PayLink processes roughly 8 million card transactions per day across web and mobile checkout. The risk team wants an anomaly detection system that flags suspicious transactions for manual review and requires a clear explanation of why the chosen detection approach is appropriate.
You are given 12 months of transaction-level data with historical review outcomes for a subset of transactions. Most transactions are legitimate, labels are incomplete, and fraud patterns change over time.
| Feature Group | Count | Examples |
|---|---|---|
| Transaction attributes | 14 | amount, currency, merchant_category, payment_method, hour_of_day |
| Customer behavior | 11 | avg_txn_amount_7d, txn_count_24h, device_count_30d, chargeback_rate_90d |
| Device / network | 9 | device_id_hash, ip_risk_score, country_mismatch, browser_family |
| Merchant context | 6 | merchant_id, merchant_risk_tier, refund_rate_30d |
| Labels / metadata | 4 | reviewed_fraud, chargeback_flag, event_time, transaction_id |
A good solution should detect unusual transactions early enough for review, achieve strong ranking quality on labeled data, and provide a defensible explanation for why the chosen method fits sparse labels and evolving fraud behavior.