The question.
A risk score is only one part of a fraud workflow. Analysts also need evidence, related activity, and a record of why an action was recommended.
This concept replaces the separate fraud engine and analysis-bot entries with a complete decision workflow. Models estimate risk; evidence tools assist investigation; people retain case disposition authority.
The proposed approach.
- Create point-in-time features from transaction and account events
- Combine supervised scoring with graph and anomaly signals
- Give investigative agents read-scoped tools and source-linked summaries
- Review threshold choices against analyst capacity and false-positive costs
Target architecture.
Transaction eventsFeature serviceRisk scoringEvidence graphInvestigation agentAnalyst review
The difficult parts.
- Delayed or incomplete fraud labels
- Adversarial behavior and concept drift
- Evidence retrieval without unsupported accusations
How to evaluate it.
- Precision and recall at a fixed review budget
- Explanation fidelity and investigation evidence support
- Drift sensitivity, false-positive burden, and decision latency
Planned deliverables.
- An end-to-end risk-system architecture
- An analyst-focused evidence and review specification
- A delayed-label evaluation and monitoring plan
Design principles.
An explanation should help a reviewer inspect the evidence.
Keep investigative assistance separate from final case decisions.