# Credit card fraud detection - anomaly detection based on amount of money to be withdrawn?

I am trying to figure out how the amount of money that a customer would want to withdraw on an ATM tell us if the transaction is fraudulent or not.There are other attributes, of course, but now I would want to hear your views on the amount of money that the customer wants to withdraw.

Data may be of this form:

Let us assume that a customer, for ten consecutive transactions, withdrew the following amounts:

100.33, 384 , 458, 77.90, 456, 213.55, 500 , 500, 300, 304.

Questions:

1. How can we use this data to tell if the next transaction done on this account is fraudulent of not?

2. Are there specific algorithms that can be used for this classification?

What I was thinking:

I was thinking to calculate the average amount of money, say for the last ten transactions, and check how far is the next transaction amount from the average. Too much deviation would signal an anomaly. But this does not sound much, does it?

## 5 Answers

I was thinking to calculate the average amount of money, say for the last ten transactions, and check how far is the next transaction amount from the average. Too much deviation would signal an anomaly. But this does not sound much, does it?

A typical outlier detection approach. This would work in most cases. But, as the problem statement deals with credit card fraud detection, the detection technique/algorithm/implementation should be more robust.

You might want to have a look at the Mahalanobis Distance metric for this type of outlier detection.

Coming to the algorithms for fraud detection, I would point out to the standards used in the industry (as I have no experience in this, but felt these resources would be useful to you).

Check my answer for this question. It contains the popular approaches and algorithms used in the domain of fraud detection. The Genetic Algorithm is the most popular amongst them.

• Well, this is the approach I been looking for; are there alternatives to this method? – Nation Chirara Oct 6 '15 at 7:20
• There seem to exist quite some fraud detection methods which use Neural Nets, Logistic Regression, etc. I have included the links in the other answer (datascience.stackexchange.com/questions/8099/…) You might want to have a look at it too. – Dawny33 Oct 6 '15 at 7:23
• Yes, as for fraud detection methods I am following the link. I was asking alternatives approaches to Mahalanobis Distance? – Nation Chirara Oct 6 '15 at 7:27
• There are quite a lot of methods, which can't fit/explained in a comment. But, it definitely qualifies as a seperate question. – Dawny33 Oct 6 '15 at 7:29

What's the underlying model of how much someone requests from an ATM? It doesn't seem like it's a simple distribution like a Gaussian, where comparing new amounts to the mean is sensible. Consider a person who always pulls out either \$40 or \$400. Ideally we want to build a distribution of what normal transactions from a user look like, and notice if new datapoints don't look like they're sampled from that distribution.

idclark's suggestion, to look at the nearest n datapoints from that user and compute the distance from just them, is a good and fast implementation of that sort of test.

One other possibility is to try to find similar users, and then aggregate data across users. If I only have 10 withdrawals from each user, I'm not going to be able to reject any new withdrawals with confidence, but if I have seven clusters of users, with a thousand withdrawals per cluster, I can notice when a user who was in a particular cluster deviates from the overall cluster distribution. (This also helps you make use of knowledge about which previous transactions were fraudulent.)

• Well, I am going for the suggested option. Two things, you mentioned about finding similar users - it is sounding like I must have my users into distinct clusters. Do I clusters them based on the range of money that they withdraw - like $0 -$200, $200 -$300, etc? And, data aggregation, may you elaborate a little here, I am lost. – Nation Chirara Oct 3 '15 at 7:25
• @Giovanrich, You can cluster them based on any similarity measure. The Mahalanobis distance, mentioned elsewhere, is the ideal measure for normal data (as it transforms out the mean and the scale but not other features of the distribution). Another thing you could do is, for every withdrawal $x_i$ from user $X$, find the closest withdrawal $y(x_i)$ from user $Y$, and the total 'distance' between them is $\sum (x_i-y(x_i))^2$ (or perhaps you'd rather take the absolute value). (Note that this distance isn't symmetric.) A discretization approach could work but I suspect it won't help too much. – Matthew Graves Oct 7 '15 at 13:30
• For aggregation, instead of comparing a new withdrawal from user $X$ to the distribution of user $X$'s past withdrawals, you use user $X$'s past withdrawals to decide they're part of cluster $A$, and you compare the new withdrawal to the distribution of cluster $A$'s past withdrawals. There might be 10 datapoints associated with user $X$, but might be a thousand datapoints associated with cluster $A$, and so we'll be able to be much more statistically confident in our comparison (which we paid for by not being as confident that cluster $A$ is relevant). – Matthew Graves Oct 7 '15 at 13:33
• Well I got what you are saying and it is making sense; but this information, where does it fall under - i mean which topics should i look into to get my feet wet? – Nation Chirara Oct 7 '15 at 13:56

I was thinking to calculate the average amount of money, say for the last ten transactions, and check how far is the next transaction amount from the average.

This sounds like a good start. I'd look into Local Outlier Probabilities. For a given data point you could calculate the distance from n nearest neighbors and figure out if the data point under consideration is an outlier.

basic overview can be found here I'd also consider the source, destination, volume and frequency of transactions as features.

