Arpitkr/fraud-detection-ui
0
1FRAUD_KNOWLEDGE_BASE = [2 3 4 {5 "id": "v14_rule",6 "category": "Feature Rule",7 "title": "V14 — Strongest Single Fraud Indicator",8 "content": (9 "V14 is the most powerful fraud predictor in this dataset, accounting for ~20% of feature importance. "10 "V14 values below -3.0 are highly suspicious. Values below -5.0 are almost exclusively associated with fraud. "11 "V14 captures transaction authentication patterns. Strongly negative V14 suggests the transaction "12 "bypassed normal card authentication, consistent with skimmed card data or card-not-present fraud."13 )14 },15 {16 "id": "v10_rule",17 "category": "Feature Rule",18 "title": "V10 — Second Strongest Fraud Signal",19 "content": (20 "V10 is the second most important fraud feature (~12% importance). "21 "Values below -3.0 are strongly associated with fraud. "22 "V10 correlates with merchant category and transaction routing anomalies. "23 "Fraudsters often use compromised cards at specific merchant types (electronics, gift cards) "24 "that show up as extreme V10 deviations."25 )26 },27 {28 "id": "v12_rule",29 "category": "Feature Rule",30 "title": "V12 — Third Key Fraud Feature",31 "content": (32 "V12 contributes ~10% to fraud detection importance. "33 "Strongly negative V12 (below -3.0) is a major red flag. "34 "V12 captures spending behaviour deviations relative to the cardholder's historical profile. "35 "A V12 anomaly combined with V14 or V10 anomaly multiplies fraud likelihood significantly."36 )37 },38 {39 "id": "v17_rule",40 "category": "Feature Rule",41 "title": "V17 — Transaction Velocity Indicator",42 "content": (43 "V17 (~10% importance) reflects transaction velocity and timing patterns. "44 "Strongly negative V17 suggests unusually rapid sequential transactions, "45 "a common pattern in card-present skimming fraud where stolen cards are used immediately "46 "before the victim notices. V17 < -3.0 combined with high amount is a critical alert."47 )48 },49 {50 "id": "v4_rule",51 "category": "Feature Rule",52 "title": "V4 — High Positive Value as Fraud Signal",53 "content": (54 "Unlike most fraud features that show negative extremes, V4 shows HIGH POSITIVE values in fraud. "55 "V4 > 2.0 combined with negative V14 is a strong fraud pattern. "56 "V4 (~9% importance) captures geographic or terminal anomalies. "57 "A cardholder transacting far from their usual location or on an unfamiliar terminal type "58 "produces elevated V4 scores."59 )60 },61 {62 "id": "v11_rule",63 "category": "Feature Rule",64 "title": "V11 — Account Age and History Signal",65 "content": (66 "V11 with strongly positive values (>2.0) in combination with negative V14 indicates "67 "account takeover fraud — where a legitimate long-standing account is suddenly used fraudulently. "68 "This pattern suggests the fraudster has stolen credentials of an established account."69 )70 },71 {72 "id": "v3_rule",73 "category": "Feature Rule",74 "title": "V3 — Transaction Frequency Anomaly",75 "content": (76 "Strongly negative V3 (below -2.0) suggests an unusual spike in transaction frequency. "77 "Fraudsters often make multiple rapid transactions to test a stolen card (small amounts first) "78 "then escalate to larger purchases. V3 captures this rapid-fire pattern."79 )80 },81 82 83 {84 "id": "card_skimming",85 "category": "Fraud Pattern",86 "title": "Card Skimming / POS Terminal Fraud",87 "content": (88 "Card skimming involves physically copying card data from legitimate POS terminals or ATMs. "89 "Skimmed cards are used immediately (within hours) at different merchant locations. "90 "Signature in data: strongly negative V14 (auth failure pattern), negative V10, "91 "transaction time between 11PM-4AM, amounts between $100-$500. "92 "This is the most common fraud type in this dataset."93 )94 },95 {96 "id": "card_not_present",97 "category": "Fraud Pattern",98 "title": "Card-Not-Present (CNP) / Online Fraud",99 "content": (100 "CNP fraud occurs when stolen card details are used for online purchases without the physical card. "101 "Fraudsters buy digital goods (gift cards, electronics, subscriptions) that are easily resalable. "102 "Data signature: moderate V14 anomaly, high V4 (geographic mismatch), "103 "amounts typically $50-$300, multiple transactions in short window. "104 "CNP fraud increased dramatically with e-commerce growth."105 )106 },107 {108 "id": "account_takeover",109 "category": "Fraud Pattern",110 "title": "Account Takeover Fraud",111 "content": (112 "Account takeover (ATO) occurs when a fraudster steals login credentials and takes control "113 "of a legitimate bank account. The victim's