Interpretable Electronic Transfer Fraud Detection with Expert Feature Constructions

Abstract

Since the magnitude of financial frauds grow rapidly with low clearance rates, detecting and avoiding frauds has been a tremendous challenge for financial institutions. Both the detection performance and interpretability are critical for fraud detection to profile the fraudsters' modus operandi and to spot vulnerabilities of financial systems/processes. Traditional rule-based approaches yield poor detection performances. Recent machine learning methods basically generate recency, frequency, and temporal features to extract patterns from raw transaction data. On the other hand, this paper generates behavioral and (financial organization's) segmentation features based on financial expertise and characteristics solely belonging to (non)-fraudulent accounts. While inputting aforementioned features into diferent models and using accumulated features from past literature generate unstable prediction results, our features generate the best and stable results for the decisiontree-base approach like Extreme Gradient Boosting and Light Gradient Boosting Machine. By using Kolmogorov-Smirnov test, we discover the instable predictive results are caused by vastly diferent distributions of features that reflects the fastchanging modus operandi in the training/testing sets. Thus, generating training/testing sets by random sampling (compared to chronological separation) is improper for modeling time varying data. Combining XGBoost with our expertise-based features provides clear causal-efect between features and fraudulent labels for further interpretations. The high precision and recall rates allow banks to save screening labor costs and identify frauds without interfering with normal transactions. The quality of our features can be examined by showing that they occupy three out of the five most important features under the ranking procedure in a premium finance publication by Butaru et al. [ Journal of Banking and Finance (72) 218-239 (2016)].

Keywords

• eol>Electronic Transfer Fraud Detection
• Feature Engineering
• Boosted Decision Tree
• Interpretability

1. Introduction

precision and recall rates is thus critical. our features even though the number of our features is

Recent researches broadly apply machine learning to much lower than features in past works; this entails that detect EFT frauds. To address the high-dimensional- generating features by expertise does work. nature of the raw transaction data, [3] and [ 4 ] suggest Interpretability is important for an EFT fraud detection to construct features to retrieve patterns from raw trans- system to profile fraudulent behaviors and to discover action data. [ 5, 6, 7, 8 ] collect features proposed in past EFT system vulnerabilities. This gives us clear guidelines literature and categorize them into recency, frequency, to avoid EFT systems from being utilized by fraudulent monetary, (unsupervised) anomaly detection, and other transfers (see [18]) and to fulfill the "risk-oriented" 4 propfeature engineering techniques. Most of the aforemen- erty (of a money laundry system) required by the Finantioned features are constructed based on math or statisti- cial Action Task Force5(see [19] and [20]). Combining cal properties without involving much financial expertise. XGBoost with our features not only produces very good [ 5 ] argues that clever feature constructions could yield detection results but ranks the importance of features good detection results, we create features based on finan- that can be directly explained by expertise. The good cial expertise3 and observations. By following [9] idea qualities of our features and categories can also be examthat creating features to capture the patterns for either ined by showing that they occupy three out of the five positive or negative observations, we created features most important features under the ranking procedure specifically for fraudulent accounts and (non)-fraudulent published in a premium financial journal [21]. ones. For example, fraudsters usually try to empty an The rest of this paper is organized as follows. Section account by withdrawing at the largest amount available 2 reviews related works on financial fraud detection and in the ATM to maximize the fund-transfer speed. And feature construction. Section 3 describes the formats of the account’s last withdrawal amount is usually larger our raw data and the data-preprocessing procedures. Secthan its afterwards account balance. In addition to detect- tion 4 first collects the features of past fraud detection ing fraudulent behaviors, we also create features that de- researches. Then we describe how our features and new scribe non-fraudulent behaviors to reduce harassment on feature categories are generated based on financial expernon-fraudulent accounts. For example, over-the-counter tise and observations. Section 5 compare fraud detection services require account holders to be present in the busi- performances with diferent training models and input ness ofice and are unlikely to be utilized by fraudsters. features. We explore the properties of bad features that On top of the aforementioned five feature categories, we deteriorate detection performances and show that clever constructed two new categories: behavioral and segmen- feature constructions with decision tree models could tation for our new features. yield good detection rates and interpretability. Section 6

To compare the performances of our proposed behav- concludes this paper. iors, we first collected and implemented features from past literature [ 10, 11, 8, 3, 4, 12, 7, 13, 1, 14, 5, 15, 16, 17 ].