• This has given me a starting point, thanks for the link I am looking into it. As for the four features - source, destination, volume and frequency of transactions, do they relate to LOP or they are other attributes I would consider for signalling a fraudulent transaction? Please, may you explain on the additional features. – Nation Chirara Oct 3 '15 at 6:42
• source, destination and frequency of transactions would be separate features. Imagine if a transaction went to a destination account that it has never gone to before, that indicate a fraudulent transaction – idclark Oct 3 '15 at 22:37

I isn't actually answering your question, but it is an idea of how you can improve it. In my opinion, I don't believe that you will be able to build a classification model with only those data. And if you do it, it will not have high enough accuracy. In your position, I would start looking for more data to use as features.

Here are a few examples:

1. ATM's code of the withdrawal. People use most of the time similar ATM in their daily routine. If you know the lat and long of their previous ATM, you can check if one of them is far away and combining it with the other features, you will increase your accuracy.
2. Seconds spent on the ATM for each withdrawal. People tend to follow specific patterns when they withdraw money. If all of their previous data are similar on the spending time and then you see lower or higher time on a data point, you will be able to increase the accuracy of the model.
3. Labeled data. In models like this, it is far better if you use supervised algorithms instead of unsupervised. Thus, I would seek for labeled data for fraud usages. This will also let you to calculate the actual accuracy of your model.
4. Time between the two withdrawals. As I said before, people tends to follow patterns. An "anomaly" on this with a sooner withdrawal than the expected will also raise your accuracy.

As far as the algorithms are concerned, I am not keen on choosing one, because it is popular. If you have done all the Data Munging and the feature selection, you have the 90% of the job and the algorithm that you will choose is 2-3 lines on the code (in case you are using a language like Python). What I usually do, is to check all the possible algorithms and evaluate their accuracy. Then I either use a combination of them or the one with the highest accuracy.

• Well, that is a good explanation indeed. I had missed two attributes, time between two withdrawals and seconds spent on the ATM for each withdrawal. As for the first feature, I am still finding some way of grouping my ATMs - Say in a town A I have ATMs A1, A2, A3,..,An. Now suppose a user regularly withdraws his money from ATM A1 - "that is his behavior", then if that user were to withdraw money from ATM A7, I would allocate a high score of suspicion to that transaction. The challenge is on how to group the ATMs or is the approach wise? – Nation Chirara Oct 3 '15 at 10:38
• The time between two withdrawals: Let's say that I made one on Thursday and one on Saturday. I had about 48 hours between the two of them. The time spend on the ATM. The seconds that I needed from the time I inserted my card to the time I took it back. For example, I needed 35 seconds to fill all the details on the ATM. As for grouping, it depends of what details you have. If you have lat-long, city, unique code etc. – Tasos Oct 3 '15 at 10:46
• Now I am following, and thanks for quick response. As for grouping , I was thinking to consider city and a unique code (each ATM has a unique code that helps to identify it). I was thinking to "hard limit" the ATMs, say for a city I could have a map showing all the ATMs, then I divide the map say in chunks of some area. Then, these chunks become my classes of ATMs, but its not sounding quite intelligent! How would I go about it? – Nation Chirara Oct 3 '15 at 11:07
• @Giovanrich If you could find the lat and long of ATMs, I would probably made classes from a radius of 50km or 100km close to those coordinates. – Tasos Oct 3 '15 at 11:41
• Let me work on that first and see if I can get hold of those coordinates, I will get back to you thanks. – Nation Chirara Oct 3 '15 at 12:04

Firstly you should probably be creating models of classes/segments of users (unsupervised clustering). Otherwise it is difficult to predict what a given user will do. (More on that further below.)

Nextly, I think "deviation from recent transactions" is also fundamentally flawed. Most likely there are time patterns (time of day, days of the week, working hours, holidays and so on). To understand how to conceptualise time as useful features, see this excellent answer on Machine learning - features engineering from date/time data And similarly there are amount patterns, partly having to do with practical reasons (eg by withdrawing 38, one can receive 20, 10, 5 and 1 denominations, although this is not possible in some markets, like the USA).

Modelling the user is more complicated. You will likely not have enough data on each user, but you can build some user models. (Too few, then the system will make similar predictions for all users, without nuance - eg > \$400 always detected as fraud. Too many and there will be sparsity, overfitting, and generally the same problems as having no profile models at all, ie one model per actual user - eg fraud incorrectly detected at every time a given user goes to a new ATM.) This is basically unsupervised clustering. (Search for user profile categorisation, user models, user model clustering)

Much depends on the data available to you. Perhaps you can be more specific about the scale and scope. In any case, I wish you luck - banks/Visa do this very poorly right now.

• Thanks for the response and well explain answer. In this case I would have to develop a data base that resemble one a bank would use. Also, the scope of my system considers a credit card being used on ATM only, not in a merchant shop or web but on an ATM. – Nation Chirara Oct 5 '15 at 10:41