🛡️ FraudLens — Real-Time UPI Fraud Detection & Causal Inference Platform

Production-grade financial fraud intelligence combining 4-model ensemble anomaly detection, sub-millisecond vector similarity search, and Difference-in-Differences (DiD) econometrics.

1M+ calibrated transactions • 29,000+ vector indexed frauds • Causal impact verification of 2FA (ATE = -0.73pp, p = 0.013)

---

📌 Problem & Motivation

India's Unified Payments Interface (UPI) processes over 16 billion transactions every month (NPCI, 2025). With volumes at this scale, even a 0.05% fraud rate represents hundreds of crores in direct consumer and banking losses.

Most fraud detection systems suffer from two fatal flaws:

1. Prediction in a vacuum: They flag transactions but cannot statistically prove whether security interventions (like mandatory 2FA or biometric prompts) actually caused fraud reduction.
2. Cold-start & latency limits: Pure supervised models fail on zero-day fraud pattern variants and can create checkout latency spikes.

FraudLens addresses both challenges with a production-ready three-service architecture: an ensemble ML & sub-millisecond FAISS vector search pipeline for detection, coupled with an econometric Difference-in-Differences (DiD) engine to measure the true causal impact of security policies.

---

🏛️ System Architecture

┌─────────────────┐       HTTP POST        ┌─────────────────────────┐
│ Client / Webhook│───────────────────────▶│     FastAPI Gateway      │
└─────────────────┘                        │       (api.py)          │
                                           └────────────┬────────────┘
                                                        │
                         ┌──────────────────────────────┴──────────────────────────────┐
                         ▼                                                             ▼
             ┌─────────────────────────┐                                   ┌───────────────────────┐
             │ Synchronous Fallback    │                                   │ Redis Message Broker  │
             │ (In-process evaluation) │                                   └───────────┬───────────┘
             └─────────────────────────┘                                               │
                                                                                       ▼
                                                                           ┌───────────────────────┐
                                                                           │ Celery Async Worker   │
                                                                           │ (Distributed Queue)   │
                                                                           └───────────┬───────────┘
                                                                                       │
                         ┌─────────────────────────────────────────────────────────────┘
                         ▼
        ┌─────────────────────────────────────────────────┐
        │       Multi-Strategy Fraud Engine               │
        │                                                 │
        │  1. Z-Score Statistical Variance (User Profile) │
        │  2. Isolation Forest (Unsupervised Anomalies)   │
        │  3. RBI Heuristic Rule Validator                │
        │  4. FAISS L2 Vector Similarity (Nearest Frauds) │
        └────────────────────────┬────────────────────────┘
                                 │
                                 ▼
        ┌─────────────────────────────────────────────────┐
        │  Econometric & Causal Verification Engine       │
        │  • Difference-in-Differences (DiD) Estimation   │
        │  • Parallel Trends Test & Placebo Verification  │
        └─────────────────────────────────────────────────┘

Stack Components:

• API Gateway (FastAPI + Uvicorn): Serves real-time inference and econometric analytics endpoints with automatic OpenAPI documentation.
• Async Queue (Celery + Redis): Offloads high-throughput transaction batches and background index optimization.
• Vector Search (Meta FAISS): High-dimensional vector index mapping transactions to nearest confirmed fraud signatures.
• Analytics (Streamlit + Power BI): Executive KPI tracking, Benford's Law distribution analysis, and interactive model exploration.

---

🚀 Core Innovations & Capabilities

1. 🔍 4-Tier Ensemble Fraud Detection

Transactions are evaluated against 4 distinct analytical methodologies:

Method	Technique	Primary Target
Z-Score Deviations	Rolling baseline statistics per user	Sudden spikes in transaction magnitude
Isolation Forest	Unsupervised tree-based anomaly isolation	Novel, multi-dimensional statistical outliers
Rule-Based Engine	RBI regulatory heuristics	Structuring (<₹10K), odd hours (1–5 AM), burst velocity
FAISS Vector Search	L2 distance in 11D latent space	Geometric proximity to 29k+ known fraud vectors

Consensus Engine: A transaction is flagged when 2 or more independent models reach consensus, drastically suppressing false positive rates while maintaining high sensitivity.

2. ⚡ FAISS Vector Similarity Search

Every transaction is embedded into an 11-dimensional normalized vector:

[amount_norm, hour_sin, hour_cos, dow_sin, dow_cos, is_night,
 is_weekend, velocity_norm, amount_zscore, city_tier, txn_type]

• Indexed using Meta's IndexFlatL2 over 29,139 confirmed fraud patterns.
• Delivers sub-millisecond nearest-neighbor search, returning a calibrated fraud_similarity_score between 0.0 and 1.0.

