---

name: "fraud-detection" description: "Real-time fraud detection using ML pattern analysis, velocity checks, device fingerprinting, behavioral biometrics for African fintech with XAF/NGN transaction monitoring" version: "1.0.0" author: "CemaPay AI Security Team" category: "security" tags: ["fraud", "security", "ml", "pattern-analysis", "risk", "aml", "transaction-monitoring", "africa"] requiresAuth: true requiresAdmin: false

Fraud Detection Intelligence Skill

🎯 PURPOSE

This skill provides real-time fraud detection and prevention for African fintech transactions, with expertise in:

• Transaction Pattern Analysis: ML-powered anomaly detection for XAF, NGN, USD transfers
• Velocity Checks: Rapid transaction/login attempt monitoring with dynamic thresholds
• Device Fingerprinting: Browser/mobile device identification and risk scoring
• Behavioral Biometrics: Typing patterns, navigation flow, session behavior analysis
• Geo-Intelligence: Location-based risk (VPN detection, impossible travel, high-risk regions)
• Network Analysis: Account linking, mule account detection, fraud ring identification
• Real-time Alerts: Instant notifications for suspicious activities with auto-block capability

🔍 WHEN TO USE THIS SKILL

Trigger this skill when users mention:

• "fraud detection", "suspicious transaction", "unusual activity", "account takeover"
• "velocity check", "rate limiting", "multiple failed attempts"
• "risk score", "fraud analysis", "transaction monitoring"
• "block transaction", "flag account", "investigate fraud"
• "device fingerprint", "IP analysis", "location mismatch"
• Any security incident requiring investigation

🚨 FRAUD DETECTION RULES ENGINE

Rule 1: Velocity Checks (Transaction Frequency)

High-Frequency Transaction Alert

Trigger Conditions:

• Tier 1 (Low Risk): >5 transactions in 1 hour = ⚠️ Warning
• Tier 2 (Medium Risk): >10 transactions in 1 hour = 🚨 Alert
• Tier 3 (High Risk): >20 transactions in 1 hour = ❌ Auto-block

Dynamic Threshold Adjustment:

• New accounts (<30 days): -50% threshold (stricter)
• Verified accounts (>6 months): +30% threshold (more lenient)
• Business accounts: +100% threshold (higher limits)
• Night transactions (11 PM - 5 AM): -30% threshold (stricter)

Example:

CopyUser: John Doe (Account age: 15 days)
Transactions in last hour: 8
Base threshold: 5 (Tier 1)
Adjusted threshold: 2.5 (new account penalty)
Result: 🚨 ALERT - Exceeded velocity threshold by 220%
Action: Require 2FA for next transaction

Rapid Login Attempts

Trigger Conditions:

• Failed Logins: >5 failed attempts in 15 minutes = ⚠️ Warning
• Failed Logins: >10 failed attempts in 30 minutes = 🚨 Temporary lock (30 min)
• Failed Logins: >20 failed attempts in 1 hour = ❌ Account lock (manual unlock)

Advanced Detection:

• Multiple devices: +2 risk points per unique device
• Multiple IPs: +3 risk points per unique IP
• Multiple locations: +5 risk points if >500km distance

Rule 2: Transaction Amount Anomalies

Unusual Amount Detection

Baseline Calculation:

Copy// Calculate user's transaction baseline
const baseline = {
  avgAmount: calculateAverage(last30DaysTransactions),
  maxAmount: calculateMax(last30DaysTransactions),
  stdDeviation: calculateStdDev(last30DaysTransactions)
};

// Anomaly detection
const zScore = (currentAmount - baseline.avgAmount) / baseline.stdDeviation;

if (zScore > 3) {
  // Transaction is 3 standard deviations above average
  return { risk: 'HIGH', action: 'MANUAL_REVIEW' };
} else if (zScore > 2) {
  return { risk: 'MEDIUM', action: 'ADDITIONAL_2FA' };
}

Example:

CopyUser: Marie Kamga
Avg transaction: 50,000 XAF
Std deviation: 20,000 XAF
Current transaction: 500,000 XAF
Z-score: (500,000 - 50,000) / 20,000 = 22.5

Result: 🚨 HIGH RISK (22.5 > 3)
Action: Block transaction, require manual approval

Round Number Analysis

Suspicious Patterns:

• Exact round amounts (100,000 / 500,000 / 1,000,000) = +1 risk point
• Repeating amounts (same amount 3+ times in 24h) = +2 risk points
• Sequential amounts (100k, 200k, 300k) = +3 risk points (structured transactions)

Rule 3: Geographic Intelligence

Impossible Travel Detection

Algorithm:

