Machine Learning Fraud Detection Using Python Training Course

Participants can assess fraud datasets, construct usable labels and document data limitations.

• Transaction, customer, merchant, device and case-management data sources
• Confirmed fraud labels, disputed transactions and delayed outcome windows
• Chargeback, recovery and investigation outcomes reconciled into target labels
• Label contamination caused by unresolved cases and manual-review decisions
• Data dictionaries recording field meaning, timing, source and quality
• Evidence lineage from raw events through modelling dataset construction

Participants can use a reproducible Python notebook workflow for fraud-data analysis.

• Jupyter notebooks structured for reproducible fraud-model development
• pandas DataFrames loaded, inspected and filtered using transaction identifiers
• Data types corrected for timestamps, amounts, categories and binary flags
• Missing values profiled by fraud outcome and operational data source
• Versioned input files and random seeds recorded for repeatable results
• Notebook outputs organised into analysis, modelling and review sections

Participants can identify fraud patterns, data defects and initial modelling hypotheses.

• Fraud rates segmented by channel, country, merchant and payment type
• Transaction amounts compared across legitimate and confirmed-fraud populations
• Time-of-day and day-of-week patterns plotted for fraud events
• Duplicate transactions, reversals and impossible timestamps identified systematically
• Customer tenure and transaction velocity distributions examined for anomalies
• Investigation outcomes compared with model-ready fraud labels

Participants can create predictive transaction and customer behaviour features without future-data leakage.

• Transaction velocity features calculated across minutes, hours and days
• Rolling customer spend, count and amount features built historically
• Merchant novelty and geographic distance features derived from prior activity
• Device, IP address and payment-token reuse indicators constructed
• Ratio features comparing current amount with customer spending history
• Feature timestamps checked against the fraud decision point

Participants can establish transparent baselines for comparing fraud detection models.

• Existing fraud rules translated into measurable decision logic
• Logistic regression fitted as an interpretable fraud-risk baseline
• Odds ratios interpreted for selected transaction and behavioural features
• Rule-only, model-only and combined strategies compared against labels
• Score bands created for low, medium and high-risk transactions
• Baseline assumptions documented before more complex model development

Participants can train tree-based fraud models and control their complexity.

• Decision trees split transaction populations using fraud-predictive variables
• Tree depth and minimum leaf size controlled against overfitting
• Random forests trained using bootstrap samples and feature subsampling
• Feature importance reviewed alongside fraud-domain plausibility checks
• Partial dependence plots examined for major behavioural risk drivers
• Tree models compared with logistic regression on validation data

Participants can address rare fraud events without distorting model evaluation.

• Fraud prevalence quantified before selecting sampling or weighting methods
• Class weights applied to penalise missed fraud more heavily
• Random undersampling evaluated against lost legitimate transaction information
• SMOTE synthetic examples assessed for suitability in transaction data
• Training samples separated from untouched validation and test populations
• Sampling effects measured using precision, recall and PR-AUC

Participants can validate fraud models under realistic future-use conditions.

• Chronological train, validation and test periods defined before modelling
• Out-of-time testing used to estimate future fraud detection performance
• Target leakage identified in chargeback, case and post-event fields
• Feature availability checked at transaction authorisation or review time
• Customer overlap assessed across training and testing time windows
• Validation findings recorded in a model development evidence log

Participants can select models using fraud-loss, workload and customer-impact measures.

• Confusion matrices interpreted for fraud detection operational decisions
• Precision, recall, specificity and false-positive rate calculated correctly
• Precision-recall curves used for rare-event model comparison
• ROC-AUC limitations recognised under severe class imbalance conditions
• Expected fraud loss estimated using transaction value and recovery assumptions
• Alert volumes compared with available investigator review capacity

Participants can set score thresholds that reflect financial and operational constraints.

