Automated Fraud Detection System That Caught Suspicious Transactions Manual Reviews Were Missing for a Payment Processor

A regional payment processor handling over 2 million transactions per month for a growing base of 1,200 merchants was facing an escalating fraud problem that its manual review processes could not contain. The company's fraud team -- three analysts reviewing flagged transactions based on static threshold rules -- was catching only the most obvious fraudulent activity while sophisticated schemes involving velocity manipulation, card testing, and merchant collusion passed through undetected. Chargebacks were rising quarter over quarter, merchant losses were increasing, and the processor's card network risk scores were trending toward thresholds that could trigger enhanced monitoring or fines.

The company had operated for seven years, building its merchant base through competitive pricing and responsive service. But the payments landscape had shifted dramatically. Transaction volumes had tripled in two years as the company expanded into e-commerce and mobile payment channels, and fraud tactics had evolved well beyond what static rules and human reviewers could detect at scale. The processor needed a system that could analyze every transaction in real time, identify patterns invisible to human reviewers, and prioritize the highest-risk cases for analyst investigation.

JSG was engaged to design and deploy an automated fraud detection system that would dramatically expand the processor's detection capabilities while reducing the burden on its fraud analysis team.

Client: Regional payment processor serving 1,200 merchants across retail, e-commerce, restaurant, and professional services verticals. Processing 2M+ transactions per month with $140M in monthly payment volume. Seven years in operation with a growing merchant base but escalating fraud losses threatening network standing.

Employee Size: 50 employees

Industry: Financial Services

Services: - AI-Powered Transaction Monitoring & Pattern Detection - Real-Time Risk Scoring & Alert Generation - Fraud Analyst Case Management Platform - Escalation Workflow & Merchant Notification Automation

The processor's fraud detection challenges were both technical and operational. The sheer volume of transactions made manual review of more than a tiny fraction impossible, and the static rules that served as the first line of defense were both too broad (generating excessive false positives) and too narrow (missing sophisticated fraud patterns that did not trigger simple threshold rules).

First, the existing rule-based detection system was generating an unmanageable volume of false positives. The processor had configured approximately 60 static rules -- transaction amount thresholds, geographic velocity checks, declined transaction counts -- that flagged roughly 4,800 transactions per month for manual review. Of these, the fraud team determined that only 8% were genuinely suspicious. The remaining 92% were legitimate transactions that consumed analyst time, delayed merchant settlements, and occasionally caused friction with cardholders whose valid purchases were held for review.

Second, sophisticated fraud patterns were going undetected entirely. Card testing rings that distributed small authorization attempts across dozens of merchants, bust-out schemes where dormant merchant accounts suddenly processed high volumes, and refund manipulation patterns that exploited timing gaps in settlement cycles all fell outside the static rule framework. The processor estimated -- based on post-incident analysis of chargeback patterns -- that at least 40% of actual fraud was passing through undetected.

Third, the fraud team lacked an efficient case management workflow. When a transaction was flagged, analysts investigated using a combination of the processing platform's transaction search, spreadsheets for tracking case status, and email for communicating with merchants and internal teams. There was no centralized case record, no standardized investigation workflow, and no mechanism to link related suspicious transactions into a single case. Analysts frequently investigated the same fraud ring's transactions in isolation, missing the connection between them.

Fourth, escalation and notification processes were manual and inconsistent. When fraud was confirmed, the process of notifying affected merchants, filing network reports, and escalating to law enforcement depended on individual analyst judgment and manual execution. Response times varied widely -- from same-day for obvious cases to several days for complex schemes -- and there was no audit trail documenting the escalation steps taken for each case.

The processor needed:

• AI-powered transaction monitoring that could analyze every transaction against behavioral patterns, not just static thresholds
• A risk scoring engine that prioritized the highest-risk transactions for human review
• A case management platform that gave fraud analysts a structured investigation workflow
• Automated escalation chains that ensured consistent, timely response to confirmed fraud
• A dramatic reduction in false positives to make the fraud team's limited time more productive

JSG designed and deployed an automated fraud detection system for the payment processor that layered AI-powered pattern recognition on top of the existing transaction infrastructure, fundamentally changing how fraud was identified, investigated, and resolved.

