Glossary
Anomaly detection is the identification of data points, events, or behaviors that deviate significantly from an established pattern of "normal": flagging the unusual as potentially indicative of fraud, account takeover, or other threats. It’s a foundational technique in fraud detection, because fraud, almost by definition, looks different from legitimate behavior.
Rather than defining every possible fraudulent action in advance (impossible, as tactics evolve), anomaly detection learns what normal looks like and surfaces what doesn’t fit, which lets it catch novel and unforeseen threats.
The system first establishes a baseline of normal behavior (for an individual account, a population, or both) using statistical methods or machine learning. It then compares new activity against that baseline and scores how far it deviates. Significant deviations are flagged for action: a login from an impossible location, a transaction far outside normal amounts, a burst of activity inconsistent with the account’s history, or interaction that doesn’t resemble a human. The baseline adapts over time, so "normal" stays current as legitimate behavior evolves.
Anomaly detection’s key advantage is catching the unknown. Rules-based systems only catch what they’ve been told to look for, so novel fraud slips through until someone writes a new rule. Anomaly detection flags anything that deviates from normal, including attacks no one has seen before, a crucial capability against fast-evolving fraud. It’s also well-suited to the many fraud types that manifest as deviations: account takeover, unusual transactions, bot activity, and coordinated attacks.
The flip side is that not every anomaly is fraud: legitimate behavior can be unusual too (a customer travels, makes an uncharacteristic large purchase, or changes habits). Naive anomaly detection can generate false positives that frustrate customers and burden review teams. The art is calibration and context: weighing an anomaly against other signals (device, identity, behavior) so a genuine-but-unusual action isn’t treated the same as a suspicious one. This is why anomaly detection works best as one input into a broader, contextual risk decision rather than a standalone trigger.
Modern anomaly detection is largely powered by machine learning, which can model complex, high-dimensional notions of "normal" that simple thresholds can’t, and adapt as behavior shifts. Combined with the other signals in a fraud engine (and with explainability so analysts understand why something was flagged) it becomes a precise, adaptive core of fraud detection rather than a noisy alarm.
What is anomaly detection?
Identifying activity that deviates significantly from established normal patterns, flagging it as potential fraud or a threat.
Why is anomaly detection useful against fraud?
It catches novel, previously unseen attacks by flagging anything abnormal, unlike rules that only catch known patterns.
What’s the downside of anomaly detection?
Legitimate behavior can be unusual too, so it can generate false positives, which is why it works best combined with contextual signals.
How is anomaly detection different from rules?
Rules catch only known, predefined patterns; anomaly detection flags anything abnormal, including novel attacks no rule anticipated.
What powers modern anomaly detection?
Machine learning, which models complex notions of "normal" and adapts over time, beyond what fixed thresholds can capture.
Does every anomaly mean fraud?
No, legitimate behavior can be anomalous, so anomalies should be weighed with other signals rather than treated as automatic fraud.
Related: Behavioral Analytics · Machine Learning for Fraud · Risk Scoring · Fraud Detection · Account Takeover (ATO)
