Anomaly Scoring
Definition
A numeric score assigned to each entity or transaction based on how different it is from the expected population, derived from multiple input features. Scored outputs are ranked so investigators can prioritise high-scoring records.
- Output
- A numeric deviation score per entity or transaction
- Input
- Multiple behavioural or transactional features
- Purpose
- Rank records for investigator review
- Domain
- Fraud investigation and financial data analytics
Common questions
Does a high anomaly score prove fraud?+
No. It only means the record is statistically unusual relative to the modelled population, and an investigator still has to review context, such as a legitimate one-off large purchase, before treating a high score as a lead worth pursuing.
How does anomaly scoring differ from a fixed rule-based fraud check?+
A rule check flags a transaction only if it breaks a predefined threshold, while anomaly scoring combines many features into a single relative measure, which can catch unusual patterns no single rule was written to cover.
Related terms
- Explainability
- The degree to which a model's output can be explained in terms of its inputs and logic. Logistic regression and decision trees...
- Isolation Forest
- An unsupervised machine-learning model for anomaly detection. It builds random decision trees and scores each record by the average depth required to...
- Logistic Regression (Supervised Fraud Model)
- A classification model trained on historically labelled transactions (fraud vs. legitimate) to estimate the probability that a new transaction is fraudulent. Requires...
- Network Analysis (Link Analysis)
- A method that models entities (people, companies, accounts, addresses) as nodes and connections between them (shared attributes, transactions, ownership) as edges, then...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...