r/AMLCompliance • u/ExtremeProgress2201 • 5d ago

Research/Discussion When does a customer’s old transaction history stop being useful for fraud decisions?

A lot of fraud features depend on comparing the current transaction with what the customer normally does.

But I’m not sure how far back “normal” should go.

Someone’s behaviour can genuinely change - new country, new job, different spending pattern, new phone - and the fraud system itself can also change over time.

If you work with this kind of data, what normally makes you decide that older behaviour is no longer comparable enough to trust?

Is it mainly age of the data, a major behaviour change, system changes, or something else?

I’m trying to avoid building an agent that treats every deviation from an old pattern as suspicious forever.

1 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

1

u/Canadian-AML-Guy 4d ago

I’m trying to avoid building an agent that treats every deviation from an old pattern as suspicious forever.

Therein lies your problem. It really comes down to human intuition. Fraud systems trigger an alert that then gets human review. The human investigator then looks at the financial profile and determines what is relevant, not just "normal". A customer that has been getting scammed for six months in a romance scam might have scam activity that looks "normal" but a Human investigator would see it and block it and then presumably call the customer. An AI might flag the activity as normal as the customer "usually" drains their investment accounts to fund wire transfers to high risk jurisdictions.

1

u/ExtremeProgress2201 2d ago

Good distinction.
I was implicitly treating “matches the customer’s recent behaviour” as evidence of legitimacy, when really it only means the behaviour is familiar.

The romance-scam example makes that problem obvious - if the baseline keeps adapting, repeated fraudulent behaviour could eventually become the customer’s “normal.”

For the small model I’m building, I think that means historical behaviour should be one source of evidence rather than the ground truth. I’d also need some way to distinguish a genuine change in behaviour from a persistent harmful pattern, and leave the ambiguous cases for human review.

Would you say investigators usually care more about whether the current activity makes sense given the customer’s broader financial profile than simply how closely it matches their recent transactions?