AI fraud detection: spotting unusual patterns in digital identity transactions

At Signicat, we’re developing an AI-based approach to fraud detection built around a simple idea: to identify what looks unusual, you first need to understand what expected behaviour looks like.

Millions of transactions pass through our digital identity platform every day, across onboarding, signing, user logins and automated identity workflows. Over time, these transactions can show patterns in how an end user normally uses their digital identity.

What is AI fraud detection?

AI fraud detection uses AI and machine learning to identify unusual patterns in transaction data that may indicate increased fraud risk. In our approach, this means learning what is expected in digital identity transactions and identifying activity that does not fit that pattern. It can combine several signals to highlight transactions that may need closer attention.

How AI fraud detection identifies unusual behaviour

A pattern can consist of several different signals. When does a person usually use their digital identity? Is it mainly on weekdays, or at a certain time? How often do they use it? Which operating system do they normally use? Is the geolocation new or unexpected? Together, signals like these can help build a picture of what is expected for that end user.

But a deviation is not the same as fraud. Someone logging in at an unusual time does not automatically make the transaction fraudulent. The same applies to a new location or another change in behaviour. The value comes from looking at signals together. A transaction may warrant closer attention when several parts of the usual pattern are unusual at the same time.

This is where AI and machine learning can help. We can train the model on transactions over time so it learns what to expect from an end user. When a new transaction passes through our platform, the model compares the incoming information with the expected pattern. Rather than relying on one signal, the model can combine several findings to identify when a transaction does not fit what it has learned to expect.

Customer feedback also plays an important role. When customers confirm whether flagged activity was actually fraudulent or not, that feedback can be used to train the model further. This gives customers a way to help improve the model for their own users: as the model learns from more confirmed cases, it can become more precise at distinguishing expected behaviour from activity that needs closer attention.

From unusual behaviour to a fraud risk score

The model does not make the final decision about whether a transaction is fraudulent. Instead, it returns a calculated risk score together with the triggers identified in the transaction. This gives our customers information they can use to decide what should happen next. They may, for example, choose to add an extra verification step or cancel the transaction. The role of the model is to surface risk, not to make the decision for the customer.

Detecting unusual activity without adding friction

AI fraud detection needs to identify suspicious activity without adding unnecessary checks to every transaction. Our model works in the background. The end user does not notice anything unless a transaction is flagged and our customer decides to take action. This means we can look for unusual activity without automatically adding another step to every user journey.

Protecting PII within the model
When the model learns these end-user patterns, the data used within the model is anonymised. When a result needs to be connected to an end user, a customer with the correct access can retrieve the information needed to protect that person.

The aim is not to treat every unusual action as suspicious. It is to make better use of the signals already present in digital identity transactions and support identity fraud detection by identifying the cases that deserve more attention.

As we continue developing this approach, the goal is to help our customers identify potentially suspicious behaviour and decide when additional action is actually needed.