---
title: "Fraud Detection"
description: "8 posts about Fraud Detection, summarised, each linking to the original."
---

# Fraud Detection
> 8 posts about Fraud Detection, summarised, each linking to the original.

## Articles

### [How to Retrieve a Phone Number's SMS Pumping Score in Rust](https://yomu.fyi/post/how-to-retrieve-a-phone-number-s-sms-pumping-score-in-rust.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Matthew Setter
- Published: Oct 14, 2026
- Type: Tutorial

SMS Pumping Fraud exploits phone number input fields to generate revenue from SMS messages sent to numbers controlled by a specific mobile network operator. Twilio’s Lookup v2 API provides an SMS Pumping Risk Score from 0 to 100, based on a proprietary model using network data including Verify Fraud Guard signals and unusual traffic patterns. This Rust tutorial uses the rustlio crate, dotenvy, serde, and tokio to call the API and retrieve the score along with carrier risk category and block status. Canadian numbers do not return carrier information, and Twilio advises against using the score for US or Canadian numbers. Guidelines recommend sending messages for scores 0-60, adding friction for 60-75, treating as suspicious for 75-90, and blocking for 90-100.


### [Fine-tuning LLMs for risk assessment](https://yomu.fyi/post/fine-tuning-llms-for-risk-assessment.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Hangzhi Guo
- Published: Oct 9, 2026
- Type: Problem & solution

Stripe makes thousands of near real-time risk decisions every second, balancing fraud detection against false positives that disrupt legitimate businesses. Zero-shot prompting achieved 0.487 precision, domain-guided prompting 0.706, and human reviewers 0.790 at the same recall. The team applied supervised fine-tuning (SFT) to an open-weight 4B-parameter LLM, serializing features like card payments and account activity into text records, training it on labels, and deriving a continuous fraud score from the next-token probabilities normalized over two label tokens. SFT increased average precision by approximately 24% over domain-guided prompting and 70% over zero-shot prompting, and consistently outperformed XGBoost across multiple risk tasks. Linear probing of hidden states showed that SFT made benign signals more linearly decodable, with ROC-AUC improving from 0.583 to 0.642, indicating the model better recognizes legitimate business activity and reduces false positives.


### [Putting a Transformer Inside Every Card Authorization](https://yomu.fyi/post/putting-a-transformer-inside-every-card-authorization.md)
- Company: [Ramp](https://yomu.fyi/company/ramp.md)
- Author: Dwight Temple, Simon Miller
- Published: Oct 7, 2026
- Type: Problem & solution

Ramp’s new card fraud model combines a small transformer pre-trained without fraud labels with an XGBoost stage to score each authorization in real time. The transformer reads a cardholder’s recent transactions and learns to predict the next transaction, producing embeddings and surprisal scores that capture how anomalous each field is. The model caught 32% more fraud dollars than its predecessor while flagging the same number of transactions, with average precision 12% higher than XGBoost alone. Most of the dollar gain comes from weighting XGBoost training examples by dollar amount, while the transformer improves ranking and catches more first fraudulent charges on a card. The transformer trains in under 90 minutes on four L40S GPUs and runs on CPU within the authorization latency budget after optimizations cut median model step time from 145 to 54 milliseconds.


### [My Voice AI Demo Was Hit by a $982 Traffic-Pumping Attack! Here’s What I Learned](https://yomu.fyi/post/my-voice-ai-demo-was-hit-by-a-982-traffic-pumping-attack-here-s-what-i.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Rishab Kumar
- Published: Oct 6, 2026
- Type: Incident / postmortem

A voice AI demo using Twilio Conversation Relay and FastAPI was exploited when automated clients repeatedly called its unauthenticated /api/call endpoint, generating 1,008 requests and 921 outbound calls to Israeli +972229 numbers. The incident cost $971.50 in Twilio voice usage and $10.58 in Google Gemini fees, matching International Revenue Sharing Fraud that keeps calls connected for per-minute revenue. The author used the Twilio CLI to group call records showing 920 of 921 calls targeted the same narrow Israeli range and correlated Azure Log Analytics to confirm the exploited endpoint. Calls were kept alive by automated scripts replaying conversation-extension prompts from only 541 distinct lines across 8,363 transcriptions, with some recordings mentioning happy trafficking. The post recommends authentication, duration limits, geographic permissions, signature validation, usage triggers, and demo isolation as essential controls for public voice AI apps.


### [Follow the thread: a new dashboard to investigate account abuse](https://yomu.fyi/post/follow-the-thread-a-new-dashboard-to-investigate-account-abuse.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Nicole Justus
- Published: Oct 2, 2026
- Type: Announcement

Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure.


### [How to rank fraud detection models using custom cost metrics](https://yomu.fyi/post/how-to-rank-fraud-detection-models-using-custom-cost-metrics.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Isaac Tigges, Neha Malepati
- Published: Sep 28, 2026
- Type: Tutorial

Accuracy is misleading for fraud detection because a model labeling everything legitimate can score 96% while catching zero fraud when fraud is only 4% of transactions. The post runs a hand-built Python grid search across algorithm, hyperparameters, feature set, class weight, and decision threshold, ranking by a custom cost metric balancing fraud savings against a US 6 analyst cost per flag. On a 480-transaction test split from a 2,400-transaction dataset with 4% fraud, the winning logistic regression caught 15 of 19 frauds, saving US 3,578 over a baseline that caught none. The winner’s evidence is passed to a local 1-billion-parameter LLM that drafts analyst notes, keeping the LLM downstream of the decision to avoid hallucination. The same workflow scales to Red Hat OpenShift AI by swapping local components for enterprise services like AutoML with AutoGluon and model serving via vLLM.


### [Financial Crime Mitigation with MongoDB / Series Overview](https://yomu.fyi/post/financial-crime-mitigation-with-mongodb-series-overview.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 21, 2026
- Type: Problem & solution

Financial crime losses could exceed $2 trillion annually, and legacy systems—fragmented, batch-processed, and transaction-focused—cannot keep pace with modern, AI-powered attacks. MongoDB Atlas offers a unified platform that consolidates entity management, transaction monitoring, behavioral risk scoring, model management, and case management on a single flexible data foundation. Key capabilities include AI-driven entity resolution via Atlas Search’s $rankFusion, network analysis with $graphLookup, and hybrid detection combining rules with vector search. The platform enables real-time intelligence through Change Streams and Time Series Collections, allowing immediate action at the moment of decision instead of retrospective analysis. Organizations can either buy off-the-shelf solutions or build custom platforms on MongoDB, with the build approach offering rapid iteration, freedom from vendor constraints, and competitive differentiation.


### [Financial Crime Mitigation with MongoDB / Part III: Behavioral Risk Modeling for Event-Driven Fraud Detection](https://yomu.fyi/post/financial-crime-mitigation-with-mongodb-part-iii-behavioral-risk-model.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 21, 2026
- Type: Explainer

MongoDB’s document model and event-driven architecture support behavioral risk modeling for fraud detection in financial institutions. The platform combines rule-based policies with probabilistic reasoning, using change streams for real-time event processing and vector search for similarity assessment. MongoDB captures behavioral events like typing patterns and device IP addresses, aggregating them into dynamic customer profiles. Vector search compares incoming transactions against historical patterns, but it does not evaluate numerical data such as transaction amount, which requires traditional risk scoring. This approach reduces false positives and lowers total cost of ownership by minimizing manual intervention, while MongoDB’s flexible schema allows adding risk factors without downtime.