Then we compare the performance of Extreme Gradi- 2. Related Works ent Boosting (abbreviated as XGBoost), Bayes-Point machine, Random Forest, support vector machine (abbrevi- There are many types of financial frauds, such as credit ated as SVM), Neural Network, Logistic regression and card frauds [22, 16, 17, 14], phone fraud [23], online translight gradient boosting machine (abbreviate as LGBM) action fraud [24], instant payment fraud [25], and so on. by inputting the features generated in past works and The rule-based method is commonly used to detect frauds the features generated in this paper. Our experimental by conventional banks for high interpretability. However, results suggest that XGBoost produces the best detection it is dificult for the rule-based method to capture comresults unless certain "noisy" features are inputted. These plex and time-varying fraud patterns and the detection noisy features are examined to have diferent distribu- performance is hence related low. In addition, fixed rules tions by Kolmogorov–Smirnov test; in addition, the recall may be easily cracked once fraudsters became aware of (precision) rates deteriorate with the level of diference them. in features distributions of fraudulent (non-fraudulent) Training a machine learning model with raw transacobservations. Thus, instead of separating the data into tion data is impractical since fraudulent transactions are training and testing sets by chronological orders, gener- too rare to meet very high dimensionality of raw data. ating training/testing set by randomly sampling the data [ 4 ] and [3] suggest to construct features to extract incould faultily generate good detection results since the formation from raw transaction data to train a machine time-varying properties of noisy features are alleviated. learning model for fraud detection. The aforementioned Besides, XGBoost also produces comparable results with feature engineering process is called feature construction 4Eforts should be allocated where the risk of money laundering 3Like the anti-money laundry (AML) guidelines from Taiwan’s is higher. ifnancial supervisory commission. 5https://www.fatf-gafi.org/ (generation) (see [26]), and it can develop a more pro- from the National Police Agency. Sophisticated features found insight into characteristics of fraudulent and non- are designed in this paper based on real raw transaction fraudulent accounts. Obviously, the qualities of feature data that contains featureful details as in Table 1. We do constructions significantly influence detection results. not test our method with public fraudulent detection data [7] argue that many features are generated based on the sets on the Internet 6 since the limited disclosure informafrequency of transactions. But only exploring temporal tion provided by public datasets due to strict protection of features without considering financial/fraud detection privacy regulations prevent the construction of expertise expertise could significantly prevent a machine learning features. The survey paper [28] also show that some antimodel from recognizing complete fraudulent behaviors. fraud works, like [29] and [30], only raise their methods [6] studies suggest that most recent fraudulent detec- without conducting experiments due to the aforemention works construct their input features based on RFM tioned problem. Inputting the entire transaction record (recency, frequency. and monetary) categories. In addition to RFM, [ 5 ] show that some past studied features can Table 1 be categorized into two new categories: (unsupervised) Structure of Transaction Data anomaly detection, and other feature engineering tech- Item Description niques. By implementing past studied features, they em- Account ID Unique identification number for each account pirically show that clever feature engineering can yield Transaction Date The date when the transaction took place very good detection results even with simple learning Transaction Type TasheATtrMansinatcrtaio-bnatnykpew(itinhdcroadwea)lsaunchd models like classification trees. Similarly, in addition to at the counter deposit. frequency features, [7] explained that frequency features Withdrawal Amount The withdrawal amount. It is empty are unable to capture chronological relationships in trans- Deposit Amount Tifhtehedterpaonssiatcatimonouisntn.otItwiisthedmrapwtyali.f actions. For example, fraudsters tend to first make some the transaction is not deposit. small transactions and then make a big one. They also Account Savings The balance of the account after pershow that incorporating interpretable monetary features Note Tfoerxmtuinalg itnhfeortmraantsiaocntioonf.the transacderived from fraudulent behaviors can greatly enhance tion, like “transferred to company X”, detection performance. In light of their observations, this torranthsaectAioTnM. ID for performing the paper creates new features through financial expertise Internet Whether the transaction is perand meticulous observations of (non-)fraudulent behav- formed through E-bank services iors. we also augment two more categories of features Voice Wforhmetehdetrhrtohuigsh ttrealenpsahcotnioynserisvicpeseraccording to typical (non-)fraudulent behaviors and seg- Warned Whether the account is fraudulent or not. mentational properties.

