A fraud team may need to spot a new attack before it has enough confirmed cases to train on. Unsupervised learning addresses that gap by learning patterns in data without relying on labeled fraud outcomes. In anomaly detection, it learns what normal financial behavior looks like from data assumed to be predominantly legitimate, then flags significant departures for investigation. A flag is a lead, not a fraud verdict. section 7.4.3 section 8.4
Several methods can expose departures from normal activity:
- K-means and DBSCAN group similar transactions; outliers or very small clusters may be suspicious. section 7.4.3
- Local Outlier Factor looks for observations that are unusual relative to their local neighborhood. section 7.4.3
- Autoencoders learn to reconstruct normal inputs; a high reconstruction error signals an anomaly. PCA can be used similarly. Isolation forest and one-class SVM are other listed options. section 7.4.3
Supervised fraud models learn from historical labeled cases and are useful for recognizing known patterns. Unsupervised detection instead looks for activity that does not fit the learned norm, making it useful when labels are scarce or emerging tactics may differ from past attacks. section 7.4.3 section 8.4



















