MODEL CARD · VERSION 1.0
How the lab works
This lab uses deterministic synthetic data to demonstrate an analytical workflow. It is not a trained fraud model, a production rule set or a reconstruction of any employer’s systems.
Dataset
Sixty fictional customer accounts generate 3,771 transactions during August 2026. Seven accounts are assigned a synthetic review-worthy outcome: five form a linked fan-in and rapid cash-out cluster, and two show large payouts from newly observed foreign devices. Benign lookalikes include a marketplace seller and a household device shared by two customers.
Python pipeline
src/generate_lab.py creates accounts, devices, account-device links and transactions; loads SQLite; runs the SQL feature query; calculates a transparent point score; and exports JSON and CSV for the browser dashboard. A fixed random seed makes the results reproducible.
SQL features
- Distinct inbound counterparties by account and calendar day
- Outbound value within 60 minutes of inbound activity
- Number of other accounts connected to the same device
- Outbound activity within two days of a device first seen outside the customer’s country
Scoring
score = min(100, shared device peers × 12 + distinct daily inbound senders × 4 + rapid outbound amount ÷ 500 + new foreign-device outbound amount ÷ 350 )
The point weights are invented for education and intentionally interpretable. Moving the threshold changes alert volume, precision and recall against the seeded outcomes. These metrics describe this small constructed dataset only.
Important boundaries
- Ground-truth labels are visible for evaluation but would be unknown during live decisioning.
- A shared device or location mismatch is not proof of common control or fraud.
- The graph shows observed links, not ownership or identity.
- Calendar-day aggregation is simpler than a rolling 24-hour window.
- Loss, customer-friction and demographic fairness metrics are outside this first version.
- Production changes require mature outcomes, data-quality monitoring, segment testing, legal/compliance review and change governance.
Why this project exists
Current fraud and compliance roles repeatedly ask for SQL, Python, investigative judgment, graph analysis, control measurement, automation and communication with product, engineering and leadership. This project makes those skills inspectable without using confidential data.