A fraud score is not yet a decision. A threshold is a cutoff that turns a measured value into a label or action. In finance, the value might be a fraud score, an anomaly score, a credit score, or a daily return. The cutoff should reflect the decision being made, not just the distribution of model outputs. section 7.4.4 section 8.4.6 section 10.4.1 section 5.3.7
Place the cutoff at the right point in the workflow:
- Define a prediction target: classify SPY’s next-day return as bullish above +1%, bearish below −1%, and neutral between those limits, inclusive. This filters smaller moves from the training labels; it is not a trading instruction. section 10.4.1
- Translate fraud scores into actions: illustrative bands send low-risk transactions below 0.2 to auto-approval, intermediate scores around 0.2–0.7 to authentication or review, and scores above 0.7 to decline or urgent investigation. A strategy team sets the bands against risk appetite, customer experience, review capacity, and obligations. section 7.4.4
- Set an anomaly alert boundary: with no fraud labels on incoming payments, flag reconstruction errors above a chosen cutoff. Start from a high percentile of trusted legitimate errors, or choose the error value that produces a manageable alert volume—for example, about 100 reviews per day. section 8.4.6
- Apply credit policy: after converting default probabilities to an operational score, illustrative rules approve scores of at least 580, review 550–579, and reject scores below 550. Here lower scores indicate greater risk, so the direction of comparison matters. section 5.3.7
Listing 10.3 Creating realistic target labels
import numpy as np
def create_target_labels(data, threshold=0.01):
"""Create next-day directional labels with realistic thresholds"""
returns = data['SPY_close'].pct_change().shift(-1) #1
conditions = [
(returns > threshold), # Bullish moves
(returns < -threshold) # Bearish moves
]
choices = [1, -1] # 1: Up, -1: Down
data['target'] = np.select(conditions, choices, default=0) #2
return data.dropna()
etf_data_labeled = create_target_labels(etf_data)
print(f"Target distribution:\n{etf_data_labeled['target'].value_counts()}")
The Python listing calculates next-day percentage returns, applies a configurable ±1% cutoff with `np.select`, and prints the resulting bullish, bearish, and neutral label counts. Inspect the class distribution when changing the cutoff: roughly three-quarters of days are neutral at the illustrated setting. section 10.4.1
A threshold is a tunable policy choice, not a permanent model constant. For fraud alerts, simulate review volume and customer friction, test in shadow mode with analyst feedback, and monitor fraud rates and false positives. Recalibrate as attacks, applicants, markets, or priorities change; keep explicit business rules alongside score-based decisions. A narrower alert boundary may catch more suspicious activity while creating more reviews, so assess the operational effect before rollout. section 7.4.4 section 8.4.6 section 1.4.2 section 8.5
