Drift Under Pressure

In one line: you cannot monitor fraud detection by watching the fraud rate, because the fraud rate is the metric that arrives last.

The monitoring problem, stated

Every other system in this course can measure whether it is working. Click-through arrives in seconds, relevance judgements can be commissioned, revenue is on a dashboard.

Here the ground truth is a chargeback that lands in six weeks. If the model broke this morning, the metric that would tell you is a month and a half away.

So the monitoring has to be built on leading indicators — things that move before the labels arrive.

The leading indicators

Five, in roughly the order they move.

Score distribution. The shape of the model's outputs, compared to a recent baseline. A shifted distribution means the input population changed or the model is behaving differently, and it moves within minutes. This is the single most valuable fraud monitoring signal.

Decision rates. Approve, challenge and decline proportions. A rising decline rate with no corresponding fraud signal is over-blocking; a falling one may be an attack that has learned to look normal.

Feature drift. Distribution of key inputs, per segment. A feature that suddenly goes null is an upstream break, and the model will happily score around it with no error raised.

Rule fire rates. A rule that fired a hundred times a day and now fires ten thousand is either an attack or a bug, and both need attention within the hour.

Challenge pass rate. A drop suggests attackers are reaching the challenge band; a rise suggests you are challenging people who should have been approved.

The signal that is misread

The one worth being ready for, because it is counterintuitive and interviewers like it.

A sudden drop in detected fraud is usually bad news.

The comfortable reading is that the defences improved. The likelier readings: an upstream feature broke, so the model cannot see the signal; the attackers found a path that does not trigger anything; or the fraud moved to a channel nobody is counting.

Genuine improvement is gradual, because attacks stop gradually. A step change downward is almost always a measurement failure rather than a defensive success.

Retraining cadence

Set by the adversary rather than the calendar, which means it cannot be a fixed schedule.

The useful trigger set:

Score distribution shift beyond a threshold against the reference window.

A new attack pattern confirmed by analysts — retrain to incorporate it rather than waiting.

Performance decay on whatever labels have matured, which is the slowest and most reliable signal.

Elapsed time as a floor, so the model does not go stale during a quiet period.

Two constraints on how fast you can go. Retraining more often than labels mature means training on increasingly incomplete data, so there is a floor set by the label horizon. And frequent retraining against a probing adversary risks chasing them — reacting to a pattern that was itself a probe, which is a form of overfitting to the attacker's exploration.

Detecting what you have never seen

Supervised models learn the fraud in their training data, so a genuinely novel attack has no representation. Two complements, both imperfect.

Anomaly detection on the population. Flag transactions unlike anything normal, without reference to labels. Catches novelty and produces a great deal of noise, because unusual and fraudulent are different properties — a legitimate customer doing something rare is exactly what it flags.

Anomaly detection on the entity. Much better, and less commonly proposed. Compare this account's behaviour to its own history rather than to the population. A customer who has bought a coffee weekly for two years and suddenly attempts a large electronics purchase from a new device is anomalous relative to themselves, which is a far more specific signal than being unusual in general.

That per-entity framing is the right answer for account takeover, where the account's own history is the baseline and the population's is irrelevant.

Neither should decide alone. Route anomalies to the challenge band or to analyst review rather than to an automatic decline, because an unsupervised flag has no notion of cost.

The human loop

Analysts are the fastest detector of genuinely new patterns, and the design point is to make their findings actionable rather than anecdotal.

Three mechanisms worth naming: a queue prioritised by expected loss rather than by score, so attention goes where money is; a fast path from a finding to a rule, because an analyst who spots a pattern at 2am needs to act on it before the model can be retrained; and structured capture of what they found, so it becomes a feature or a labelled set rather than a note in a ticket.

The failure mode is an analyst team that catches patterns nobody encodes, so the same attack is rediscovered every few months.

Attack simulation

The proactive version, and it is the fraud equivalent of red teaming.

Have a team attempt to defeat the system deliberately: probe thresholds, test which signals matter, look for paths through. It finds boundaries before an attacker sells them, and it produces exactly the regression cases the test suite needs.

The finding that matters most is not "we got a fraudulent transaction through" but which layer should have caught it and did not — because that points at an architectural gap rather than a threshold to nudge.

Next: explaining a decline to the person you declined.