Use case assessment
Is AI fraud detection worth building?
Genuinely AI. The false positive rate is the product, and it's the number nobody quotes.
Real AI on a genuine pattern problem. What decides whether it works is not detection rate but what happens to the legitimate customers it stops.
What it usually means
Scoring transactions, claims or account activity for likely fraud, in real time or in batch.
Is it genuinely AI?
Yes, and it is one of the oldest production applications there is. Fraud patterns shift deliberately in response to your controls, which is exactly the situation static rules handle badly and models handle well.
Rules still matter. Most working systems are hybrid: hard rules for the things you never allow, a model for the pattern layer above.
The number that decides it
Not the detection rate. The false positive rate, and what happens to the person it hits.
Blocking a legitimate transaction is not a neutral error. For a customer trying to pay for something, it is the worst experience your product can produce, and a meaningful share of them do not come back. Vendors quote detection rates because they are flattering. The number that decides value is how many good customers you stop, and how quickly you can unstop them.
Design the appeals path before the model. If a wrongly blocked customer cannot reach a human quickly, your fraud saving is being funded by churn you are not measuring.
What the simpler version looks like
Velocity rules, geography checks, amount thresholds against the account's own history. These catch a lot, run instantly and explain themselves. Measure what they miss before assuming a model is the answer.
What it costs to run
Retraining as fraud adapts, which it does continuously and adversarially. Labelled outcomes, which are delayed — chargebacks arrive weeks later, so your feedback loop is slow by construction. Human review capacity for flagged cases, which is the real operating cost.
Where it sits under the EU AI Act
Fraud detection on transactions is not itself an Annex III high-risk use.
Two edges matter. Creditworthiness assessment of natural persons is Annex III, so if fraud scoring feeds credit decisions the classification changes. And where a decision has legal or similarly significant effect on a person, GDPR Article 22 rights around automated decision-making apply independently of the AI Act.
When it is worth building
Buy the base capability — this is a mature vendor category and their cross-customer data beats yours. Build on top only where your fraud patterns are genuinely specific to your product.
Not without an appeals path staffed by people. That is not a compliance detail; it is the thing that determines whether the system costs you more than it saves.
Common questions
What matters most in fraud detection accuracy?
The false positive rate and what happens to the customer it hits. Blocking a legitimate transaction is the worst experience a payment product can produce and a meaningful share of those customers do not return. Vendors quote detection rates because they are flattering.
Should you build or buy fraud detection?
Buy the base capability. Mature vendors have cross-customer data that a single company cannot match. Build on top only where your fraud patterns are genuinely specific to your product.
Is fraud detection high-risk under the EU AI Act?
Transaction fraud detection is not itself an Annex III use. Creditworthiness assessment of natural persons is, so scoring that feeds credit decisions changes classification. GDPR Article 22 rights on automated decisions apply independently.
Acquiring 24,000 users for a fintech lifestyle app — fintech where the experience of being wrongly stopped was a product decision, not a risk one.