Why fraud models fail at the last mile

When a bank's fraud losses rise, the first instinct is to improve the model. Add more data, try a newer algorithm, tune the threshold. Sometimes that helps. More often, the model was already catching a good share of the fraud, and the losses happened afterwards, in what I think of as the last mile: the steps between a model raising a flag and the money being stopped.

What the last mile looks like

A fraud score is only useful if something happens because of it. The last mile is everything that has to happen:

• the alert reaches someone, or something, that can act
• the alert is reviewed in time
• the right action is taken, whether that is blocking, holding, calling the customer or allowing
• the customer is told, in a way they believe and understand
• the outcome is fed back so the model learns

Each step has its own failure rate. A model that catches most fraud can still lose most of the money if the steps after it are slow.

Where it breaks

Queues. Alerts go to a review team that works office hours, while fraud happens at night and at weekends. By the time an analyst looks, the money has moved through several accounts.

Friction budgets. Every blocked payment that turns out to be genuine is an angry customer. Business teams push thresholds up to protect the experience, and the model is quietly asked to catch less.

Authorised fraud. In many scams, the customer makes the payment themselves, persuaded by a caller. The model may flag it correctly, and the customer insists on going ahead. A warning screen is not enough. Someone, or something, has to break the spell, and that is a design problem as much as a modelling one.

Mule accounts. Fraud money is moved quickly through accounts opened for the purpose. Detecting the receiving account needs data and cooperation that a single bank's model does not have. Shared efforts such as the RBI Innovation Hub's mule detection work exist for this reason.

Feedback. If confirmed fraud cases are not labelled and returned to the model quickly, it keeps learning from last year's fraud.

A fraud model is only as good as the fastest thing the bank can do with its score.

What to fix first

1. Measure the last mile. Track the time from alert to action, and losses on alerts that were raised but not acted on in time. That number is often more revealing than the model's accuracy.
2. Automate the first response. A short, reversible hold on a high-risk payment is better than a perfect review that arrives after the money has gone.
3. Design the intervention. For authorised fraud, test what actually makes customers stop: a call, a pause, a specific question about who asked them to pay.
4. Close the loop. Label outcomes quickly and retrain often.

A better model is sometimes the answer. More often, the answer is a faster, better designed response to the model you already have.