Key Components

AI-Powered Pattern Recognition Engine Azure OpenAI was deployed to analyze transaction data streams in near-real-time, applying behavioral pattern recognition that went far beyond static threshold rules. The model was trained on 18 months of the processor's historical transaction data, including confirmed fraud cases, chargeback records, and legitimate transaction patterns. It identified anomalies based on merchant behavior profiles, cardholder spending patterns, transaction velocity across merchant clusters, and temporal patterns that indicated card testing, bust-out schemes, and refund manipulation.

Dynamic Risk Scoring Every transaction received a risk score from 0 to 100 based on the AI model's analysis. Scores incorporated multiple signal dimensions: transaction characteristics, merchant risk profile, cardholder behavior history, device and location signals, and network-level patterns. Transactions scoring above 75 were flagged for immediate analyst review; scores between 50 and 75 entered a monitoring queue; and scores below 50 were processed normally. The scoring thresholds were continuously tuned based on analyst feedback and confirmed outcome data.

Fraud Analyst Case Management Platform A Power Apps-based case management application gave the fraud team a structured workspace for investigating flagged transactions. Each case included the risk score breakdown, related transaction history, merchant profile, and recommended investigation steps. The platform automatically linked related suspicious transactions -- for example, multiple flagged transactions from the same card across different merchants -- into unified cases, enabling analysts to see the full scope of a potential fraud ring rather than reviewing transactions in isolation.

Automated Alert Escalation Chains N8N workflows managed the end-to-end escalation process for confirmed fraud cases. When an analyst confirmed fraud, the system automatically initiated the appropriate response sequence: merchant notification, cardholder alert, card network reporting, and law enforcement referral for cases exceeding dollar thresholds. Each step was logged with timestamps and responsible parties, creating a complete audit trail.

Merchant Risk Profiling The system continuously maintained and updated risk profiles for each of the 1,200 active merchants. Profiles incorporated transaction pattern baselines, chargeback ratios, historical fraud incidence, business type risk factors, and seasonal volume patterns. Sudden deviations from a merchant's established profile triggered enhanced monitoring automatically, catching bust-out schemes and account takeover scenarios that static rules would miss.

Real-Time Monitoring Dashboard A live operations dashboard displayed transaction volume, fraud detection rates, analyst queue depth, and risk score distributions across the merchant portfolio. The fraud team manager used the dashboard to allocate analyst resources dynamically, and executive leadership monitored the processor's overall fraud posture and card network risk metrics in real time.

## Quantifiable Impact

• Suspicious transaction detection increased by 3.1x (from approximately 384 confirmed cases/month to 1,190 confirmed cases/month)
• False positive rate reduced from 92% to 34%, making analyst review time 9.5x more productive per flagged transaction
• Average fraud case review time reduced from 45 minutes to 14 minutes through structured case management and automated evidence assembly
• Chargeback rate decreased by 62%, from 0.41% to 0.16% of transaction volume, pulling the processor well below card network penalty thresholds
• Monthly fraud losses reduced by $218,000, representing a 71% decrease from pre-deployment levels

• Frontend: React (real-time monitoring dashboard)
• Backend: Node.js with Express (transaction analysis API, risk scoring engine)
• Cloud: Microsoft Azure
• Database: Azure SQL (transaction data warehouse, merchant profiles, case management records)
• AI & Automation: Azure OpenAI (behavioral pattern recognition, anomaly detection, transaction risk scoring, merchant profile deviation analysis)
• Workflow Orchestration: N8N (alert escalation chains, merchant notification workflows, card network reporting automation, case linking logic)
• Low-Code Tools: Power Apps (fraud analyst case management platform, investigation workflow interface)
• Communication: Twilio (merchant fraud alert SMS), SendGrid (detailed fraud case notifications, analyst assignment alerts)
• Integrations: Payment gateway transaction feed, card network reporting APIs (Visa and Mastercard), chargeback management system, merchant onboarding database