activity that was declined. It does not say how much would have succeeded without the system, nor how many legitimate payments were declined.
• No denominator. Without the total volume and the false-positive rate, a headline number cannot be turned into a detection rate.
• Self-reported. The figure comes from the company that sells the service. No independent audit is cited in the release.
• Attribution. A system built from rules, models, authentication, and human review does not credit any single component.

None of this means the claim is wrong. It means a dollar total is a statement about scale, not about accuracy. The same caution applies to any widely quoted "99 percent" detection rate: unless the false-positive rate, the time window, and the definition of fraud are stated, the figure cannot be interpreted.

The arms race: drift, adversaries, and the move to scams

Concept drift

Fraud patterns change because criminals watch what works. When a detection model starts catching one tactic, the tactic changes. Machine learning calls this concept drift: the relationship between the inputs and the label shifts over time, so a model trained on last quarter's data gradually becomes less accurate. Fraud teams respond by monitoring performance continuously and retraining on fresh data. The general problem is explained in what model drift means in production.

Adversaries probe the system

Unlike spam or image recognition, fraud has an opponent who responds. Criminals can probe a system with small purchases to learn which behaviors pass, then scale up. This is why defenders avoid publishing exact thresholds and why they combine many weak signals instead of relying on one strong one. The data show the contest shifting: IC3's 2025 report includes a category of complaints with an "AI related" descriptor, at 22,364 complaints and $893 million in losses, which indicates that criminals are using the same class of tools defenders do. For one example of how synthetic media enters the picture, see what deepfakes are and how they work.

The shift from stolen cards to persuaded customers

The more important change is where the money is being lost. In the IC3's 2025 data, investment fraud accounted for $8.65 billion of reported losses and business email compromise for $3.05 billion across 24,768 complaints, while the credit card and check fraud category totaled $283 million across 18,774 complaints. Complaints with a cryptocurrency descriptor were associated with $11.4 billion in losses. These are different measures from card-network data, so they should not be added together, but the contrast is clear.

In business email compromise, an attacker impersonates a vendor or executive and persuades an employee to send a payment. In an investment scam, the victim is convinced to move money voluntarily. The bank's model sees an authenticated customer on a known device sending a payment to a new recipient. That might raise a flag, but customers send money to new recipients every day.

UK Finance's 2026 report gives the UK picture: criminals stole £1.28 billion through payment fraud in 2025, up four percent. Detecting scams of this kind requires different signals, such as unusual urgency, the recipient account's history, a sudden change in the customer's behavior, and sometimes a direct conversation with the customer. It also requires information the bank does not hold, which is why scam prevention increasingly involves telecom and technology companies as well as banks. For the human side of why people fall for these schemes, see scam psychology: the red flags that actually work.

False positives, fairness, and explainability

Who bears the cost of a false alarm?

Every threshold sets a trade-off. Lower it, and more fraud is caught but more legitimate customers are interrupted. Raise it, and the reverse. Because the cost of a missed fraud and the cost of a false alarm differ by customer, merchant, and payment type, institutions often use different thresholds for different segments. That raises a fairness question: whether the burden of friction falls evenly. Fraud models trained on historical labels can inherit patterns from how past cases were investigated, and the censored-feedback problem described earlier makes such bias hard to see. Responsible teams measure false-positive rates across customer groups and review features that act as proxies for protected characteristics.

Explaining a decision

Customers and regulators want to know why a transaction was blocked. For tree ensembles and neural networks, a common technique is SHAP, introduced by Scott Lundberg and Su-In Lee, which assigns each input feature an importance value for an individual prediction. The authors define a class of additive feature importance measures and show that one solution within it has desirable properties. A SHAP-style explanation might say that a block was driven mainly by a burst of transactions and a first-time merchant. Such explanations are approximations of the model's behavior, not the model's literal reasoning, and they need validation.

On the legal side, Article 22 of the EU's General Data Protection Regulation gives people a right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, with exceptions for contract necessity, law, or explicit consent. Even where exceptions apply, the safeguards must at least include the right to obtain human intervention. Whether a given fraud block counts as a "similarly significant" effect is a legal question that varies by case. In the United States, bank supervisors expect institutions to manage the risk of models through validation and oversight, under model risk management guidance the Federal Reserve issued on April 4, 2011.

Privacy and data sharing

Fraud rings operate across institutions, but customer data cannot simply be pooled. Privacy-preserving techniques such as federated learning, where models are trained across institutions without centralizing raw data, are an active area of work. Public evidence about how widely such methods are deployed is thin, so claims of broad adoption should be treated cautiously.

What the next few years may bring

Three developments are visible in the data, though their pace is uncertain.

More behavior-based signals. As authorized scams grow, banks look more closely at how a customer interacts with a session, not only at the payment, and at whether the customer seems rushed or coached. This raises privacy questions that regulators will weigh.

More synthetic media. Voice cloning and generated documents make impersonation cheaper. The IC3's AI-related complaint category is small beside its total but is a direct measure to watch.

