Real-Time Fraud Detection Systems: Architecting Low-Latency Neural Networks

The latency budget shapes the architecture

Fraud decisioning at the point of authorisation typically has a budget in the tens of milliseconds. That single constraint determines almost every downstream choice: which features can be computed inline, how large the model can be, whether an external lookup is affordable, and what happens when a dependency is slow.

The practical approach is to decompose the budget explicitly — feature retrieval, model inference, rules evaluation, network overhead — and to define a safe default decision for timeouts. A system that fails open on every hiccup is a fraud vector; one that fails closed without care destroys legitimate revenue.

Streaming features and consistency

Most predictive power in fraud comes from short-window aggregates: transactions per card in the last minute, distinct merchants in the last hour, velocity of address changes, deviation from the entity's own baseline. These must be computed in a streaming layer and served from a low-latency store, while the identical definitions are used to build historical training sets with point-in-time correctness.

• Windowed velocity and counting features across card, device, merchant and IP.
• Deviation features comparing the event to the entity's own history.
• Graph features capturing shared devices, addresses or payment instruments.
• Sequence models over recent event history where the latency budget allows.
• Deterministic fallbacks when a feature source is unavailable.

Imbalance, thresholds and the cost matrix

Fraud is rare, so accuracy is meaningless and even area under the ROC curve can mislead. Precision-recall analysis, and precision at the operating recall the review team can absorb, are the metrics that matter. Thresholds should be set from an explicit cost matrix: expected loss from a missed fraud against the revenue and trust cost of a false decline and the marginal cost of a manual review.

Because adversaries adapt, thresholds and models both need continuous evaluation. Reserve a small randomised holdout that bypasses blocking where risk tolerance allows, so unbiased performance remains measurable rather than being masked by the system's own interventions.

Hybrid decisioning and operability

Production systems pair a neural scorer with a rules engine. Rules deliver instant response to a newly observed attack pattern and encode regulatory or contractual constraints; the model captures the diffuse signal rules cannot express. Keeping them separate but jointly evaluated preserves both agility and statistical power.

Operability completes the design: reason codes for every decision so analysts and regulators can interpret it, a feedback loop that returns chargeback and investigation outcomes as labels, shadow deployment for candidate models, and per-segment monitoring so a localised attack does not hide inside a healthy aggregate.