We'll get back to you within 24 hours.
We built a real-time ML fraud detection system for a UPI payments fintech — analyzing 200+ transaction signals in under 50ms to classify each transaction as legitimate or fraudulent, saving ₹4.8 Cr in year 1 while blocking fewer genuine transactions than the rule-based system it replaced.
Industry Context
India's digital payments ecosystem processed over 14,726 crore UPI transactions worth ₹200 lakh crore in FY 2024-25 — creating one of the world's largest fraud attack surfaces. As payment volumes grow, traditional rule-based fraud systems that worked for 2019 transaction volumes are failing to keep pace with sophisticated modern fraud rings that operate with near-algorithmic precision.
RBI's Annual Report on Payment System Data shows UPI fraud complaints have grown 67% year-over-year, with cumulative losses in the digital payments ecosystem exceeding ₹20,000 crore annually. For fintech companies facilitating UPI payments, fraud losses represent a direct hit to P&L. The average UPI fintech with ₹50-100 crore monthly GMV loses between ₹60 lakh and ₹2 crore monthly to fraud without adequate ML detection in place. Our client was experiencing ₹35-40 lakh in monthly fraud losses before the ML system was deployed.
The fundamental problem with rule-based fraud detection is that rules are static while fraudsters are dynamic. A rule that blocks "new device + new city + high amount" gets circumvented by fraudsters within weeks — they simply start with small amounts from new devices. Studies of Indian payment fraud show that the average time between a new fraud pattern emerging and a corresponding rule being deployed is 23-35 days — a window during which fraudsters operate freely. Our client was losing ₹35-40 lakh per month in this "rule lag" window alone, a cost completely eliminated by continuous ML retraining.
Every payment blocked incorrectly is a customer moment destroyed. India's mobile payment users have high expectations for frictionless transactions — a user whose legitimate payment is blocked for the second time will switch to a competing app. Research from digital payment platforms shows users blocked for false positive fraud have an 8x higher churn rate than unaffected users. Our client's 22% false positive rate was generating roughly 14,400 incorrectly blocked transactions monthly — each one a potential customer lost, plus ₹86,400/month in unnecessary customer support costs.
The Challenge
Our Solution
A gradient boosting ML model trained on 18 months of transaction history that scores each transaction across 200+ features in real time — and self-adapts as fraud patterns evolve.
The fraud score draws on an exhaustive feature set assembled in real time: user behavioral baseline — typical transaction amount, time, merchant type, and geographic range over 30/60/90 days. Device intelligence — is this device fingerprint known? Has it been seen across multiple accounts (mule device indicator)? Velocity checks — transactions in the last 1/6/24 hours and total value. Network graph signals — recipient account age, transaction history, and network centrality. Contextual signals — VPN usage, device jailbreak status, IP address reputation. All 200+ features are computed in under 20ms using a Redis feature cache that pre-materializes the most expensive computations. The breadth of signal — covering device, behavior, network, and context simultaneously — is what allows the model to catch fraud patterns that any single signal category would miss.
We trained an XGBoost gradient boosting model on 18 months of labeled transaction data containing 47 million transactions (1.2% fraud rate, balanced through SMOTE oversampling). The model outputs a probability score 0–1 per transaction with three routing tiers: Score < 0.20 → auto-approve with no added friction. Score 0.20–0.75 → step-up authentication (OTP or biometric challenge — justified friction that catches moderate-confidence fraud without hard blocking). Score > 0.75 → auto-block with fraud ops review. The three-tier approach — rather than a binary block/allow — was critical to reducing false positives, since medium-confidence cases get additional authentication rather than outright rejection. This structure reduced hard blocks by 31% while maintaining fraud catch rates above the rule-based system.
The entire fraud scoring pipeline — feature retrieval from Redis cache, model inference, threshold evaluation, and decision return — runs in under 50 milliseconds. This was a hard engineering requirement: UPI payment processing has a 300ms total latency budget, and the fraud check must not perceptibly slow down the payment experience. We achieved this through: a FastAPI inference microservice running on Kubernetes with horizontal autoscaling at 70% CPU utilization; a Redis feature store that pre-computes user-level behavioral features every 15 minutes; and Apache Kafka for asynchronous post-decision event logging — the decision is returned to the payment system without waiting for logging to complete. The system handles 10,000 concurrent transaction scoring requests during peak periods without latency degradation, validated in load testing at 15,000 concurrent requests.
