Anomaly Detection
Anomaly detection scans transactions for three narrow patterns — likely duplicate charges, unusually large amounts, and price increases on recurring charges — and reports them as observations rather than conclusions.
In short
Three specific, narrow checks, not a general fraud detector: same vendor and amount within five days, a charge far larger than typical for the account, and a recurring charge whose price went up. Every flag is something to check, not proof of a problem — a clean scan especially doesn't mean nothing happened.
Also called: transaction anomaly scan
Anomaly detection here is a named set of three checks, not a capability that improves with use. It looks for a repeated vendor and amount within a short window, a charge far larger than that account's own history, and a recurring charge whose price has risen. Everything outside those three shapes is invisible to it.
The word is doing more work than the feature does, which is why the boundary matters more than the definition. It is not fraud detection, not machine learning, and not a review of whether a transaction was appropriate. It compares numbers against patterns someone specified in advance.
The consequence worth internalising is what a clean result means. An empty report says nothing matched three narrow patterns — not that nothing unusual happened. Read it as a filter that surfaced no candidates, never as a statement that the month was fine.
Its output is observations rather than conclusions. Every item is a thing to look at, and a flagged duplicate is often a legitimate second purchase from the same vendor on the same day.
What people get wrong
- Treating a clean anomaly scan as proof nothing's wrong, especially for the price-increase check, which is deliberately conservative and will miss real increases with messy data behind them.
- Assuming a flagged duplicate or large charge is automatically a problem — the tool reports a pattern, not a verdict; a repeat or a big charge can be entirely legitimate.
- Expecting general-purpose fraud detection — the three checks are specific and narrow, not a comprehensive scan for every kind of unusual activity.
Common questions
- If anomaly detection finds nothing, are my books clean?
- Not necessarily, especially for price increases — the checks are deliberately narrow, and an empty result means nothing matched those specific patterns, not that nothing unusual happened.
- Is a flagged duplicate charge automatically a mistake?
- No — it's an observation worth checking, not a verdict. A repeated charge for the same vendor and amount can be a legitimate double order.
Machine-readable: /api/knowledge/concept:anomaly-detection