A machine learning model is trained to predict risk from patterns in past data, used to score transactions, entities, or sessions at decision time. It generalizes to new fraud better than static rules, but it needs labels, monitoring, and retraining to stay sharp.
What is a machine learning model, in plain English?
A machine learning model learns patterns from historical data instead of following instructions someone wrote by hand. You feed it many past cases, each labeled fraud or not fraud, along with their features, and it works out the combinations of signals that tend to go with fraud. At decision time it takes a new case and outputs a score or a prediction.
The advantage over a hand-written rule is that a model can pick up subtle, multi-signal patterns and generalize to variations a rule would miss. A rule fires on an exact condition; a model can recognize something that merely resembles past fraud, catching new twists on old tricks.
In the detection stack the model is the nuanced scorer. It rarely works alone: it produces the risk score, and rules and thresholds decide what to do with it. But everything the model knows comes from its training data, which is both its strength and its weakness.
Models versus rules
Models and rules are not rivals so much as different tools. Knowing what each is good at is the point.
What changes | Hand-written rule | Machine learning model |
How it decides | Exact conditions you specify | Patterns learned from data |
New fraud | Misses anything not written down | Generalizes to close variations |
Explainability | Clear and easy to state | Harder to spell out |
Upkeep | Manual edits as fraud shifts | Labels, monitoring, retraining |
The trade is adaptiveness against transparency and upkeep. That is why most teams run both: models for nuanced scoring, rules for hard policy and decisions that must be clearly explained.
What it looks like in practice
In practice
A team trains a model on a year of labeled transactions and it performs beautifully at launch, catching subtle fraud the old rules never touched. Everyone is happy, and attention moves elsewhere.
Six months on, a new fraud crew changes its playbook, using different devices, amounts, and timing. The model was never trained on this behavior, so it scores the new fraud as safe. Nothing breaks and no alarm sounds; the model just quietly catches less while the attackers keep adapting. Only ongoing monitoring of score-versus-outcome and loss rate reveals the decay, and a retrain on fresh labels restores it. Left alone, the model would have degraded silently until losses spiked.
Why models and rules run together
A model buys you adaptiveness: it catches variations of fraud that no one thought to write a rule for. But it comes with obligations. It needs labeled outcomes to learn from, constant monitoring to catch decay, and periodic retraining as fraud shifts. It can also inherit bias or leakage from its training data, learning the wrong thing in a way that is hard to spot until it fails live.
Its reasoning is also harder to explain than a rule's, which matters when you owe a customer or a regulator a clear reason for a decision. That is why models and rules almost always run together: the model handles nuanced scoring, while rules enforce hard policy and provide clean, statable reasons where they are required. And because a model degrades silently as fraud moves away from what it learned, the real work is watching for drift and decay all the time, not just at launch.
What to watch in the data
- Silent decay. A model degrades without any error as fraud shifts; only score-versus-outcome and loss monitoring reveal it.
- Label quality. The model is only as good as its labels; missing or wrong labels teach it the wrong patterns.
- Leakage and bias. A feature that encodes the answer, or a skewed training set, can make a model look strong offline and fail or discriminate live.
- Retrain cadence. A model that has not been retrained in a long time is probably tracking a fraud world that no longer exists.
- Explainability gaps. If you cannot state why the model declined a case, you may struggle to meet customer or regulatory expectations.
Quick questions
Do models replace rules?
No. Most teams run both. Models handle nuanced, multi-signal scoring; rules enforce hard policy and give clear, explainable decisions. They complement each other rather than competing.
Why does a model degrade over time?
Because it learned from past data, and fraud tactics and customer behavior keep changing. As the world drifts away from the training set, the model catches less. This is model drift, and it is silent without monitoring.
What does a model need to work well?
Good labeled data, quality features, ongoing monitoring, and periodic retraining. Without labels it cannot learn; without monitoring you cannot see decay; without retraining it falls behind current fraud.
Can a model be biased?
Yes. It can inherit bias or leakage from its training data, learning correlations that are unfair or that fail to hold live. This is why validation, monitoring, and governance matter as much as the model itself.
Why is a model harder to explain than a rule?
A rule states an exact condition, so its reason is obvious. A model weighs many signals together, so pinning a single clear reason on a decision is harder, which is why rules often sit alongside it for explainable cases.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.