Security operations & fraud detection

A global bank replaced rules-based transaction monitoring with a cloud vendor's machine-learning anti-money-laundering (AML) product as its primary system in key markets, reporting 2–4× more confirmed suspicious activity with ~60% fewer alerts. Every number is a vendor-and-customer self-report with no independent audit — which is the honest structure of a domain where deployment-scale benefit is not publicly measured. Two dynamics govern it: extreme base rates (a threshold change moves the burden of alerts, not the truth) and a label-feedback loop (the model retrains on the investigators' own dispositions).

A neobank's fraud algorithms — triggered heavily by pandemic-era benefit deposits — froze and closed legitimate customers' accounts at scale, holding balances for 30 to 90+ days; the company admitted some closures were mistakes. A 2024 federal consent order ($3.25M penalty plus ≥$1.3M redress) priced not the model but the downstream operations backlog that turned a freeze into months without funds. The harm ran through three stages the organization controlled, and the enforcement attached to the last one.

A Nordic bank's legacy rules-based fraud system ran at ~40% detection with a 99.5% false-positive rate — the most credible datum in the record, because that badness is measured, not marketed. A deep-learning engine (real-time scoring under 300ms) claims −60% false positives and +50% detection (a vendor case study, not independently audited). The two-sided lesson: the same bank later ranked worst for reimbursing scam victims, and a regulatory rule — not a better model — moved the victim outcome from ~two-thirds to 89% sector-wide.