Concept Drift

An abrupt, discontinuous shift in the target variable's relationship with features, often triggered by an external shock. In fraud detection, this manifests as a novel attack vector launched simultaneously across thousands of accounts.

• Mechanism: A new malware strain or a zero-day exploit in a payment protocol instantly changes fraud patterns.
• Example: The immediate global shift in transaction behaviors following a major Payment Services Directive (PSD2) enforcement deadline.
• Detection: Typically identified by a sharp, sustained drop in model precision within a single monitoring window.

A gradual, continuous evolution of the target concept over time, where old patterns slowly become obsolete. This is the most common form of drift in consumer finance, reflecting adaptive fraudster behavior.

• Mechanism: Fraudsters iteratively tweak transaction amounts, frequencies, or merchant categories to mimic legitimate spending habits.
• Example: A slow, month-over-month increase in micro-transaction fraud testing card validity, moving from $0.01 to $0.50 authorizations.
• Detection: Requires statistical process control on model performance metrics over rolling windows, not just point-in-time checks.

Cyclical or seasonal variations where the input-output relationship changes predictably but temporarily before reverting to a prior state. This is often confused with permanent drift, leading to unnecessary model retraining.

• Mechanism: Legitimate behavioral shifts during holiday shopping seasons, tax filing periods, or Black Friday events that alter spending velocity.
• Example: A fraud model flagging high-velocity luxury purchases as anomalous during December, when such behavior is seasonally normal.
• Detection: Decompose performance metrics using time-series analysis to isolate seasonal components from genuine structural breaks.

A change in the distribution of input features (data drift) that does not yet impact model accuracy but signals an impending shift in the underlying environment. It serves as a leading indicator of future concept drift.

• Mechanism: A new mobile banking app release changes the distribution of transaction_device_type without immediately altering fraud labels.
• Example: A marketing campaign attracting a younger demographic shifts the account_age feature distribution, potentially preceding a change in fraud propensity.
• Detection: Monitored via Population Stability Index (PSI) and divergence metrics on input features, triggering investigation before performance degrades.

A specific subtype where the predictive power of individual features decays or reverses over time. A feature that was once highly correlated with fraud becomes irrelevant or even inversely correlated.

• Mechanism: Fraudsters learn that a specific feature (e.g., ip_country_mismatch) is a strong model signal and route transactions through residential proxies to neutralize it.
• Example: The transaction_amount feature losing predictive power as fraudsters adopt exact-match amounts to typical customer average basket sizes.
• Detection: Track SHAP value distributions and feature importance rankings across monitoring windows to identify decaying signals.

A shift in the definition, quality, or distribution of the target variable itself, rather than the input features. This corrupts the supervised learning signal and invalidates ground truth comparisons.

• Mechanism: A change in regulatory chargeback codes, a backlog in fraud claim processing, or a new internal policy reclassifying certain disputes as non-fraud.
• Example: A bank reclassifying 'friendly fraud' (family member misuse) from a fraud label to a non-fraud dispute, instantly altering the target distribution.
• Detection: Monitor the distribution of the target variable and audit the label generation pipeline for policy or process changes.