---
title: "How to Build Real-Time Fraud Detection using Spark Real-Time Mode and Lakebase"
description: "Card fraud operates in seconds, while organizations need to score and block suspicious transactions before settlement without adding a separate streaming stack. This Solution Accelerator presents an open-source, end-to-end implementation on Databricks, covering transaction ingestion, Spark Real-Time Mode processing, fraud scoring, Lakebase feature serving, and a Databricks Apps monitoring dashboard. RTM processes streaming workloads in milliseconds and targets sub-300ms latency, while Lakebase supplies a managed, serverless Postgres serving layer with sub-millisecond reads. The design keeps batch ETL, training, streaming, and governance within the same platform. Deployment progresses from a synthetic rate-source quick start to Kafka-based parsing, stateful per-card velocity tracking with TTL, enrichment, weighted scoring, routing, and optional MLflow-trained RandomForest scoring, followed by a Streamlit app for live decisions."
---

# How to Build Real-Time Fraud Detection using Spark Real-Time Mode and Lakebase

[Databricks](https://yomu.fyi/company/databricks) · Sixuan He, Navneeth Nair · May 19, 2026

**Type:** Tutorial

## Summary

Card fraud operates in seconds, while organizations need to score and block suspicious transactions before settlement without adding a separate streaming stack. This Solution Accelerator presents an open-source, end-to-end implementation on Databricks, covering transaction ingestion, Spark Real-Time Mode processing, fraud scoring, Lakebase feature serving, and a Databricks Apps monitoring dashboard. RTM processes streaming workloads in milliseconds and targets sub-300ms latency, while Lakebase supplies a managed, serverless Postgres serving layer with sub-millisecond reads. The design keeps batch ETL, training, streaming, and governance within the same platform. Deployment progresses from a synthetic rate-source quick start to Kafka-based parsing, stateful per-card velocity tracking with TTL, enrichment, weighted scoring, routing, and optional MLflow-trained RandomForest scoring, followed by a Streamlit app for live decisions.

## Context

Card fraud must be identified and blocked within the sub-second interval between authorization and settlement. The stated challenge is achieving this latency while avoiding a separate specialized streaming engine, duplicated data and governance, and additional operational complexity.

## Approach / What changed

The accelerator uses Spark Real-Time Mode for sub-300ms streaming, Lakebase as a low-latency online serving layer, and Databricks Apps for monitoring. Its staged implementation covers synthetic quick-start testing, Kafka ingestion, stateful per-card velocity tracking with TTL, enrichment, weighted rule scoring, optional MLflow-trained RandomForest scoring, and live dashboard deployment.

## Takeaways

- Real-Time Mode runs inside Spark Structured Streaming and is described as up to 92% faster than Apache Flink across stateless transformation, join-based enrichment, and aggregation workloads.
- The pipeline uses transformWithState to maintain per-card transaction state, including 60-second velocity counts, with TTL-based expiration to prevent unbounded memory growth.
- Lakebase receives continuously streamed per-card features with upsert semantics and provides sub-millisecond reads for real-time feature serving.

**Tags:** [Kafka](https://yomu.fyi/topic/kafka), [Lakebase](https://yomu.fyi/topic/lakebase), [MLflow](https://yomu.fyi/topic/mlflow), [Spark](https://yomu.fyi/topic/spark)

- Source: [Databricks](https://www.databricks.com/blog/how-build-real-time-fraud-detection-using-spark-real-time-mode-and-lakebase)
- Source URL: https://www.databricks.com/blog/how-build-real-time-fraud-detection-using-spark-real-time-mode-and-lakebase
- Ingested by Yomu: 2026-08-31T03:34:00.542Z

[Read original post](https://www.databricks.com/blog/how-build-real-time-fraud-detection-using-spark-real-time-mode-and-lakebase)