The Adversary Responds

In one line: a recommender's data drifts because the world moves, and a fraud system's data drifts because someone is watching your decisions and adjusting.

The difference that changes everything

A ranking model degrades slowly as tastes shift. Nobody is trying to make it degrade. Retrain periodically and the problem is managed.

A fraud model degrades because a person is probing it. They submit transactions, observe which are approved, and infer where your boundary sits. Then they move to the other side of it. Your model is not becoming stale — it is being mapped.

Three consequences, and each inverts an instinct that serves you well elsewhere.

Consequence one: your best model degrades fastest

The better a model is, the more precisely it defines a boundary, and the more valuable it is to find that boundary and step over it. A crude model with a fuzzy boundary is harder to map than a sharp one.

That does not mean building worse models. It means the value of a fraud model is a decaying asset from the moment it ships, and the system must be built to replace it continuously rather than to perfect it once.

It also argues for some deliberate unpredictability — randomised thresholds on a slice of traffic, or an ensemble whose composition rotates — so probing returns a noisy answer rather than a clean one.

Consequence two: catching more can be worse

Block one attack pattern completely and the fraud does not stop. It moves — to a different channel, a different product, a different technique — and you have converted an attack you could see into one you cannot.

So a fraud metric that improves may mean the defence worked, or it may mean the attack relocated to somewhere you are not measuring. Distinguishing those requires watching total loss across all channels, not the block rate on the one you just improved.

Consequence three: every rule you ship is published

Not literally — but a determined attacker learns it within days, by testing.

Decline every transaction over £500 from a new account and you will not see fraud over £500 from new accounts. You will see a great deal at £499. The rule did not stop the fraud; it specified the fraud's parameters.

This is the strongest argument for models over pure rules, and it is more subtle than "models are more accurate". A model with hundreds of interacting features has a boundary that is expensive to map. A threshold on one field is a single experiment to discover.

The practical version is that hard thresholds on a single observable field are the most probeable thing you can build. Where you need one — and sometimes you do — soften the edge or randomise it slightly, so the boundary cannot be located by bisection.

What stays the same

Worth saying, because the adversarial framing can be over-applied.

The overwhelming majority of transactions are not adversarial at all. Legitimate customers vastly outnumber attackers, and most of a fraud system's decisions are about ordinary people doing ordinary things. A design that treats every transaction as an attack produces so much friction that the fraud losses become the smaller problem.

The adversary matters for how you maintain the system — the retraining cadence, the monitoring, the resistance to probing. It does not mean paranoia at the level of the individual decision.

The three parties, again

Like ads, this is not a two-party system, and the three interests conflict in a specific way.

The asymmetry that catches teams: fraud losses are measured precisely and appear on a report with someone's name on it, while declined legitimate customers are invisible. Nobody files a ticket saying "I tried to buy something and you would not let me." They just leave.

So the organisational pressure runs one way, and a fraud team optimising only what it can measure will over-block indefinitely without anyone noticing.

That is the same shape as the over-refusal problem in a guardrail system, and it is worth recognising as a recurring pattern: whenever one error is counted and the other is not, the threshold drifts toward the counted one.

What to open with

The framing that sets up the rest of the interview:

Three things make this different from the ranking problems. There's an adversary who responds to what I deploy, so the model is a decaying asset and the retraining cadence is set by them rather than by a calendar. The two errors cost completely different amounts, so the threshold is a business decision rather than a modelling one. And I only ever learn the outcome of transactions I approved — anything I declined has no label, forever.

That third point is the deepest and gets its own lesson. Naming it early signals that you know where the real difficulty is.

Next: scoping, and the cost matrix that sets your thresholds.