Copy// Calculate if travel between two locations is physically possible
function detectImpossibleTravel(location1, location2, timeDiffMinutes) {
  const distance = calculateDistance(location1, location2); // in km
  const maxSpeed = 900; // km/h (commercial flight speed)
  const minTimeRequired = (distance / maxSpeed) * 60; // minutes
  
  if (timeDiffMinutes < minTimeRequired) {
    return {
      impossible: true,
      distance: distance,
      timeGap: timeDiffMinutes,
      minRequired: minTimeRequired,
      riskScore: 10 // Highest risk
    };
  }
  return { impossible: false };
}

Example:

CopyEvent 1: Login from Lagos, Nigeria (6.5244° N, 3.3792° E) at 10:00 AM
Event 2: Login from Paris, France (48.8566° N, 2.3522° E) at 10:30 AM

Distance: 4,713 km
Time gap: 30 minutes
Min time required: 314 minutes (5.2 hours)

Result: 🚨 IMPOSSIBLE TRAVEL DETECTED
Risk Score: 10/10
Action: Lock account immediately, notify user via SMS/email

High-Risk Country Detection

FATF High-Risk Jurisdictions (Updated October 2025):

• Myanmar, North Korea, Syria, Iran (Tier 1 - Blacklist)
• Haiti, Mali, Mozambique, Nigeria (Tier 2 - Greylist, increased monitoring)

Risk Actions:

• Tier 1: ❌ Block all transactions automatically
• Tier 2: ⚠️ Enhanced due diligence, manual review for >$500 USD equivalent

VPN/Proxy Detection

Indicators:

• Known VPN IP ranges (database of VPN providers)
• Proxy server detection (HTTP headers: X-Forwarded-For, Via)
• Tor exit nodes (publicly available list)
• Data center IPs (non-residential)

Risk Scoring:

• VPN detected: +2 risk points (moderate concern)
• Proxy detected: +3 risk points (higher concern)
• Tor detected: +5 risk points (highest concern)
• Data center IP: +1 risk point

Rule 4: Device Fingerprinting

Device Intelligence Collection

Browser Fingerprint (collected via JavaScript):

Copyconst deviceFingerprint = {
  userAgent: navigator.userAgent,
  screenResolution: `${screen.width}x${screen.height}`,
  timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
  language: navigator.language,
  platform: navigator.platform,
  plugins: Array.from(navigator.plugins).map(p => p.name),
  canvas: generateCanvasFingerprint(), // Unique rendering signature
  webgl: getWebGLFingerprint(), // GPU signature
  fonts: detectInstalledFonts(),
  doNotTrack: navigator.doNotTrack,
  hardwareConcurrency: navigator.hardwareConcurrency,
  deviceMemory: navigator.deviceMemory
};

// Generate unique hash
const fingerprintHash = SHA256(JSON.stringify(deviceFingerprint));

Device Risk Scoring:

• Known Device (seen before): 0 risk points
• New Device (first time): +2 risk points
• Suspicious Device (proxy/VPN/Tor): +5 risk points
• Multiple Devices (>3 in 24h): +3 risk points per additional device

Example:

CopyUser: Samuel Okafor
Known Devices: 2 (iPhone 14, MacBook Pro)
Current Login: Unknown device (Windows 11, Chrome, VPN detected)

Device Risk Analysis:
+ New device: +2 points
+ VPN detected: +2 points
+ Different OS from usual: +1 point
Total Device Risk: 5/10 (MEDIUM)

Action: Send verification code to registered phone

Rule 5: Behavioral Biometrics

Typing Pattern Analysis

Metrics Collected:

• Keystroke Dynamics: Time between key presses (dwell time, flight time)
• Typing Speed: Characters per minute (CPM)
• Error Rate: Backspace frequency
• Pressure: Touch pressure on mobile devices

Anomaly Detection:

Copy// Compare current session to user's baseline
const typingAnomaly = {
  speedDiff: Math.abs(currentSpeed - baselineSpeed) / baselineSpeed,
  errorRateDiff: Math.abs(currentErrors - baselineErrors) / baselineErrors,
  dwellTimeDiff: Math.abs(currentDwell - baselineDwell) / baselineDwell
};

if (typingAnomaly.speedDiff > 0.5 || typingAnomaly.dwellTimeDiff > 0.5) {
  // Typing pattern 50%+ different from baseline
  return { risk: 'MEDIUM', reason: 'Typing pattern mismatch' };
}

Example:

CopyUser: Fatima Yusuf
Baseline: 280 CPM, 3% error rate, 150ms avg dwell time
Current: 450 CPM, 12% error rate, 80ms avg dwell time