3. 📉 Causal Inference: Effect of 2FA on Fraud

Instead of standard observational correlation, FraudLens applies Difference-in-Differences (DiD) econometrics to quantify policy impact:

Research Question:

Does enforcing 2-Factor Authentication (2FA) causally decrease the probability of UPI fraud, independent of city tier and user volume?

Econometric Specification:

$$\text{is_fraud}_{it} = \beta_0 + \beta_1(\text{has_2fa}_i) + \beta_2(\text{post}_t) + \beta_3(\text{has_2fa}_i \times \text{post}_t) + \mathbf{X}'_{it}\boldsymbol{\gamma} + \varepsilon_{it}$$

• $\beta_3$ = Average Treatment Effect (ATE) estimated via OLS with HC1 heteroscedasticity-robust standard errors.
• Deliberately Confounded Assignment: 2FA adoption mirrors real-world adoption skew (higher in Tier-1 cities and tech-first banks), requiring robust DiD controls.

Econometric Validation Results:

Metric	Value	Interpretation
ATE ($\beta_3$)	-0.0073	2FA reduces fraud probability by 0.73 percentage points
95% Confidence Interval	[-0.013, -0.0016]	Strictly negative bound; confirms true protective effect
p-value	0.013	Statistically significant at the 5% level ($p < 0.05$)
Parallel Trends Test	Valid ($p = 0.40$)	Pre-treatment trajectories of treatment & control are identical
Placebo Timing Test	Passed ($p = 0.99$)	Zero effect detected when evaluated on simulated pre-policy date
Sample Size ($N$)	100,000	Full population sub-sample with $R^2 = 0.118$

---

📊 Performance Benchmarks

Methodology	Precision	Recall	F1-Score	Detection Speed
Z-Score Anomaly	34.4%	36.7%	35.5%	< 0.5 ms
Isolation Forest	57.6%	61.0%	59.3%	~ 2.1 ms
RBI Rule Heuristics	73.9%	54.4%	62.7%	< 0.2 ms
Ensemble (Consensus 2+)	69.1%	53.9%	60.6%	**~ 1.8 ms**
FAISS Vector Query	71.2%	68.4%	69.8%	< 0.8 ms

---

📡 API Endpoints & Usage

Method	Route	Description
GET	/health	Live health probe & vector index readiness check
POST	/fraud/score	Real-time transaction scoring via ensemble + FAISS
POST	/fraud/batch	High-throughput async batch scoring via Celery
GET	/fraud/similar/{txn_id}	Retrieve K nearest historical fraud vectors
GET	/causal/summary	Complete DiD regression estimates & ATE metrics
GET	/causal/parallel-trends	Pre-treatment trend validation time-series
GET	/task/{id}/status	Check asynchronous job status

Quick Example: Score a Transaction via cURL

curl -X POST "http://localhost:8000/fraud/score" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 9950.0,
    "hour": 3,
    "day_of_week": 6,
    "velocity_last_hour": 5,
    "city_tier": 1,
    "transaction_type": "P2P"
  }'

---

💻 Quickstart Guide

Option 1: Docker Compose (Recommended)

Launch the API, Redis broker, and Celery workers with a single command:

# Clone the repository
git clone https://github.com/Vedag812/FraudLens.git
cd FraudLens

# Build and start all 3 services in daemon mode
docker-compose up -d --build

# Verify live status
docker-compose ps

# Access Swagger API documentation
open http://localhost:8000/docs

Option 2: Local Python Environment

# Create and activate virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run full calibration pipeline (generates data, trains models & builds FAISS index)
python run_pipeline.py

# Launch interactive Streamlit dashboard
streamlit run dashboard/app.py

# Launch FastAPI server
uvicorn api:app --reload --port 8000

Running Automated Test Suite

pytest tests/ -v

All 29 unit and statistical tests validate causal estimators, FAISS indexing correctness, and endpoint response contracts.

---

📈 Real-World Data Calibration

All simulation distributions are explicitly calibrated against official Indian financial publications:

• NPCI Monthly UPI Metrics: Calibrated against 16B+ monthly volume datasets and market share splits (PhonePe ~47%, Google Pay ~34%, Paytm ~8%).
• RBI Trends & Progress of Banking in India: Fraud typology distributions (SIM-swap, odd-hour bursts, round structuring) aligned with official RBI FY2020–2025 releases.

---

👥 Contributors

• Vedant Agarwal (@Vedag812)

📄 License

Distributed under the MIT License.