Anomaly Detection

Anomaly detection is the identification of data points, events or patterns that differ markedly from what is expected, using statistics, rules or machine learning. In finance it is used to flag possibly fraudulent payments, unusual account activity, suspected money laundering, cyber intrusions, accounting errors and suspicious trading. The flagged items, called anomalies or outliers, are not proof of wrongdoing; they are cases that deserve a closer look.

Anomaly detection is a general technique from statistics and data science, also called outlier detection. In payments it underpins fraud detection and transaction monitoring, and it works alongside simpler controls such as velocity checking and richer profiling such as behavioral analytics. Unlike a fixed rule that looks for a known scheme, anomaly detection can surface new kinds of fraud that nobody has written a rule for yet.

Imagine sorting a basket of apples. You do not need a list of every possible defect to notice the one apple that is a strange colour or twice the size of the rest. It simply stands out from the crowd. Anomaly detection teaches a computer to do the same with millions of payments: learn what the normal crowd looks like, then point to the ones that stand out.

The odd apple may be rotten, or it may just be a different variety that ended up in the basket. In the same way, an unusual payment might be fraud, or it might be a customer buying a car for the first time. That is why flagged items usually go to a person or a second check rather than being blocked outright.

Researchers commonly group anomalies into three kinds:

• Point anomalies. A single event that is unusual on its own, such as a $9,000 card payment on an account that normally spends $50 at a time.
• Contextual anomalies. An event that is normal in one setting but odd in another, such as a large cash withdrawal at 3 a.m. in a country the customer has never visited.
• Collective anomalies. A group of events that is unusual together even if each looks harmless, such as dozens of small transfers from different accounts into one new account, a pattern typical of mule accounts.

The simplest method measures how far a value is from the average, in units of standard deviation. This is the z-score:

Here $x$ is the new observation, $\mu$ is the mean of past observations and $\sigma$ is their standard deviation. A common rule of thumb flags values where the absolute z-score is above 3, because under a normal distribution fewer than 0.3% of values fall that far from the mean.

Worked example: a customer's card payments over the past year average $\mu = 60$ dollars with a standard deviation of $\sigma = 40$ dollars. A new payment of $x = 300$ dollars gives $z = (300 - 60) / 40 = 6$, well above 3, so it is flagged. A payment of 120 dollars gives $z = 1.5$ and passes. In practice, spending data is skewed rather than normal, so firms often use medians, percentiles or a logarithm of amounts instead.

More advanced methods include:

• Unsupervised machine learning. Clustering and isolation forests find points that are far from or easily separated from the rest, without needing labelled fraud cases.
• Supervised models. Gradient-boosted trees and neural networks trained on past confirmed fraud learn which patterns predict it, though they detect only schemes similar to those already seen.
• Autoencoders and sequence models. Neural networks that learn to reproduce normal behaviour, so events they reproduce badly are treated as anomalous.
• Graph analysis. Mapping links between accounts, devices, addresses and payees to find unusual clusters, useful against fraud rings and synthetic identity fraud.
• Benford's law tests. In accounting, checking whether the first digits of figures follow the expected distribution, since invented numbers often do not.

Card issuers and processors score authorisations in real time to catch stolen and cloned cards, including signs of card skimming and card testing fraud. Banks watch logins and transfers for account takeover and authorised push payment fraud. Compliance teams use it to find activity that may need a suspicious activity report for money laundering. Market surveillance teams look for unusual order patterns that may indicate spoofing or insider trading, and security teams watch network traffic as part of managing cybersecurity risk. Regulators encourage the approach: the EU's standards for strong customer authentication require payment providers to monitor transactions for abnormal patterns, and Nacha's 2026 rules require US ACH participants to run risk-based fraud monitoring.

The main practical problem is false positives. Fraud is rare, so even an accurate model flags many more genuine transactions than fraudulent ones, and each false alarm costs analyst time or annoys a customer. Normal behaviour also changes over time, for instance during holidays or after a new product launch, so models must be retrained to avoid "drift". Criminals adapt by imitating normal patterns. Finally, complex models can be hard to explain to customers, auditors and regulators, which is why supervisors expect firms to manage model risk, test for bias and document how decisions are made. Anomaly detection therefore works best as one layer of a broader fraud risk management programme rather than as a stand-alone answer.

• NIST: AI Risk Management Framework
• Nacha: Risk management topics, fraud monitoring phase 2