🛡️ Fraud & Risk Anomaly Detector — Live

Spending patterns, fraud tactics, seasonality (e.g. holiday shopping), and even currency/inflation effects shift the underlying distribution of "normal" transactions over time — a phenomenon called concept drift. A threshold tuned to last year's data can become miscalibrated: either the false-positive rate creeps up as legitimate behaviour drifts outward, or fraudsters learn to stay just inside the boundary. Production systems recompute μ and Σ (or retrain more complex models) on rolling windows of recent data, monitor precision and recall in real time, and often use adaptive or per-segment thresholds — e.g. different cutoffs for different countries or merchant categories — rather than one static global cutoff.

Precision = TP/(TP+FP) — of all transactions flagged, what fraction were actually fraud. Recall = TP/(TP+FN) — of all actual fraud, what fraction did the system catch. F1 is their harmonic mean, balancing both. Accuracy is misleading here because fraud is rare — a heavily imbalanced problem: a detector that flags nothing at all could still be "99% accurate" while catching zero fraud. Precision and recall separate the two failure modes that actually matter operationally: annoying customers with false alarms versus letting fraud through undetected.

The mean vector and 2×2 covariance matrix are recomputed live from every point currently in the dataset. The covariance matrix is analytically inverted, and the Mahalanobis distance is evaluated at every cell of a grid spanning the visible plane, producing a continuous scalar field. That field is mapped through a colour ramp — green through yellow to red as distance increases — and written into a canvas/DataTexture that Three.js renders as a textured plane behind the scatter points, the same technique used for decision-boundary heatmaps elsewhere on this site, just with a Mahalanobis-distance field instead of a network's forward pass.

A false negative (missed fraud) directly costs the money lost to the fraudulent transaction, plus potential regulatory and reputational damage. A false positive (blocking or flagging a legitimate transaction) costs customer trust and support overhead, and can push genuine customers to abandon a purchase or a bank altogether — but it doesn't lose principal. Because these costs are measured in different currencies — direct financial loss versus customer-experience friction — and vary by transaction size and customer segment, real systems often weight the threshold decision by expected monetary loss rather than treating every error as equally bad.

The shape of the equal-anomaly-score contours is determined entirely by the estimated covariance matrix Σ. If the two features were uncorrelated and had equal variance, the contours would be circles. Because amount and time-since-last-transaction are positively correlated in this simulation's normal cluster, Σ has non-zero off-diagonal terms, which tilts and stretches the contours into ellipses aligned with the direction of correlation — exactly the shape you would get by eye-balling a scatter plot of the normal points, which is the point: Mahalanobis distance is a principled, automatic version of "does this point fall outside the natural scatter of the cloud".