Since a decision tree is inherently interpretable (see to a fraud detection system is impractical (see [ 4 ]) due to [18]) and our proposed features (categories) are con- very high dimensionality of raw data and heterogeneity structed based on financial expertise and observations, of transactions. Thus they aggregate n transactions for combining our features and the XGBoost provides good each user within a fixed time interval and extract feadetection results and proper causal explanations as dis- tures from these transactions. To our knowledge, this cussed later. Thus our model is practical and can avoid technique is widely used in recent researches. However, lfawed or unfair AI usages. The interpretability of AI deciding the value of the hyper-parameter n results in models has attracted widespread attention in both aca- a trade-of. Specifically, as n decreases (increases), less demics and especially practical applications in finance (more) transactions are aggregated to describe the characand law. According to the evaluation indicators based teristics of an account but more (less) accounts are eligible on human subject-based evaluation metrics proposed by to be included as training/test data. This is because many Morafah [ 27], our model is causal interpretable that can accounts do not have frequent transactions and will be explain and predict the classification results. Our pro- removed if n becomes large. But removing samples can posed features can be explained by financial expertise and be detrimental to fraud detection since fraudulent samthe fraudulent detection results also conform to human ples are scarce and some of them are seldomly transacted. intuition. Good interpretability makes our model more To strike a balance between the number of aggregated suitable to meet financial institutions’ requirements. transactions and the removed accounts, we choose n to be 9 as illustrated in Table 2. It can be observed that the 3. Data Descriptions and percentage of fraudulent accounts being included in the trading data drop rapidly when n exceeds 9. The ratio

Preprocessing of aggregated transactions of fraudulent accounts to all

Our data set contains transaction data during Apr. 2018

to Sep. 2018 from Bank L and the fraudulent accounts 6Like https://www.kaggle.com/ealaxi/paysim1?fbclid=IwAR1wwa2npiZsoLHf1yNUTODJU z_x JoCQ5eKOLLpDMBkmyGDnNz2OIsmxcac Table 2 in a short period of time. Thus it is intuitive to pinpoint Percent of Used Accounts and Transactions Given n “what fraudsters would do” to identify fraudsters. On Per1: % of fraudulent accounts that contains more than transactions to all the other hand, profiling certain normal behaviors could Per2: % of aggregfarateuddutrleanntsaacctcioounnstosf fraudulent accounts to all fraudulent also be beneficial since fraudsters avoid these behaviors account transactions due to the risk of getting caught or due to potential disn Per1 Per2 turbances to their criminal schemes. Taking account of 4 100.00% 19.40% “what fraudsters would not do” in addition to “what fraud5 95.36% 23.13% sters would do” is beneficial to identifying normal users 6 93.30% 27.15% whose transaction characteristics are closer to fraudsters; 7 90.72% 30.80% intuitively, this improvement could alleviate the harass89 8875..6537%% 3374..3050%% ment to normal clients and hence reduce screening labor 10 78.87% 38.25% costs for fraud detection as well as reducing the heavy 11 69.59% 37.13% cost of dealing false alarms for banks [8]. But we find 12 64.43% 37.50% that our way of constructing features with respect to 13 58.76% 37.05% “what fraudsters would (not) do” could not be easily clas14 51.55% 35.00% sified into categories proposed by [ 5 ] and therefore we 15 47.42% 34.50% augmented the categories by inserting "Behavioral" and 16 43.81% 34.00% "Segmentation". 17 38.66% 31.88% Behavioral features denote specific transaction attributes that do not relate to RFM and anomaly detection techniques but are considered to be important in fraud transactions of these accounts during the time period is detection according to financial expertise. These features also the highest for ≤ 9 scenarios. include:

ATM_Transaction: It is defined as the number of ATM 4. Feature Construction transactions of all 9 aggregated transactions (defined in Table 2) of an account. A Bank-L’s expert suggests that [ 4, 3 ] create features to extract information from aggre- most EFT frauds include transferring and dispatching gated transaction data and then use these features to money through ATM services for it is faster and involves train a machine learning model. less risks of being caught. In fact, there are 405 types of

This approach is generally adopted in machine- transactions and creating features for every type results learning-based fraud detection papers. To comprehen- in unnecessary dimensions of inputs, deteriorating fraud sively analyze the characteristics of past features and detection performances. analyze their efectiveness, we collect features that can Immediate_Withdraw: be applied to our raw data in Table 4 from past literature, It is defined as the number of times a withdrawal hapincluding [ 10, 11, 8, 3, 4, 12, 7, 13, 1, 14, 5, 15, 16, 17 ], and pening right after a deposit within the same trading day. these features7 are denoted as Others in the following ex- This is because fraudsters strive to withdraw the illicit periments. On the other hand, we create two new sets of money prior to polices’ investigations and freezing the features: behaviors and segmentation, that are generated suspicious accounts. based on financial expertise or observations. Features Internet: that are first proposed in this paper will be denoted as It is defined as the number of times an account uses the Ours. The categories of Ours and Others features are il- E-bank service. Very few fraudsters ever used the E-bank lustrated in Table 5. The definitions of Others and Ours service since additional personal information should be features are listed in Table 4 and later in this section, provided at the bank counter in advance to enable certain respectively. Our experiments suggest that our proposed E-bank services like wire transfer. features can significantly improve the performance of Voice: Similar to the descriptions for Internet. the fraudulent detection model. LT_Count:

