A fraud team needs to catch transaction patterns it has never seen before. Anomaly detection flags observations that differ substantially from normal behavior, even when examples of the new threat have no fraud labels. It is broader than fraud detection: an unusual transaction might reflect fraud, a data error, a malfunction, or legitimate behavior such as travel. Conversely, fraud can resemble ordinary activity. An anomaly is a reason to investigate, not a verdict. section 7.3 section 8.4 section 8.5
An autoencoder provides one practical route from normal transactions to reviewable alerts:
- Train it on legitimate transactions to reconstruct its inputs; validate on a separate legitimate set and inspect training and validation loss. section 8.4.3
- Score incoming transactions by reconstruction error. A large error signals a departure from the patterns learned during training, not proof of intentional deception. section 8.5 section 7.3
- Choose an alert threshold using normal-error statistics, review capacity, and tolerance for customer friction. Test it in shadow mode before allowing alerts to affect transaction decisions. section 8.5 section 8.4.6
Listing 8.11 Training the autoencoder on legitimate transactions
# Ensure X_train_autoencoder_legit is available from Listing 8.9
# Splitting legitimate training data (X_train_autoencoder_legit) for AE's own validation during training
X_train_ae_actual_fit, X_val_ae_actual_fit = train_test_split(
X_train_autoencoder_legit, test_size=0.2, random_state=42
) # A
num_epochs_ae = 50
batch_size_ae = 512
# Callbacks
early_stopper_ae = EarlyStopping(monitor='val_loss', patience=10, verbose=1, restore_best_weights=True)
# It's good practice to save the best model.
model_checkpoint_ae = ModelCheckpoint(
'best_autoencoder_model_ch8.keras', monitor='val_loss', save_best_only=True, verbose=0
)
print(f"\nTraining autoencoder on {X_train_ae_actual_fit.shape[0]} legitimate samples, validating on {X_val_ae_actual_fit.shape[0]} legitimate samples...")
history_ae = autoencoder_model.fit(
X_train_ae_actual_fit, X_train_ae_actual_fit, # Input and Target are the same
epochs=num_epochs_ae,
batch_size=batch_size_ae,
shuffle=True,
validation_data=(X_val_ae_actual_fit, X_val_ae_actual_fit), # Using the split validation set
callbacks=[early_stopper_ae, model_checkpoint_ae], # Include checkpointing
verbose=1
).history
print("\nAutoencoder training completed.")
# Plot training & validation loss
plt.figure(figsize=(10, 6))
plt.plot(history_ae['loss'], label='Train Loss (MSE)', linestyle='-') # A solid line for training loss
plt.plot(history_ae['val_loss'], label='Validation Loss (MSE)', linestyle='--') # A dashed line for validation loss
plt.title('Autoencoder Model Loss During Training', fontsize=14)
plt.ylabel('Loss (Mean Squared Error)', fontsize=12)
plt.xlabel('Epoch', fontsize=12)
plt.legend(loc='upper right')
plt.grid(True)
plt.show()
The training listing shows a legitimate-only train–validation split, early stopping on validation loss, and a checkpoint for the best autoencoder model. These checks help establish that reconstruction of normal transactions has been learned before errors are used to flag departures. section 8.4.3
Run anomaly detection alongside supervised models that recognize known fraud patterns. Combine its scores with context, business rules, and analyst review rather than automatically treating every alert as fraud. Monitor alert volume, the share of reviews yielding meaningful findings, and the reconstruction-error distribution; recalibrate the threshold as customer behavior and fraud tactics change. Keep decisions explainable and auditable, particularly when they could block a transaction or freeze an account. section 7.3 section 8.4.6