• Risk scores converted into ranked fraud investigation queues
• Thresholds selected using precision targets and daily alert capacity
• Different thresholds assigned to payment channels and customer segments
• Decline, step-up authentication and review actions linked to scores
• Score bands monitored for fraud rates and customer treatment
• Threshold changes governed through documented approval and testing

Participants can apply unsupervised methods where confirmed fraud labels are incomplete.

• Unsupervised detection positioned beside supervised fraud classification models
• Isolation Forest scores calculated for unusual transaction behaviour
• Local Outlier Factor applied to dense transaction feature spaces
• Novelty detection separated from historical anomaly identification tasks
• Anomaly alerts sampled for investigator review and feedback
• Unsupervised results assessed without assuming anomalies are fraud

Participants can identify connected entities that indicate mule networks and organised fraud.

• Customer, account, device and merchant links represented as graphs
• Shared identifiers used to identify connected suspicious account clusters
• Degree, centrality and connected-component features calculated for entities
• Mule-account indicators derived from inbound and outbound transfer patterns
• Network features combined with transaction-level risk scores carefully
• Graph findings documented with supporting transaction and entity evidence

Participants can explain fraud scores at portfolio and individual-alert level.

• Global feature importance assessed for model behaviour and plausibility
• SHAP values used to explain individual transaction risk scores
• Reason codes written for investigators using understandable fraud signals
• Correlated features reviewed before relying on importance rankings
• Explanation outputs checked against transaction facts and case evidence
• Adverse customer actions distinguished from investigator-facing explanations

Participants can connect fraud model outputs to case management and label improvement.

• Alert fields designed for rapid investigator triage and evidence gathering
• Case outcomes standardised into confirmed, declined and inconclusive labels
• Investigator feedback captured without introducing target leakage
• Quality assurance samples reviewed for decision consistency and accuracy
• Escalation paths defined for high-value and linked fraud alerts
• Feedback cycles scheduled for feature review and model retraining

Participants can design monitoring measures for fraud performance, data quality and changing patterns.

• Population Stability Index calculated for score and feature distributions
• Fraud-rate shifts monitored by channel, segment and score band
• Precision and recall tracked after delayed fraud outcomes mature
• Data-quality controls detect missing fields, range changes and latency
• Champion-challenger models compared using controlled production evidence
• Retraining triggers defined for drift, loss deterioration and fraud changes

Participants can document fraud models for review, approval and accountable use.

• Model purpose, intended users and prohibited uses documented clearly
• Development, validation and approval responsibilities assigned through governance
• Fairness tests compare error rates across relevant customer groups
• Privacy minimisation applied to personal and device-related data
• Model inventory entries record version, owner, inputs and limitations
• Independent review evidence prepared for audit and model risk teams

Participants can specify a controlled production process for fraud scoring and alert delivery.

• Batch and real-time scoring architectures compared for fraud use cases
• Input data contracts specify fields, formats, timing and ownership
• Score outputs routed to authorisation systems and case queues
• Fallback rules defined for unavailable models and incomplete data
• Release checklists cover testing, approvals, rollback and communications
• Operational handover assigns monitoring, incident and threshold-change ownership

Participants can critically review a fraud model for technical, operational and governance weaknesses.

• Problem statements checked against intended fraud decision and action
• Data lineage reviewed for label quality, timing and missing fields
• Validation evidence challenged using out-of-time results and leakage tests
• Threshold rationale tested against losses, workload and customer outcomes
• Explainability outputs reviewed for investigator usefulness and plausibility
• Monitoring plans assessed for timely detection of performance deterioration

Participants can build, review and present a complete fraud detection model package for a banking use case.

• Fraud use case defined with decision, loss and capacity assumptions
• Transaction dataset prepared with documented labels and feature definitions
• Python model trained using time-based validation and imbalance treatment
• Threshold selected using precision, expected loss and queue capacity
• Model explanations prepared for investigators, managers and governance reviewers
• Monitoring plan, deployment controls and limitations presented for review