Change Point Detection

Change point detection identifies abrupt variations in the statistical properties of a time series. Instead of flagging individual outlier transactions, it detects when the entire generating process changes.

• Mean Shift: A sudden jump in the average transaction amount.
• Variance Change: An increase in the volatility of transaction frequency.
• Correlation Break: A disruption in the relationship between transaction velocity and merchant category.

For example, a fraud ring testing stolen cards might cause a sudden increase in the mean value of small-dollar transactions at a specific merchant type.

The operational context dictates the detection strategy, split into two fundamental modes.

• Offline (Batch) Detection: Analyzes a complete historical dataset to retrospectively identify all change points. Algorithms like PELT (Pruned Exact Linear Time) are used for forensic investigation of past fraud campaigns.
• Online (Sequential) Detection: Processes data points as they arrive in a stream, minimizing detection delay. CUSUM (Cumulative Sum) and Bayesian Online Change Point Detection (BOCPD) are essential for real-time fraud blocking.

Online methods trade some accuracy for low latency, making them suitable for pre-authorization scoring pipelines.

Algorithms optimize a cost function that measures the homogeneity of a segment, combined with a penalty to control the number of change points.

• Cost Functions: L2 (mean shift), L1 (median shift), or kernel-based costs for distributional changes.
• Search Methods: Dynamic programming finds the exact optimal segmentation but is computationally expensive. Binary segmentation and window-sliding are greedy, faster approximations.
• Penalty Term: A regularization parameter (e.g., BIC or AIC) prevents overfitting by penalizing excessive change points.

The choice of cost function directly determines which type of fraud campaign shift the model can detect.

Bayesian approaches provide a probabilistic framework for change point detection, quantifying uncertainty in the location and number of changes.

• Bayesian Online Change Point Detection (BOCPD) maintains a posterior distribution over the run length (time since the last change point).
• With each new data point, the model computes the probability that the current run continues versus a change occurring.
• This yields a change point probability at each time step, allowing risk systems to trigger alerts with a configurable confidence threshold.

BOCPD naturally handles streaming data and provides interpretable probability scores for downstream decision engines.

Fraud campaigns rarely manifest in a single metric. Multivariate change point detection monitors joint distributions across multiple time series simultaneously.

• E-divisive methods use energy statistics to detect changes in the joint distribution of transaction amount, frequency, and user location.
• Kernel change point detection maps data into a reproducing kernel Hilbert space to detect subtle, non-linear distributional shifts.
• A change in the correlation structure between two metrics (e.g., transaction count and average basket size) can be a stronger fraud signal than a shift in either metric alone.

This holistic view reduces false positives caused by benign fluctuations in isolated metrics.

A critical distinction exists between anomalies (isolated outliers) and change points (sustained regime shifts). Robust algorithms must not confuse the two.

• A single large transaction is an anomaly; a sustained sequence of large transactions is a change point.
• Robust cost functions (e.g., Huber loss) or median-based statistics prevent outlier contamination from triggering false change point detections.
• Pruned Exact Linear Time (PELT) with a robust cost function can accurately segment a time series even in the presence of transactional noise.

This robustness ensures that the system signals the start of a coordinated fraud attack, not just a single unusual purchase.

Detects sudden, coordinated fraud campaigns where transaction velocity and mean amount spike simultaneously across multiple accounts. Change point algorithms like PELT (Pruned Exact Linear Time) segment the time series to identify the exact moment a normal pattern transitions to an attack pattern.

• Flags a sudden 10x increase in transaction attempts from a specific BIN range
• Triggers automated rule hardening when a change point is detected
• Reduces time-to-detect from hours to sub-second after the shift

Monitors individual merchant terminal or ATM transaction streams for abrupt changes in decline ratios, average transaction value, or reversal frequency. A single change point in a terminal's behavioral profile often indicates physical skimming device installation or POS malware compromise.

• Tracks per-terminal metrics in real-time streaming windows
• Uses Bayesian Online Change Point Detection (BOCPD) for sequential monitoring
• Automatically isolates compromised terminals within minutes of the shift

Identifies the precise moment a legitimate account's behavior transitions to fraudulent activity by detecting change points in session duration, geolocation velocity, transaction amount distribution, and beneficiary entropy. This enables real-time step-up authentication triggers.

• Models per-user behavioral baselines using historical transaction patterns
• Applies CUSUM (Cumulative Sum) control charts to detect subtle mean shifts
• Triggers MFA challenge at the exact point of behavioral divergence

Detects coordinated fraud ring activity by monitoring aggregate network-level metrics for change points in graph density, community formation rate, and shared attribute concentration. A sudden structural shift in the transaction graph often signals the activation of a synthetic identity ring.

• Applies change point detection to graph topology metrics over sliding windows
• Uses non-parametric change point tests robust to heavy-tailed financial distributions
• Correlates structural shifts across multiple network views for high-precision alerting

Monitors production fraud model score distributions, false positive rates, and precision-recall curves for abrupt change points that indicate a fundamental shift in fraud patterns the model was not trained on. This triggers automated model retraining pipelines before performance degrades below SLAs.

• Tracks KS-statistic and PSI (Population Stability Index) drift metrics
• Uses Pruned Exact Linear Time (PELT) for efficient multi-change point detection
• Integrates with MLOps pipelines for automated model refresh triggering

Distinguishes between expected seasonal fraud fluctuations (holiday shopping spikes, tax season scams) and anomalous deviations by decomposing time series into trend, seasonal, and residual components before applying change point detection to the residual signal.

• Uses STL decomposition to isolate the irregular component
• Applies Seasonal Hybrid ESD (S-H-ESD) for robust anomaly detection
• Prevents false alarms from legitimate cyclical business patterns while catching true campaign onsets