established account history paradoxically "114 "helps the fraud pass initial filters. "115 "Signature: positive V11 (old account), sudden V14 anomaly, large amounts, "116 "new device or location (V4 spike). ATO is hardest to detect because the account history is genuine."117 )118 },119 {120 "id": "card_testing",121 "category": "Fraud Pattern",122 "title": "Card Testing / Carding Attack",123 "content": (124 "Fraudsters test stolen card numbers with small transactions (under $10) before making large purchases. "125 "This creates a distinctive pattern: multiple tiny transactions followed by a large one. "126 "Data signature: very small Amount (<$5) followed by large Amount (>$200) within minutes, "127 "negative V3 (rapid velocity), consistent merchant category codes. "128 "Card testing is an early warning signal — the real fraud comes after the test succeeds."129 )130 },131 {132 "id": "friendly_fraud",133 "category": "Fraud Pattern",134 "title": "Friendly Fraud / Chargeback Fraud",135 "content": (136 "Friendly fraud is when a legitimate cardholder makes a purchase and then falsely claims "137 "it was unauthorized to get a chargeback refund. "138 "This is difficult to detect with ML because the transaction itself looks legitimate. "139 "Usually involves high-value items, online purchases, and repeat chargeback history. "140 "V features tend to be near-normal in friendly fraud cases."141 )142 },143 {144 "id": "synthetic_identity",145 "category": "Fraud Pattern",146 "title": "Synthetic Identity Fraud",147 "content": (148 "Synthetic identity fraud combines real and fake information to create a new identity. "149 "The fraudster builds credit slowly over months, then 'busts out' — maxing all credit at once. "150 "Very hard to detect at transaction level. Signature: sudden large transactions after "151 "long period of normal activity, diverse merchant categories, amounts near credit limit."152 )153 },154 155 156 {157 "id": "dataset_fraud_rate",158 "category": "Dataset Statistics",159 "title": "Overall Fraud Rate in Dataset",160 "content": (161 "This fraud detection system was trained on 284,807 real credit card transactions. "162 "Only 492 transactions (0.17%) are fraudulent — extreme class imbalance. "163 "This means a naive model predicting 'no fraud' for everything would be 99.83% accurate "164 "but completely useless. The model uses XGBoost with scale_pos_weight=25 to handle this imbalance."165 )166 },167 {168 "id": "high_value_risk",169 "category": "Dataset Statistics",170 "title": "High-Value Transactions Have 2x Higher Fraud Rate",171 "content": (172 "SQL analysis of the dataset reveals that transactions above $200 have a fraud rate of 0.29%, "173 "exactly double the overall 0.17% fraud rate. "174 "Fraudulent transactions average $122 in amount versus $88 for legitimate transactions. "175 "This confirms that fraudsters target higher-value transactions. "176 "A transaction above $200 with V14 anomaly should be treated as very high risk."177 )178 },179 {180 "id": "time_patterns",181 "category": "Dataset Statistics",182 "title": "Peak Fraud Hours: 2AM-3AM",183 "content": (184 "Time-based SQL analysis reveals fraud peaks dramatically between 2AM and 3AM, "185 "with a fraud rate of 1.33% during this window — nearly 8x the baseline rate. "186 "Fraudsters prefer late night hours because: victims are asleep and won't notice alerts, "187 "bank fraud teams are understaffed, and stolen card data is often used immediately after theft. "188 "A transaction with V14 anomaly occurring in the 2AM-3AM window (Time ~7200-10800 seconds) "189 "should be treated as extremely high risk."190 )191 },192 {193 "id": "amount_distribution",194 "category": "Dataset Statistics",195 "title": "Fraud Amount Distribution",196 "content": (197 "Legitimate transactions average $88.35 in amount. "198 "Fraudulent transactions average $122.21 — about 38% higher. "199 "However, the distribution is wide: some fraud occurs at very low amounts (card testing under $5) "200 "and some at very high amounts (bust-out fraud over $1000). "201 "Amount alone is a weak predictor — it must be combined with V-feature anomalies."202 )203 },204 205 206 {207 "id": "xgboost_model",208 "category": "Model Knowledge",209 "title": "XGBoost Model Configuration and Performance",210 "content": (211 "The fraud detection model is XGBoost with 200 estimators, learning_rate=0.5, scale_pos_weight=25. "212 "scale_pos_weight=25 means the model treats each fraud case as 25x more important than legitimate, "213 "compensating for the 0.17% fraud rate. "214 "Performance: Precision=91%, Recall=84%, F1=0.87, PR-AUC=0.878. "215 "This means 91% of flagged transactions are actually fraud (low false alarm rate) "216 "and 84% of real fraud is caught."217 )218 },219 {220 "id": "why_not_accuracy",221 "category": "Model Knowledge",222 "title": "Why Accuracy is Misleading for Fraud Detection",223 "content": (224 "Accuracy is the wrong metric for fraud detection. "225 "A model predicting 'no fraud' for every transaction achieves 99.83% accuracy but catches 0% of fraud. "226 "The correct metrics are: Precision (of all flagged transactions, what % are actually fraud), "227 "Recall (of all real fraud, what % did we catch), and PR-AUC (area under precision-recall curve). "228 "Our XGBoost achieves PR-AUC=0.878 vs Logistic Regression at 0.764."229 )230 },231 {232 "id": "false_positives",233 "category": "Model Knowledge",234 "title": "Cost of False Positives vs False Negatives",235 "content": (236 "False Positive (legitimate transaction flagged as fraud): frustrates the customer, "237 "damages trust, may cause card decline at point of sale — costs $10-50 in customer service. "238 "False Negative (fraud missed): bank absorbs the loss — costs $50-5000 per case. "239 "Our model prioritizes precision (91%) to minimize false positives that damage customer experience, "240 "while maintaining 84% recall to catch most fraud."241 )242 },243 {244 "id": "shap_explainability",245 "category": "Model Knowledge",246 "title": "SHAP Values for Model Explainability",247 "content": (248 "SHAP (SHapley Additive exPlanations) values show how each feature contributed to a specific prediction. "249 "A positive SHAP value means the feature pushed the prediction toward fraud. "250 "A negative SHAP value means the feature pushed toward legitimate. "251 "For fraud cases, V14 typically has the largest absolute SHAP value. "252 "SHAP values make the XGBoost black-box model interpretable for analysts and regulators."253 )254 },255 256 257 {258 "id": "high_risk_combo",259 "category": "Risk Rules",260 "title": "High Risk Combination: V14 + V10 + V12 Anomalies",261 "content": (262 "When V14 < -3.0 AND V10 < -2.0 AND V12 < -2.0 simultaneously, "263 "the fraud probability is extremely high (>90%). "264 "This triple-feature anomaly pattern is present in the majority of confirmed fraud cases. "265 "Each feature alone might be explainable, but their simultaneous extreme deviation "266 "is almost always indicative of card skimming or stolen card use."267 )268 },269 {270 "id": "medium_risk_signals",271 "category": "Risk Rules",272 "title": "Medium Risk Signals Worth Monitoring",273 "content": (274 "Medium risk indicators (fraud probability 30-70%): "275 "Single V14 anomaly below -2.0 with normal other features, "276 "High amount (>$300) with slightly elevated V4, "277 "V17 < -2.0 suggesting rapid sequential transactions, "278 "Transaction between 1AM-4AM with any single V-feature anomaly."279 )280 },281 {282 "id": "low_risk_context",283 "category": "Risk Rules",284 "title": "Low Risk Context — When Anomalies Are Expected",285 "content": (286 "Some transactions appear anomalous but are legitimate: "287 "International travel (V4 spike is expected), "288 "Large one-time purchases like electronics or jewelry (high amount normal), "289 "New merchant category the cardholder hasn't used before. "290 "Context matters — isolated V-feature deviations with normal Amount and Time "291 "have lower fraud probability than multi-feature anomalies."292 )293 },294 295 296 {297 "id": "pci_dss",298 "category": "Industry Context",299 "title": "PCI DSS and Data Privacy — Why Features Are Anonymized",300 "content": (301 "The V1-V28 features in this dataset are PCA-transformed for privacy compliance under PCI DSS "302 "(Payment Card Industry Data Security Standard). "303 "PCI DSS prohibits sharing raw cardholder data. PCA transformation preserves mathematical "304 "relationships needed for ML while making the data uninterpretable to humans. "305 "This is why we cannot say 'V14 = merchant ID' — the mapping is intentionally obscured."306 )307 },308 {309 "id": "industry_fraud_stats",310 "category": "Industry Context",311 "title": "Global Credit Card Fraud Statistics",312 "content": (313 "Credit card fraud costs the global economy over $32 billion annually. "314 "The United States accounts for ~35% of global card fraud despite having only 22% of card volume. "315 "Card-not-present fraud has grown 140% over 5 years with e-commerce expansion. "316 "Real-time fraud detection systems must decide in under 100ms whether to approve a transaction. "317 "Machine learning has reduced fraud losses by 40-60% compared to rule-based systems alone."318 )319 },320]