Analysis:
- Speed 61% faster (possible bot/script)
- Error rate 300% higher (possible automated tool)
- Dwell time 47% faster (suspicious)

Result: 🚨 HIGH RISK - Possible account takeover
Action: Require biometric authentication (face ID / fingerprint)

Mouse Movement Analysis (Web)

Patterns Tracked:

• Movement speed and acceleration
• Cursor trajectory (human curves vs straight lines)
• Click patterns (rapid vs deliberate)
• Scroll behavior (smooth vs jumpy)

Bot Detection:

• Perfectly straight lines = +3 risk points (bots move in straight lines)
• Inhuman speed (>5000px/sec) = +5 risk points
• No mouse movement (keyboard-only navigation) = +2 risk points

Rule 6: Transaction Pattern Analysis

Money Mule Detection

Indicators:

1. Rapid In-Out Pattern:

   • Funds received → Immediately transferred out (within 1 hour)
   • High volume of received funds from multiple sources
   • Withdrawals to different recipients

2. Dormant Account Activation:

   • Account inactive for >90 days
   • Suddenly receives large transfer
   • Immediately transfers funds out

Example:

CopyAccount: John Smith (Dormant 120 days)

Activity Pattern (Today):
09:00 AM - Received 5,000,000 XAF from "ABC Company"
09:15 AM - Transferred 4,800,000 XAF to "Unknown Recipient 1"
09:20 AM - Transferred 200,000 XAF to "Unknown Recipient 2"

Analysis:
✅ Dormant account activated
✅ Large incoming transfer
✅ Rapid outgoing transfers (96% within 20 min)
✅ Multiple recipients

Result: 🚨 CRITICAL - Money Mule Pattern Detected
Action: Freeze account immediately, escalate to AML team

Structuring Detection (Smurfing)

Pattern: Breaking large amounts into smaller transactions to avoid reporting thresholds

CTR Threshold (Currency Transaction Report):

• Nigeria: ₦5,000,000 NGN
• Cameroon: 10,000,000 XAF
• US: $10,000 USD

Detection Logic:

Copy// Detect structuring
function detectStructuring(transactions, threshold) {
  const timeWindow = 24; // hours
  const recentTxs = transactions.filter(tx => 
    withinTimeWindow(tx.timestamp, timeWindow)
  );
  
  const totalAmount = recentTxs.reduce((sum, tx) => sum + tx.amount, 0);
  const avgAmount = totalAmount / recentTxs.length;
  
  // Check if total exceeds threshold but individual txs don't
  if (totalAmount > threshold && 
      recentTxs.every(tx => tx.amount < threshold * 0.9) &&
      recentTxs.length >= 3) {
    return {
      suspicious: true,
      pattern: 'STRUCTURING',
      transactions: recentTxs.length,
      totalAmount: totalAmount,
      avgAmount: avgAmount
    };
  }
}

Example:

CopyUser: "ABC Trading Ltd"
Time Window: Last 24 hours
Transactions:
1. 4,500,000 XAF (90% of threshold)
2. 4,300,000 XAF (86% of threshold)
3. 4,700,000 XAF (94% of threshold)
4. 4,200,000 XAF (84% of threshold)

Total: 17,700,000 XAF (177% over threshold)
Individual: All below 10M XAF threshold
Count: 4 transactions in 24h

Result: 🚨 STRUCTURING DETECTED
Action: File STR (Suspicious Transaction Report), freeze account

Rule 7: Network Analysis (Graph-Based)

Account Linking Detection

Shared Attributes:

• Same device fingerprint across multiple accounts
• Same IP address (residential, not business)
• Same phone number or email pattern
• Same beneficiary recipients
• Similar transaction patterns

Risk Calculation:

Copy// Calculate similarity score between two accounts
function calculateAccountSimilarity(account1, account2) {
  let similarity = 0;
  
  if (account1.deviceFingerprint === account2.deviceFingerprint) similarity += 30;
  if (account1.ipAddress === account2.ipAddress) similarity += 20;
  if (account1.phoneNumber === account2.phoneNumber) similarity += 25;
  if (hasSharedBeneficiaries(account1, account2)) similarity += 15;
  if (hasimilarTransactionPattern(account1, account2)) similarity += 10;
  
  return similarity; // Max 100%
}

// If similarity > 70%, flag as linked accounts

Example:

CopyAccount A: John Doe (ID: 123)
Account B: Jane Smith (ID: 456)

Shared Attributes:
✅ Device fingerprint: 85% match
✅ IP address: Same (192.168.1.1)
✅ Beneficiary: Both send to "ABC Corp"
❌ Phone number: Different
✅ Transaction pattern: 78% similar (same times, amounts)

Similarity Score: 30 + 20 + 15 + 10 = 75%

Result: 🚨 LINKED ACCOUNTS DETECTED
Action: Flag for investigation, possible fraud ring

Fraud Ring Detection

Indicators:

• Circular money flow (A → B → C → A)
• Shared infrastructure (same devices, IPs)
• Coordinated activity (transactions at same times)
• Multiple accounts created from same source

Graph Analysis:

CopyFraud Ring Example:
Account A --500K--> Account B
Account B --450K--> Account C  
Account C --400K--> Account D
Account D --350K--> Account A (circular!)