More cross-industry cooperation. The FTC's statement notes that its Consumer Sentinel database combines reports from nearly 180 data sources, including law enforcement, and that Apple, LinkedIn, MoneyGram, Western Union, and Zelle send reports to the FTC or host referral links. Sharing of this kind, at scale, is one way defenders can match criminals who already operate across borders and platforms.

None of these developments guarantees a winner. Fraud detection is a contest in which each improvement changes the opponent's behavior, so progress shows up as a moving balance rather than a final result.

Common misconceptions

"AI catches nearly all fraud." Public data do not support any universal detection rate. Reported losses keep rising in the FTC and IC3 series, and the FTC says reported losses understate the total. Vendors' blocked-fraud figures describe attempts declined, not the share of all fraud stopped.

"A high accuracy number means a good model." With a base rate of 0.172 percent, accuracy is almost meaningless. Precision, recall, and the false-positive rate matter.

"Anomaly detection finds fraud." Anomaly detection finds the unusual. Some unusual behavior is fraud, and much of it is an ordinary customer doing something rare.

"More complex models always win." On the Elliptic benchmark, random forest beat the graph neural network the authors tested. Complexity helps only when the data and the problem reward it.

"Fraud is mostly stolen cards." In consumer-reported losses, investment and impersonation scams dominate, and the payments involved are often ones the victim authorized.

Frequently asked questions

Q: How does AI detect credit card fraud? A: A model scores each payment using signals such as amount, merchant, device, location, and the customer's recent behavior, usually in milliseconds. Supervised models learn from past confirmed fraud, while anomaly detectors flag unusual activity. A decision layer then approves, challenges, reviews, or declines the payment depending on the score and business rules.

Q: What is anomaly detection in fraud prevention? A: Anomaly detection looks for transactions that differ from normal behavior without needing labeled fraud examples. Isolation forests isolate rare points with few random splits, and autoencoders flag inputs they cannot reconstruct well. The output is a measure of unusualness, which analysts or other models then judge.

Q: Why do legitimate transactions get declined? A: Fraud is rare, so even an accurate model flags many legitimate payments. In the author's illustration using a 0.172 percent fraud rate and a 90 percent detection rate, a 1 percent false-positive rate means only about 13 percent of flags are real fraud. Institutions tune thresholds to balance missed fraud against customer friction.

Q: Can AI stop authorized push payment scams? A: Only partly. In these scams the customer approves the payment, so transaction signals look normal. Detection relies more on the recipient account, behavior changes, and direct warnings to the customer. UK Finance reported £1.28 billion in total UK payment fraud losses in 2025, and the FTC's data show bank payments produced the largest aggregate losses, followed by cryptocurrency.

Q: How much money is lost to fraud each year? A: It depends on the source. US consumers reported $15.9 billion to the FTC in 2025, the FBI's IC3 recorded $20.877 billion in reported losses, and Nilson put global card fraud losses at $33.83 billion in 2023. The FTC estimates the true cost to US consumers could be as high as $195.9 billion for 2024.

Q: Are fraud models biased? A: They can be. Models learn from historical labels, and when past investigations or declines were uneven, the model can reproduce that pattern. Declined transactions also produce no label, which hides errors. Teams reduce the risk by measuring error rates across customer groups and reviewing proxy features, though no method removes it entirely.

The takeaway

AI fraud detection works less like a single clever algorithm and more like a layered system: fast feature pipelines, supervised models for known patterns, anomaly detectors for the unfamiliar, graph analysis for networks, and decision rules that balance cost against friction. Its hardest problems are statistical and human rather than technical. Rare events make false alarms inevitable, criminals change tactics in response to every defense, and the fastest-growing losses involve customers who approve the payments themselves. The practical lesson for anyone reading a claim about AI and fraud is to ask for the denominator, the false-positive rate, and the time window before accepting a number.

Sources

• FTC prepared statement, The Rising Scam Economy, Joint Economic Committee, March 25, 2026
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report
• Nilson Report, Card Fraud Losses Worldwide in 2023
• UK Finance, Annual Fraud Report 2026
• Visa press release, Visa's Growing Services Business Infused with New AI-Powered Products, March 27, 2024
• Credit Card Fraud Detection dataset (ULB/Kaggle), Zenodo record
• scikit-learn documentation: IsolationForest
• Weber et al., Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics, arXiv:1908.02591
• Lundberg and Lee, A Unified Approach to Interpreting Model Predictions (SHAP), arXiv:1705.07874
• General Data Protection Regulation, Article 22
• Federal Reserve, SR 11-7, Guidance on Model Risk Management

---

Read next:

• Algorithmic Trading & Neural Networks — How AI Makes Billions Per Second
• AI in Bank Risk Management: Smarter Stress Tests or Dangerous Blind Spots?
• Reinforcement Learning for Portfolio Optimization: Teaching AI to Invest
• Machine Learning in Cybersecurity: How AI Detects Intrusions Before Humans Can