Fraud Detection
Real-time card-fraud detection on a genuinely imbalanced dataset (1 fraud in 578 transactions), streamed through a Kafka-compatible broker, scored in milliseconds, then handed to an AI agent that writes analyst-style case notes.
Transactions stream through Redpanda. An autoencoder anomaly model, trained only on normal transactions so it degrades gracefully to fraud patterns it has never seen, scores each one in a few milliseconds with a SHAP explanation attached. Results land in Postgres and a live dashboard.
Measured results
log scale
Anomaly model
Unsupervised autoencoder trained only on normal transactions, on a genuinely rare-event problem (1 fraud in 578 transactions).
vs 0.0013 random-chance baseline on this fraud rate, roughly two orders of magnitude better than chance
Production threshold
At the "high" risk cutoff used in production.
The split is time-ordered, not shuffled, so the model is never evaluated on transactions from before its own training window.
The investigation agent
Every medium or high-risk transaction is picked up by a separate LangGraph agent worker. It pulls real account history, merchant risk data, and deterministic rule flags (amount vs rolling average, unusual hour, high-risk merchant category, card-testing pattern) before an LLM writes a structured case note that cites only that evidence.
If the LLM call fails, a deterministic rule-based fallback takes over, so an outage never breaks the pipeline.
Scoring never waits on the LLM
Investigation runs as an independent consumer group, so its latency cannot touch live scoring latency. The scoring path stays fast no matter what the agent is doing.
How it was measured
Evaluated with a strict time-ordered train, threshold, and test split, not randomly shuffled, to avoid training on the future.
A classical Isolation Forest is trained and kept in the same artifact, not as the primary scorer but as a fast tree-based SHAP surrogate explainer, since exact SHAP on the autoencoder would cost hundreds of forward passes per request.