A payment fraud detector must distinguish suspicious transactions from legitimate ones quickly enough to guide decisions. Supervised learning uses historical transactions labeled “fraudulent” or “legitimate” to learn a mapping from transaction features to outcomes. Its output is typically a fraud risk score, not just a yes-or-no classification. It is strongest at recognizing patterns represented in reliable past labels. section 7.4.3 section 8.1
Build the detector as a data-to-decision workflow:
- Assemble transaction features and trustworthy labels. Chargebacks, human reviews, and validated legacy alerts can supply ground truth, but label quality directly limits model quality. section 8.1.1
- Address class imbalance during training. Oversampling methods such as SMOTE add synthetic fraud examples; undersampling removes some legitimate examples. Cost-sensitive learning instead penalizes missed fraud more heavily. section 8.1.1
- Choose a model suited to the data, inference speed, computing budget, and explainability needs. Options include interpretable logistic regression, tree-based models, gradient boosting, support vector machines, and neural networks. section 7.4.3
- Evaluate on imbalanced data using precision, recall, F1, and AUC-PR rather than accuracy alone. Then examine Precision@TopN% and Fraud Capture Rate@TopN% to relate alert thresholds to review capacity. section 8.1.1 section 8.5
A practical classifier
An imblearn pipeline combines SMOTE with a LightGBM classifier. RandomizedSearchCV tunes the model, which is then evaluated on an imbalanced test set. The resulting risk ranking can be assessed against the number of alerts a review team can handle; approving every transaction might otherwise appear highly accurate while catching no fraud. section 8.5 section 8.1.1
A supervised score belongs within a wider fraud system: the data asset layer supplies features, the modeling layer produces predictions, and strategy, monitoring, and application layers turn them into controlled actions. Rich context can help distinguish unusual but legitimate behavior, such as travel, from fraud and reduce false positives. When reliable labels are unavailable or a threat is novel, unsupervised anomaly detection serves a different purpose. section 8.0 section 8.5