In addition to the aforementioned RFM features, [7] It is defined as the number of times an account conand [ 5 ] create features only based on anomaly proper- ducted "likely-legal" transactions, which are defined as ties of fraudulent accounts; this is, they focus solely on transaction types that have never been used by fraudulent identifying typical fraudulent behaviors. This is because accounts. Such transaction types may increase the risk fraudsters act very similarly to a normal user for most of being caught or identified, like withdrawal/deposit at of the time, and fraudulent behaviors usually take place bank counters, Or they are unrelated to criminal schemes, such as the purchase/redemption of funds provided by 7Some features like transaction locations that cannot be re- Bank-L. trieved from the raw data in Table 1 are ignored. Last_Withdrawal_Larger_Than_Savings: It indicates a specific scenario that the last withdrawal amount is larger fraudulent accessed numbers of a specific Bank’s ATMs than the account balance. This is because fraudsters are probably due to its management and location selecwould transfer as much illicit money as possible from tion policies8. For instance, ATMs located in the vicinity a fraudulent account under the limitation of the ATM: of police station are less likely to be accessed by fraudthe minimum withdraw amount is a 1000 or 100 Taiwan sters. dollar note. Note that no withdrawals can be made after the fraudulent account is frozen. Figure 2: Histogram and Percentile of the Number of Suspicious_Score: It computes the suspicious likelihood Fraudulent Accesses of a Bank’s ATMs. Each bar shows of frauds by the products of several suspicious features the the number of banks and the ratio (in parenthesis) to the and the equation is defined as follows: total number of banks.

(_ ℎ__ ℎ_) × (__)/ × (_ ℎ)/ × ( _ )/,

(1) where “Suspicious_Amount_Count” is a monetary feature proposed by [7] that denotes the maximum or the quick-transfer amount in an ATM. In Taiwan, the maximum inter-bank withdraw amount is $60,000 (Taiwanese Dollar). The maximum cross-bank withdraw amount is $20,000 plus the service fee $5. The maximum quicktransfer service is $10,000 plus the fee $5. The ATM withdraw menu is illustrated in Fig. 1 . Besides, denote the number of aggregated transactions defined in Table 2. This feature allows us to capture simultaneous occurrences of suspicious features to precisely identify fraudulent transactions. account to access "likely-legal ATMs", which are defined as ATMs that have been accessed by fraudsters less than 6 times. 6 is decided due to 95%(a widely adopted threshold in statistics) of ATMs in our training set data have been accessed more than 6 times (see Fig 3) by fraudulent accounts.

Suspicious_Branch: Label Whether an account’s transactions are performed in areas with dense fraudulent activities. Although actual ATM locations are not accessible from our raw data, we can identify the branch to which each ATM belongs by comparing a bank’s branches serial numbers and its ATM’s serial numbers. Since ATMs belonging to a bank’s branch ofice are normally located in its proximity, we can then profile each branch ofice with its own ATM data. We found that some ATMs have

Segmentation features label each account/ATM ma- only been accessed by fraudsters with Bank-L’s accounts. chine with the bank, branches, or other meaningful clas- We then label the ATM’s owner branches as suspicious sifications that they belong to. These features include: branches (see Fig. 4). Note that this label does not imply a Suspicious_ATM_Bank: We first calculate the number suspicious branch’s ATMs are only accessed by fraudsters of times each ATM has been accessed by fraudulent ac- since we can only access Bank-L accounts’ transaction counts and recognize its owner bank. Then we label data during a limited time span. the banks with top 5% lump sums (see Fig 2) of fraudulent ATM accesses as "Suspicious ATM Banks". 5% is a 8For example, a bank may corporate with a chain store to decommon statistical threshold for significance tests. High ploy ATMs to its branch stores.

Here we first sort the observations by chronological or

Xgboost Feature Importance der and divide the first 60% of the data as the training LFTe_aCtuoruenst I2m.0p8o4r1t0a4n4c6e ra1nk set and the last 40% for testing as illustrated in Table 6.