Fraud detection models decay faster than almost any other ML model — the underlying distribution shifts as fraudsters adapt. We built a weekly automated retraining pipeline on Apache Airflow that: pulls all confirmed fraud labels from the past 7 days; retrains the XGBoost model on an 18-month rolling window incorporating new fraud cases; runs validation on a held-out test set; and deploys to production only if precision, recall, and AUC-ROC metrics improve or maintain versus the previous model. If the new model underperforms — because a new fraud pattern has too few labeled examples yet — the old model stays in production and the fraud ops team receives an alert. The continuous learning loop means a new fraud pattern that emerges on a Monday is typically incorporated into the model by the following Monday — reducing "rule lag" from 23-35 days to 7-8 days.
Implementation Journey
Comprehensive audit of 18 months transaction data. Worked with fraud ops to label 50,000 known fraud cases. Designed 200+ feature taxonomy. Set up Kafka event streaming infrastructure.
Trained XGBoost on 47M transaction dataset. A/B tested 8 model variants. Ran precision-recall analysis across 12 fraud pattern types. Calibrated three-tier scoring thresholds with fraud ops team.
Built FastAPI inference microservice. Deployed Redis feature cache cluster. Set up Kubernetes autoscaling. Integrated with UPI payment processing via API. Built fraud operations dashboard in React with SHAP explainability.
Ran ML model alongside rule engine for 3 weeks — ML decisions logged but not enforced. Compared ML vs rule catches. Fine-tuned thresholds. Launched on 10% of traffic, validated, then 100%.
Rule engine decommissioned (retained as fallback for known pattern rules only). ML-driven fraud scoring live on all transactions. Airflow weekly retraining pipeline activated. Month 1 result: ₹42 lakh fraud prevented.
Results
Up from 71% with the rule-based system — a 23 percentage point improvement. Sophisticated multi-step fraud patterns (smurfing, SIM swap behavioral sequences, account takeover anomalies) that were completely invisible to rules are now caught by the ML model's behavioral analysis. The model catches approximately 8,400 fraudulent transactions per month that the old system was missing, representing direct fraud prevention rather than absorbed losses.
False positive rate dropped from 22% to 5.3% — instead of 1 in 5 blocked transactions being legitimate, only 1 in 19 is. Approximately 10,800 fewer incorrect blocks per month. Customer satisfaction for payment experience improved 18 points following ML deployment. Support call volume for "why was my payment blocked?" queries dropped 78%, saving ₹86,400/month in handling costs on its own.
Fraud scoring adds only 50ms to payment processing — imperceptible to users. The fintech maintains its UPI SLA while running sophisticated ML inference on every single transaction. P99 latency (worst 1% of requests) is 87ms, well within the 300ms UPI processing budget even in worst-case scenarios during festival peaks. Validated in load testing at 15,000 simultaneous scoring requests — equivalent to peak Diwali traffic.
Incremental fraud prevented in year 1 over the old rule-based system — more than 12x the cost of building the ML system. The ₹4.8 crore breaks down as: ₹2.9 crore from newly caught fraud the rules were missing, ₹1.2 crore from improved accuracy on fraud the rules were catching with high false positives, and ₹70 lakh from reduced false-positive churn (revenue from customers who would have left after incorrect blocks).
ROI Analysis
The investment case for ML fraud detection is straightforward when the costs of inaction are properly quantified. Our client's ₹38 lakh build cost was recovered within the first 3 months of operation.
| Value Component | Annual Value | Basis |
|---|---|---|
| Incremental fraud prevented (vs rule engine) | ₹4.8 Cr | Actual Year 1 measurement |
| Support cost savings (fewer false positive calls) | ₹10.4 L | 10,800 fewer calls/month × ₹80 handling cost |
| Reduced false-positive churn (retained customers) | ₹68 L | 3,800 customers retained × ₹1,800 avg LTV |
| Fraud ops productivity gain | ₹8.4 L | 45% workload reduction on 3-person fraud team |
| Total Annual Benefit | ₹5.87 Cr | |
| ML system build cost (one-time) | ₹38 L | One-time investment |
| Ongoing infrastructure + maintenance | ₹12 L/yr | Cloud infra + model retraining ops |
| Year 1 Net ROI | 12.1x | ₹5.87 Cr benefit / ₹50 L total cost |
Tech Stack
FAQ
Related Services
Get a free fraud risk assessment of your current transaction monitoring. We'll identify the patterns your rules are missing and estimate your preventable loss exposure.
Get Free Fraud Detection Assessment