The Outlier Lab

Transaction Pattern Anomalies

Deviations in amount, timing, rail, counterparty and sequence from an account's own baseline and its peers, which make up the core feature set of most transaction risk models.

What it measures

There are three comparison frames, and each catches different fraud:

FrameQuestionTypically catches
Self-baselineIs this unusual for this customer?ATO, scams, elder exploitation (the account's behavior changes)
Peer baselineIs this unusual for customers like this (segment, tenure, product)?Mules and bust-out (the account was never normal)
TrajectoryIs the account's behavior shifting in a direction associated with fraud?Bust-out ramp, scam "grooming" (small test sends then large), kiting cycles

The core feature families are amount relative to history (z-score, percentile, ratio to max ever); new rail for the customer (first wire, first crypto purchase, first instant payout); new counterparty; time-of-day and day-of-week deviation; balance depletion (share of available funds moved); round-number and just-below-limit amounts; sequence features (funding → trade → withdrawal; gift card purchase bursts; product liquidation followed by transfer out).

Why it matters

Fraud that runs through a legitimate customer's account, whether taken over or manipulated, can't hide that the pattern changed. FinCEN's red flags across alerts are largely pattern anomalies: dormant accounts with large balances suddenly showing frequent withdrawals; early cash-out of savings products then transfers to virtual asset providers; sudden gift card or crypto purchases by customers with no history of either; multiple transfers labeled as taxes or fees. FinCEN's elder exploitation trend analysis covered 155,415 reports and about $27 billion in suspicious activity over one year, roughly 80% of it scams, and almost all of those present as the customer's own account behaving out of character.

The 2026 Nacha rules make pattern monitoring explicit for ACH: originators and ODFIs must maintain risk-based processes to identify entries that are unauthorized or induced under false pretenses, and RDFIs must monitor incoming credits. Nacha's own examples include unusually large amounts, clusters of similar credits, and activity on new or dormant accounts.

How to collect it

  • Transaction and ledger events across all rails in one customer view, because the scam often crosses rails (savings → checking → wire; brokerage sell → ACH out).
  • Baselines computed in batch (rolling windows of 30/90/365 days) and served in real time via a feature store; see Fraud Data Architecture.
  • Enrich with counterparty data (Payee and Counterparty Risk), memo/description text, and merchant or security metadata.
  • Build vs. buy: transaction monitoring and scoring platforms ship generic anomaly features and consortium-trained models; your own baselines and cross-product sequences are rarely available off the shelf. Most programs run both.

How to use it

  • Combine with "who is acting": anomaly + risky session (Login Anomalies, Account Change Events) points to ATO; anomaly + clean session on the customer's own device points to a scam (Scam Victim Indicators) or first-party behavior. The right response differs: step-up for ATO, intervention and friction for scams.
  • Combine with counterparty: an anomalous amount to a long-standing payee is far less risky than a normal amount to a brand-new payee on an instant rail.
  • Use sequence models for multi-step patterns rather than scoring each transaction in isolation. In a sell-then-withdraw sequence, the liquidation is the warning and the withdrawal is where the loss happens.
  • Response tiering: score → friction (Payee Confirmation and Payment Friction) → hold (Funds Availability Holds) → review (Manual Review Queues).

Strengths and limitations

Strengths: detects fraud regardless of how access was obtained; works for authorized scams where identity signals are useless; well suited to ML.

Limitations: needs history (weak on new accounts; use peer baselines and Customer Tenure and History). Pattern features can be degraded by patient adversaries and by scam victims who are being coached, so pattern anomaly works best as one input among several. Baselines drift with seasonality and life events. Model performance depends heavily on label quality (Fraud Labeling and Feedback Loops).

False positives and fairness

  • Life events: home purchases (large wires), inheritances, divorces, medical bills, tuition, relocation.
  • Seasonal spikes: tax refunds, holiday shopping, bonuses, annual insurance premiums.
  • Legitimate first-time crypto or investment activity.
  • Small business owners running business payments through personal accounts, with irregular large inflows and outflows that look like mule activity.
  • Older adults reorganizing finances legitimately; avoid age-triggered rules that produce disparate treatment.

Measure false positive rates and intervention outcomes by segment, and give customers a clear path to confirm intent.

Privacy and compliance considerations

Pattern monitoring is core to BSA/AML programs and the 2026 Nacha fraud monitoring rules; document the risk assessment that defines higher-risk transactions. Holds and declines must align with Reg E, Reg CC and network rules. Avoid protected-class proxies. See BSA-AML and SAR Filing and Nacha Rules and ACH Risk.

Mechanisms it helps detect

Account Takeover (ATO) · Authorized Push Payment (APP) Scams · Investment Scams (Pig Butchering) · Elder Financial Exploitation · Bust-Out Fraud · Money Mules · Real-Time Payment Rail Fraud · Gift Card Fraud · Card-Not-Present Fraud (spend out of pattern for the cardholder)

Velocity Signals · Fast In Fast Out Patterns · Funding Source Signals · Trading Pattern Signals · Real-Time Transaction Risk Scoring · Transaction Monitoring · Machine Learning Models · Rules Engine · Playbook - Scam Intervention Members

Sources and further reading