Average_Transaction_Interval 1.696345674 2 Then we compare the fraud detection performance with untrusted_frequent_trade_count 1.401884328 3 diferent machine learning models and input features as Big_onetime_deal_count 1.320201917 4 illustrated in the "Model+Data" column. It can be obBranchID_CPP 1.098959776 5 served that decision-tree-based models like XGBoost and

LGBM can often yield very good detection results but on

Table 3 ranks the importance of all features in Table rare occasions perform badly due to diferent input fea5, including the features constructed exclusively by us, tures.10 Specifically, using only Ours features produce a based on the method proposed in a top financial exper- very good F1-Score (73.95%) while incredibly low Recalls tise publication [21]. It can be observed that 3 out of 5 and F1-Scores are produced if all features in Table 5 are top important features belong to our proposed behav- included. It confirms [ 5 ] arguments that clever feature ioral or segmentation categories. It confirms [ 5 ] claims constructions do influence machine learning results since that clever feature engineering can yield good detection we could use less features (marked in red colors in Table results even with simple machine learning models. 5) to achieve similar prediction results. To check for the causes for the severe drop in performance, we adopted 5. Experiments 9See https://www.banking.gov.tw/en/home.jsp?id=17&parentpath=0,3 10https://medium.com/@aravanshad/gradient-boosting-versusAfter constructing a feature vector defined in Table 5 for trraenedsosmuc-fhoraessXt-GcfBa3ofoas8tf0adn8d0L GalBsoM saurgegmesotrse tsheantsitbivoeosttoedovderefitctiisnigon each account, we compare the fraud detection perfor- if the data is noisy. leave-one-out feature selection to monitor the change the training and the testing period are drawn from the in detection performance by repeatedly singling out one same distribution. We use Kolmogorov–Smirnov test (Kfeature each time for all features. We discover that the S test) to check for distribution similarity by calculating significant drops in recalls and F1-scores are caused by the likelihood of two realized distributions of samples two features from the (unsupervised) anomaly detection being drawn from the same distribution. category: LOF and KNN_ distance. Removing these two The null hypothesis is "the two distributions are drawn features as in the right panel of Table 6 could restore the from the same distribution" and we reject the null hypothXGBoost performance which the F1-score is 74.34% (with esis to adopt the alternative one – the two distributions Others+Ours without LOF&KNN_distance) and 68.42% are diferent– if the -value is small11. It can be observed (with Others without LOF&KNN_distance). Besides, al- that while the distributions of KNN_distance of legal acthough the performance of the non-linear-kernel SVM is counts stays relatively coherent in training and testing peworse than XGBoost when input parameters are properly riods (i.e., the -values are high), the distributions of both designed, SVM performance tends to increase with the KNN_distance and LOF of fraudulent accounts change number of features without sufering from the problem drastically represented by very small p-values. This varyof the aforementioned improper features, the non-linear- ing distribution phenomenon implies that the modus kernel SVM cannot provide feature importance for a bank operandi changes over time. It can also be observed that to profile fraudulent behaviors or to identify the weak- the increment of the -values of KNN_distance and LOF nesses of transaction process. of fraudulent accounts also increase the recall rate– the

To find the reason of this anomaly, we repeat the afore- likelihood to detect fraudulent accounts. Besides, the mentioned experiments with diferent proportions of the -value of LOF of legal accounts also vary mildly, imtraining/testing data in Table 7. If both LOF and KNN_ plying that the behaviors of legal accounts also change distance are removed, the F1-scores remain high and sta- with time but not as severe as fraudulent accounts. The ble (from 71% to 80%) regardless of the changes of the precision value even drops to 87.5% at the extreme case proportion of the training data. On the other hand, incor- (-value=0.003% when the training set accounts for 70% porating LOF and KNN_ distance varies fraud detection of data). results significantly with the changes of the training data To confirm the aforementioned argument, we conproportion. Note that precision rates are stable and high( struct the training and the testing set by randomly sam87.5%∼ 100%) but the recall rates vary significantly (1.49% pling 60% and 40% of the aggregated transaction data, to 70.59%). Because KNN_distance and LOF profiles an respectively, instead of separating the training/testing account’s overall behavior (or the modus operandi for data chronologically. Unlike the results in Table 6, the exa fraudster), we can examine whether the patterns of modus operandi change in the training and the testing 11The null hypothesis is rejected with 99% confidence interval period by checking whether KNN_distance (or LOF) from if < 0.01. with Others", even outperforming their counterpart models that remove LOF and KNN_ distance. This is because randomly sampling the training and testing set data from the same time span makes the KNN_distance (or LOF) distributions of the training and the testing set the same.

