Card fraud: what a review budget buys

Split by time. Models fit on 2019-01-01 to 2020-03-20 (1,070,966 transactions, 6,250 fraud). 2020-03-21 to 2020-06-21 picks the threshold. 2020-06-21 to 2020-12-31 is the test. A random split would let the model see the same card's fraud spree on both sides.

Features a bank has at that moment. The transaction itself (amount, category, hour, weekday, distance from the cardholder's home to the merchant) and the card's own history up to, not including, this transaction: time since its last use, count and spend over the previous 24 hours, and the amount against the card's average so far. The random forest leans most on the amount, the card's spend in the last 24 hours, the amount against the card's usual amount.

Two models, two jobs. The random forest learns the fraud patterns that were labelled. The isolation forest scores how easy a transaction is to isolate with random splits: it needs no labels, so it can flag new kinds of fraud, at the price of many more false alarms.

Earlier version. This rebuilds my 2025 fraud notebook. It one-hot encoded merchants and jobs into 2,150 columns and tuned its threshold on a random 20% of the training file, but then fit the models on the whole file, those rows included. Validation F1 read 0.850; the test file gave 0.675. Here the threshold comes from later months the models never fit on, and per-card history replaces the one-hot columns.