Feature Engineering

Velocity features capture the rate of transactions over specific time windows, transforming raw timestamps into behavioral signals.

• Card Velocity: Count of transactions per card in the last 1, 5, and 30 minutes
• Account Velocity: Number of distinct merchants or devices accessed per hour
• IP Velocity: Transactions originating from a single IP address within a sliding window

A sudden spike from a user's historical average of 2 transactions per day to 15 in 10 minutes is a strong anomaly indicator. These features are computed using sliding window aggregations in stream processing frameworks like Apache Flink or Kafka Streams.

Frequency encoding replaces categorical variables with their occurrence counts in the training data, while target encoding substitutes categories with the mean target value for that category.

• Merchant Category Code frequency: How often a specific MCC appears in legitimate vs. fraudulent transactions
• BIN encoding: Mean fraud rate associated with a specific Bank Identification Number
• Device hash frequency: How common a specific device fingerprint is across all accounts

These encodings capture the predictive power of high-cardinality categoricals without exploding feature dimensionality. Apply smoothing techniques like additive smoothing or cross-fold target encoding to prevent overfitting on rare categories.

Decomposing timestamps into cyclical and linear components allows models to learn periodic fraud patterns that raw timestamps obscure.

• Hour of day and day of week encoded as sine/cosine pairs to preserve cyclical distance
• Time since last transaction for the same card or account
• Transaction hour deviation from the user's historical median transaction hour
• Weekend/holiday flags capturing anomalous off-hours activity

Fraudulent transactions often cluster at 2-4 AM local time when legitimate users are inactive. Cyclical encoding ensures the model understands that 23:00 and 01:00 are only 2 hours apart.

Behavioral profiles aggregate historical transaction patterns per entity (card, account, device) to establish a baseline of normal behavior against which new transactions are compared.

• Average transaction amount and standard deviation per account over 30/90 days
• Typical merchant categories visited by a specific user
• Geographic radius of a user's typical transaction locations
• Device-account age: How long a specific device has been associated with an account

A transaction that deviates significantly from the established profile—such as a high-value purchase in a foreign country on a new device—triggers a high anomaly score. These features are typically computed in batch feature stores and served at inference time with low latency.

Features extracted from transaction graphs capture relational structure that flat feature vectors miss, exposing fraud rings and collusion networks.

• Degree centrality: Number of unique entities a node transacts with
• PageRank score: Importance of a node within the transaction network
• Community detection labels: Which subgraph cluster a node belongs to
• Shared identity elements: Number of accounts sharing the same device, email, or address

A legitimate user typically has a sparse, localized graph neighborhood. Fraud rings create dense, highly interconnected subgraphs with unusual shared attributes. These features are computed using graph algorithms like Louvain community detection or GraphSAGE embeddings.

Transaction amount patterns reveal sophisticated fraud tactics that attempt to evade threshold-based rules.

• Amount-to-account-average ratio: Current transaction amount divided by the user's 30-day mean
• Rounding detection: Flagging transactions ending in .00, .99, or repeating digits
• Benford's Law compliance score: Measuring deviation of leading digits from expected distribution
• Micro-transaction sequences: Detecting multiple small test transactions followed by a large one

Fraudsters often use amounts just below reporting thresholds or perfectly round numbers to test stolen cards. Benford's Law analysis is particularly effective because legitimate transactions naturally follow the expected logarithmic distribution of leading digits.

Calculate the rate of transactions over sliding time windows to detect sudden bursts of activity. These features capture behavioral momentum that individual transactions miss.

• Count per time unit: Transactions per minute, hour, or day
• Amount velocity: Total sum transacted in a window
• Distinctiveness: Count of unique merchants, devices, or IPs
• Acceleration: Rate of change in velocity itself

A legitimate user typically exhibits stable velocity profiles. A fraudster testing stolen cards often shows a sharp spike in transaction frequency and amount velocity within minutes.

Replace high-cardinality categorical variables with their empirical occurrence rates in the training data. This transforms sparse identifiers into smooth, continuous signals.

• Simple frequency: Count of occurrences divided by total records
• Target encoding: Mean fraud rate per category, often with smoothing
• Weight of Evidence: Log-odds ratio of fraud vs. non-fraud per category

For example, a merchant ID is replaced by the historical fraud rate at that merchant. This captures the riskiness of entities without exploding feature dimensionality.

Decompose timestamps into cyclical and linear components so models can learn temporal fraud patterns. Raw datetime objects are opaque to most algorithms.

• Cyclical encoding: Map hour-of-day to sin(2π * hour/24) and cos(2π * hour/24) to capture daily periodicity
• Day-of-week flags: Fraud patterns often cluster on weekends
• Time since last event: Recency features for user-specific sequences
• Session gaps: Time elapsed between consecutive user actions

This allows a model to learn that 3 AM transactions from a user who normally operates at noon are highly anomalous.

Build historical behavioral baselines per entity (user, card, device) and derive deviation features. The gap between current behavior and established norms is a powerful fraud signal.

• Rolling averages: Mean transaction amount over the last 30 days
• Standard deviation bands: Flag amounts exceeding μ + 3σ
• Ratio features: Current amount / user's average amount
• Categorical consistency: Has this user transacted with this merchant category before?

A $5,000 transaction is not inherently fraudulent. It is suspicious only if the user's historical average is $45 with a standard deviation of $20.

Extract structural features from transactional graphs where nodes are entities (users, cards, merchants) and edges are transactions. These features expose coordinated fraud rings.

• Degree centrality: How many unique connections an entity has
• PageRank: Importance score based on connected entities' importance
• Community detection labels: Which cluster or group the entity belongs to
• Shared identity signals: Number of users sharing a device, IP, or address

Fraud rings often form dense subgraphs with high interconnectivity. A single fraudulent account may look normal, but its graph neighborhood reveals collusion.

Transform raw feature values to a common scale so that distance-based algorithms like k-NN, SVM, and neural networks don't bias toward features with larger magnitudes.

• Standardization (Z-score): (x - μ) / σ, resulting in zero mean and unit variance
• Min-Max scaling: Squeeze values into [0, 1] range
• Robust scaling: Use median and IQR, resistant to outliers
• Log transformation: Tame heavy-tailed distributions like transaction amounts

Without scaling, a feature like transaction amount (range: $1–$50,000) would dominate a feature like hour of day (range: 0–23) in Euclidean distance calculations.