This further implies that the model could foresee the

change of future modus operandi beforehand, which is impractical in practice. Given the fast changing modus operandi, we conclude that it is inappropriate to examine a fraud detection model by random sampling.

6. Conclusion

This research constructs fraudulent detection features

based on financial expertise and the characteristics of both fraudulent and non-fraudulent accounts. We identify the time-varying properties of the features that deteriorate detection performance. We show that combining

XGBoost with our features provides very good detec

tion performance and interpretability. The value of our feature constructions can be verified by showing that they occupy three out of the five most important features under the ranking procedure proposed in a premium ifnancial journal [21]. 382.

– 613. [1] C. Tai, T. Kan, Identifying money laundering accounts, in: 2019 International Conference on System Science and Engineering (ICSSE), 2019, pp. 379– [2] R. J. Bolton, D. J. Hand, Statistical fraud detection:

A review, Statistical Science 17 (2002) 235–249.

[3] S. Bhattacharyya, S. Jha, K. Tharakunnel, J. C. Westland, Data mining for credit card fraud: A comparative study, Decision Support Systems 50 (2011) 602 113492. [6] X. Zhang, Y. Han, W. Xu, Q. Wang, Hoba: A novel feature engineering methodology for credit card fraud detection with a deep learning architecture, Information Sciences 557 (2021) 302– 316. URL: https://www.sciencedirect.com/science/ org/10.1016/j.ins.2019.05.023. card fraud detection from a practitioner perspective, Expert Systems with Applications 41 (2014) 4915–4928. doi:10.1016/j.eswa.2014.02.026. feature extraction method for credit card fraud de[11] A. Dal Pozzolo, G. Boracchi, O. Caelen, C. Alippi, tection, in: 2019 2nd International Conference on Intelligent Autonomous Systems (ICoIAS), 2019, pp. 70–75. doi:10.1109/ICoIAS.2019.00019. [8] A. Correa Bahnsen, D. Aouada, A. Stojanovic, B. Ot

G. Bontempi, Credit card fraud detection: A real

istic modeling and a novel learning strategy, IEEE Transactions on Neural Networks and Learning Systems PP (2017) 1–14. doi:10.1109/TNNLS.2017. tersten, Feature engineering strategies for credit 2736643. card fraud detection, Expert Systems with Applica[12] A. Correa Bahnsen, D. Aouada, A. Stojanovic, B. Ottions 51 (2016). doi:10.1016/j.eswa.2015.12. 030. tersten, Detecting credit card fraud using periodic features, 2015, pp. 208–213. doi:10.1109/ICMLA. [9] A. Abdallah, M. A. Maarof, A. Zainal, Fraud de2015.28. tection system: A survey, Journal of Network and [13] V. Van Vlasselaer, C. Bravo, O. Caelen, T. EliassiComputer Applications 68 (2016) 90 – 113. [10] A. Dal Pozzolo, O. Caelen, Y.-A. Le Borgne, S. Waterschoot, G. Bontempi, Learned lessons in credit

Rad, L. Akoglu, M. Snoeck, B. Baesens, Apate: A

novel approach for automated credit card transaction fraud detection using network-based exten(a) Training and testing sets sampled chronologically. Feature set used: Others and Ours Accuracy

Precision

Recall

F1-Score 48. URL: https://www.sciencedirect.com/science/ [14] D. Cheng, S. Xiang, C. Shang, Y. Zhang, F. Yang,

L. Zhang, Spatio-temporal attention-based neural network for credit card fraud detection, in: Proceedings of the AAAI Conference on Artificial In

org/10.1016/j.future.2019.08.029.

References

[4] C. Whitrow , D. Hand , P. Juszczak , D. Weston , N. Adams , Transaction aggregation as a strategy for credit card fraud detection , Data Mining and Knowledge Discovery 18 ( 2009 ) 30 - 55 .

[5] B. Baesens , S. Höppner , T. Verdonck , Data engineering for fraud detection , Decision Support Sys [7] Y. Xie , G. Liu, R. Cao , Z. Li , C. Yan , C. Jiang , A O. Caelen , M. Granitzer , S. Calabretto , Towards automated feature engineering for credit card fraud detection using multi-perspective hmms , Future Generation Computer Systems 102 ( 2020 ) 393 - 402 . URL: https://www.sciencedirect.com/science/