All accounts:
- Created within 7 days
- Same device fingerprint
- Transaction times within 5-minute windows

Result: 🚨 FRAUD RING DETECTED (4 accounts)
Action: Freeze all accounts, escalate to law enforcement

📊 FRAUD RISK SCORING SYSTEM

Comprehensive Risk Score (0-100)

Score Calculation:

Copyconst fraudRiskScore = {
  velocityRisk: 0-20,        // Transaction frequency
  amountRisk: 0-15,          // Unusual amounts
  geoRisk: 0-20,             // Location anomalies
  deviceRisk: 0-15,          // Device fingerprint
  behaviorRisk: 0-15,        // Behavioral biometrics
  patternRisk: 0-15,         // Transaction patterns
  
  totalScore: sum(allRisks)  // Max 100
};

// Risk categories
if (totalScore < 20) return 'LOW_RISK';
if (totalScore < 40) return 'MEDIUM_RISK';
if (totalScore < 70) return 'HIGH_RISK';
return 'CRITICAL_RISK';

Risk Actions:

• 0-19 (LOW): ✅ Allow transaction, normal monitoring
• 20-39 (MEDIUM): ⚠️ Require additional 2FA verification
• 40-69 (HIGH): 🚨 Manual review required, delay transaction
• 70-100 (CRITICAL): ❌ Block transaction, freeze account, escalate

Real-Time Fraud Score Example

CopyFRAUD RISK ANALYSIS
Transaction ID: TXN-20251024-XY7G3
User: Samuel Eze
Amount: 2,000,000 XAF
Recipient: Unknown (first time)
Timestamp: 2025-10-24 02:30 AM

===========================
RISK FACTORS DETECTED
===========================

Velocity Risk: 18/20 🚨 HIGH
- 15 transactions in last hour (threshold: 5)
- 3 different devices used
- Night-time activity (2:30 AM)

Amount Risk: 12/15 🚨 HIGH
- Amount is 8.5 std deviations above average
- Round number (2,000,000 XAF)
- Z-score: 8.5 (threshold: 3)

Geographic Risk: 15/20 🚨 HIGH
- IP location: Paris, France
- Last login: Lagos, Nigeria (30 min ago)
- Impossible travel detected (4,700 km in 30 min)
- VPN detected

Device Risk: 10/15 ⚠️ MEDIUM
- Unknown device (first time)
- Windows 11 (user typically uses iOS)
- Browser: Chrome (user typically uses Safari)

Behavior Risk: 13/15 🚨 HIGH
- Typing speed 180% faster than baseline
- No mouse movement detected (possible bot)
- Session duration: 45 seconds (rushed)

Pattern Risk: 14/15 🚨 CRITICAL
- New beneficiary (never sent before)
- Dormant account reactivation (90 days inactive)
- Similar to known fraud pattern #47

===========================
TOTAL FRAUD SCORE: 82/100
RISK CATEGORY: 🚨 CRITICAL
===========================

RECOMMENDED ACTIONS:
❌ Block transaction immediately
🔒 Freeze account temporarily
📧 Send security alert to user email
📱 Send SMS verification code
🚨 Escalate to fraud investigation team
📊 Flag for manual review (Priority: HIGH)

REASON:
Multiple high-risk indicators suggest possible account takeover:
- Impossible travel (Lagos → Paris in 30 min)
- Unusual behavior patterns (bot-like activity)
- Dormant account suddenly active
- Large amount to new recipient
- Night-time transaction

NEXT STEPS:
1. User must verify identity via registered phone
2. Provide valid reason for transaction
3. Undergo video call verification (if needed)
4. Account unfrozen after verification (24-48h)

Contact: security@cemapay.com
Reference: FRAUD-82-TXN-20251024-XY7G3

🔔 REAL-TIME ALERTING SYSTEM

Alert Channels

1. In-App Notifications: Instant push to user's dashboard
2. SMS Alerts: Critical alerts sent to registered phone
3. Email Notifications: Detailed fraud report with evidence
4. Slack/Teams: Internal team notifications (for staff)
5. Webhook: External system integration (custom URLs)

Alert Severity Levels

• INFO (Score 0-19): Log only, no user notification
• WARNING (Score 20-39): In-app + email notification
• ALERT (Score 40-69): All channels + SMS, manual review queued
• CRITICAL (Score 70-100): All channels + auto-block + escalation

Example Alert Template (SMS)

Copy🚨 CEMAPAY SECURITY ALERT

We detected unusual activity on your account:

Transaction: 2,000,000 XAF to [Recipient]
Location: Paris, France
Risk: CRITICAL

This transaction has been BLOCKED for your protection.

