{"id":"concept:anomaly-detection","kind":"concept","label":"Anomaly Detection","synonyms":["transaction anomaly scan"],"definition":"Anomaly detection scans transactions for three narrow patterns — likely duplicate charges, unusually large amounts, and price increases on recurring charges — and reports them as observations rather than conclusions.","summary":"Three specific, narrow checks, not a general fraud detector: same vendor and amount within five days, a charge far larger than typical for the account, and a recurring charge whose price went up. Every flag is something to check, not proof of a problem — a clean scan especially doesn't mean nothing happened.","explanation":["Anomaly detection looks for three specific, narrow patterns rather than trying to be a general-purpose fraud detector: the same vendor and amount charged more than once within five days of each other, a single charge far larger than what's typical for that account's own history, and a recurring charge whose price went up compared to its own prior history. Each one is reported as an observation, not a verdict — a repeated charge might be a legitimate double order, and a big one might be a planned purchase.","The duplicate and unusually-large checks are the more mechanically reliable of the three, since their patterns are straightforward: same amount and vendor close together in time, or a number that genuinely stands out against the account's own history. Still worth a human glance, but less likely to miss something real.","The price-increase check is the one most worth understanding before relying on it, because it's deliberately conservative in a way that shapes how a clean result should be read. It only flags an increase when every earlier charge matched exactly in both amount and description — not approximately, exactly. A subscription billed under a slightly different name one month, or one that varied by even a cent before the increase, won't register as a pattern at all.","That means an empty result from anomaly detection, especially regarding price increases, is not the same as \"nothing unusual happened\" — it means nothing matched the specific, deliberately narrow patterns this check looks for, not that a clean bill of health has been proven. It also determines nothing about intent; it only reports a pattern, leaving the judgment of what it means to a person."],"commonMistakes":["Treating a clean anomaly scan as proof nothing's wrong, especially for the price-increase check, which is deliberately conservative and will miss real increases with messy data behind them.","Assuming a flagged duplicate or large charge is automatically a problem — the tool reports a pattern, not a verdict; a repeat or a big charge can be entirely legitimate.","Expecting general-purpose fraud detection — the three checks are specific and narrow, not a comprehensive scan for every kind of unusual activity."],"category":"analysis","questions":[{"question":"If anomaly detection finds nothing, are my books clean?","answer":"Not necessarily, especially for price increases — the checks are deliberately narrow, and an empty result means nothing matched those specific patterns, not that nothing unusual happened."},{"question":"Is a flagged duplicate charge automatically a mistake?","answer":"No — it's an observation worth checking, not a verdict. A repeated charge for the same vendor and amount can be a legitimate double order."}],"url":"/glossary/anomaly-detection","relatedTo":[{"id":"concept:price-increase-detection","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Aprice-increase-detection"},{"id":"concept:duplicate-transaction","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Aduplicate-transaction"},{"id":"concept:spending-summary","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Aspending-summary"},{"id":"concept:reconciliation-difference","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Areconciliation-difference"},{"id":"tool:find_anomalies","relationship":"references","weight":0.7,"api":"/api/knowledge/tool%3Afind_anomalies"}],"referencedBy":[{"id":"concept:duplicate-transaction","label":"Duplicate Transaction","url":"/glossary/duplicate-transaction"},{"id":"concept:price-increase-detection","label":"Price Increase Detection","url":"/glossary/price-increase-detection"}],"license":"https://creativecommons.org/licenses/by/4.0/","attribution":"BalanceMCP — https://balancemcp.com"}