The fraud loss report usually reaches the finance director after the money is gone. The case is closed, an irreversible transfer has settled, and what remains is an analysis of the past. The problem in financial institutions is not a shortage of data; it is the distance between the moment something happens and the moment anyone notices.

Credit risk repeats the same logic over a longer horizon. A decision made today about an applicant shows up months later in the default rate. In both situations machine learning does one specific job: it shortens that distance and moves judgement out of an analyst's memory into a pattern that can be measured.

Three places a model sits in the financial cycle

• Credit scoring: Estimating default probability from how comparable borrowers behaved, not from collateral and paperwork alone.
• Transaction monitoring: Flagging an inconsistent pattern as it occurs, before final settlement.
• Early warning: Detecting gradual drift in the credit portfolio while a repayment conversation is still possible.

The real question is the threshold, not the algorithm

Fraud monitoring produces two kinds of error, and reducing one enlarges the other. Raise the sensitivity and legitimate transactions are stopped, damaging the customer experience; lower it and more cases pass the filter. Choosing that point is a commercial decision, not a technical one: the cost of one stranded customer against the cost of one fraudulent transaction. An organization that has never written that number down moves the threshold after every complaint and never learns whether its system improved.

Why the decision is urgent this year

Volume in non-branch channels has grown faster than manual review can follow. Adding reviewers scales linearly; transaction growth does not. Beyond a certain point the review queue stops being a staffing problem and becomes a design problem: which cases should reach a human at all.

Why it matters for mid-size Iranian institutions

Payment gateways, leasing firms, insurers and online retailers carry the same exposure, with the difference that their review teams are small. The necessary data already exists in the form of transaction history. What is usually missing is labels: a written record of cases confirmed as fraud. Without them no supervised model can be trained, and building that record can start this week without buying any technology.

The first 90 days

• Day 1 to 30: Pick one high-volume channel and label the confirmed fraud cases of the past two years; usually the most time-consuming part of the work.
• Day 30 to 60: Test the model on historical data and run its output in shadow mode alongside the current process, stopping no transactions.
• Day 60 to 90: Set the threshold from the real cost of both error types and let the model into the decision path only in the high-risk band.

Common mistakes

• Judging the model by overall accuracy; on data where under one percent of cases are fraud, a model that always answers clean also scores high.
• Ignoring how fraudsters adapt; patterns change once detected, and a model that is never retrained loses credibility quarter by quarter.
• Blocking automatically without a clear appeal path; a customer stopped without explanation can cost more than the fraud itself.
• Not recording the reason for a decision; if you cannot explain a rejection, neither an auditor nor a customer will be satisfied.

Three actions for this quarter

• Put a number on both types of error and set the threshold from those numbers rather than from instinct.
• Run the system in shadow mode for several weeks so alert quality is clear before anything is blocked.
• Keep an analyst as the final arbiter and record each approval or rejection as training data for the next round.

Frequently asked questions

• What if past fraud cases were never documented?
  You can start with anomaly detection methods that need no labels, but their output is noisier. Labelling from today onward determines the quality of the next iteration.
• How often should the model be retrained?
  The trigger is performance decay, not the calendar. When the detection rate falls or false alerts rise, retraining is due.
• Does the model replace the compliance and review team?
  No. It orders the queue and sets low-risk cases aside; sensitive cases still require a human signature.

Takeaway

In risk and fraud, the value of AI lies in time rather than in model sophistication. Every hour cut between occurrence and detection translates into smaller losses. An organization that keeps its labels tidy and knows the cost of its errors has already done the hard part.

Glossary

• Risk score: A number estimating the loss probability of a decision or a transaction.
• False positive: An alert raised by the system on a case that is in fact legitimate.
• Labelling: Recording the true outcome of past cases so a model can learn from them.
• Shadow mode: Running a new system alongside the current process without letting its output change any decision.
• Retraining: Training the model again on fresh data after real-world behaviour shifts.
• Default rate: The share of facilities that were not repaid.