If this was you:
Reply YES + [4-digit PIN]

If this was NOT you:
Reply NO immediately

Do not share this message.
CemaPay Security Team

🛡️ AUTO-REMEDIATION ACTIONS

Automatic Responses (No Human Intervention)

• Score 20-39: Require additional 2FA (email/SMS code)
• Score 40-69: Delay transaction 1 hour, queue for review
• Score 70-100: Block transaction, freeze account temporarily

Graduated Response System

Copy// Auto-remediation logic
function autoRemediate(fraudScore, transaction) {
  if (fraudScore >= 70) {
    blockTransaction(transaction.id);
    freezeAccount(transaction.userId, duration: '24h');
    sendAlert(['sms', 'email', 'in-app'], severity: 'CRITICAL');
    createCase(priority: 'HIGH', assignTo: 'fraud-team');
    
  } else if (fraudScore >= 40) {
    delayTransaction(transaction.id, delay: '1h');
    require2FA(transaction.userId, methods: ['sms', 'email']);
    sendAlert(['email', 'in-app'], severity: 'ALERT');
    queueReview(priority: 'MEDIUM', assignTo: 'review-team');
    
  } else if (fraudScore >= 20) {
    require2FA(transaction.userId, methods: ['email']);
    sendAlert(['in-app'], severity: 'WARNING');
    logIncident(severity: 'LOW');
  }
}

📈 FRAUD ANALYTICS & REPORTING

Key Metrics Tracked

• False Positive Rate: % of blocked legit transactions (target: <5%)
• False Negative Rate: % of fraudulent transactions missed (target: <1%)
• Average Detection Time: Time from fraud to detection (target: <60 sec)
• Fraud Loss Rate: $ lost to fraud / total transaction volume (target: <0.1%)
• User Friction Rate: % of users inconvenienced by security (target: <10%)

Daily Fraud Report Template

CopyDAILY FRAUD REPORT - October 24, 2025

Total Transactions: 125,430
Flagged for Review: 1,254 (1.0%)
Blocked Automatically: 234 (0.19%)
Confirmed Fraud: 89 (0.07%)
False Positives: 34 (0.03%)

Fraud Patterns Detected:
1. Account Takeover: 45 cases (51%)
2. Money Mule: 23 cases (26%)
3. Structuring: 12 cases (13%)
4. Card Testing: 9 cases (10%)

Top Risk Countries:
1. Nigeria: 34 cases
2. Cameroon: 18 cases
3. France: 12 cases (VPN abuse)

Prevention Savings: $127,500 USD
Fraud Losses: $3,400 USD (from false negatives)
Net Protection: $124,100 USD

Recommendations:
- Increase velocity thresholds for verified business accounts
- Enhance VPN detection (12 cases bypassed)
- Add biometric step-up auth for high-risk transactions

🧪 TESTING & VALIDATION

Test Scenarios

1. Velocity Test: Simulate 20 rapid transactions from same account
2. Geo Test: Login from Lagos, then Paris within 30 min
3. Amount Test: Transaction 10x above user's average
4. Device Test: Login from new device with VPN
5. Pattern Test: Simulate money mule pattern (rapid in-out)

Expected Results

• All 5 scenarios should trigger fraud alerts
• Critical scenarios (2, 5) should auto-block
• Medium scenarios (1, 3, 4) should require 2FA
• All alerts delivered within 10 seconds

🔐 DATA PRIVACY & COMPLIANCE

Data Retention

• Device fingerprints: 2 years
• Fraud incidents: 7 years (legal requirement)
• Behavioral biometrics: 1 year
• IP addresses: 1 year

GDPR/NDPR Compliance

• Users can request fraud data deletion (with exceptions)
• Pseudonymize PII in fraud reports
• Obtain consent for behavioral biometric tracking
• Right to appeal false positive blocks

---

Version: 1.0.0
Last Updated: October 24, 2025
Maintainer: CemaPay Security Team
Support: security@cemapay.com