Anomaly Detection
Anomaly detection scans transactions for three narrow patterns — likely duplicate charges, unusually large amounts, and price increases on recurring charges — and reports them as observations rather than conclusions.
In short
Three specific, narrow checks, not a general fraud detector: same vendor and amount within five days, a charge far larger than typical for the account, and a recurring charge whose price went up. Every flag is something to check, not proof of a problem — a clean scan especially doesn't mean nothing happened.
Also called: transaction anomaly scan
Anomaly detection looks for three specific, narrow patterns rather than trying to be a general-purpose fraud detector: the same vendor and amount charged more than once within five days of each other, a single charge far larger than what's typical for that account's own history, and a recurring charge whose price went up compared to its own prior history. Each one is reported as an observation, not a verdict — a repeated charge might be a legitimate double order, and a big one might be a planned purchase.
The duplicate and unusually-large checks are the more mechanically reliable of the three, since their patterns are straightforward: same amount and vendor close together in time, or a number that genuinely stands out against the account's own history. Still worth a human glance, but less likely to miss something real.
The price-increase check is the one most worth understanding before relying on it, because it's deliberately conservative in a way that shapes how a clean result should be read. It only flags an increase when every earlier charge matched exactly in both amount and description — not approximately, exactly. A subscription billed under a slightly different name one month, or one that varied by even a cent before the increase, won't register as a pattern at all.
That means an empty result from anomaly detection, especially regarding price increases, is not the same as "nothing unusual happened" — it means nothing matched the specific, deliberately narrow patterns this check looks for, not that a clean bill of health has been proven. It also determines nothing about intent; it only reports a pattern, leaving the judgment of what it means to a person.
What people get wrong
- Treating a clean anomaly scan as proof nothing's wrong, especially for the price-increase check, which is deliberately conservative and will miss real increases with messy data behind them.
- Assuming a flagged duplicate or large charge is automatically a problem — the tool reports a pattern, not a verdict; a repeat or a big charge can be entirely legitimate.
- Expecting general-purpose fraud detection — the three checks are specific and narrow, not a comprehensive scan for every kind of unusual activity.
Common questions
- If anomaly detection finds nothing, are my books clean?
- Not necessarily, especially for price increases — the checks are deliberately narrow, and an empty result means nothing matched those specific patterns, not that nothing unusual happened.
- Is a flagged duplicate charge automatically a mistake?
- No — it's an observation worth checking, not a verdict. A repeated charge for the same vendor and amount can be a legitimate double order.
Machine-readable: /api/knowledge/concept:anomaly-detection