System and method for implementing autonomous fraud risk management

A system that implements autonomous fraud risk management for ATM transactions, wherein the system is configured to generate fraud rule recommendations to one or more users on a near real-time basis, the system comprises:

• an interface of a computing device that receives input from the one or more users;
• and
• a fraud risk management server comprising a computer processor, electronically coupled to a memory component and the interface, the computer processor further programmed to perform the steps of:
• loading initial data associated with a product from data stored in a cloud services platform, wherein the product comprises a financial transaction service offered at an ATM;
• subsequently loading a plurality of other user-based events that occurred in connection with the product, wherein the subsequent loading generates a feature space for the plurality of events, wherein over a thousand features are generated for each of the plurality of events;
• performing feature engineering on the generated feature space to generate a set of features,
• wherein feature engineering comprises feature exclusion, feature generation and feature transformation,
• wherein the feature generation and the feature transformation are performed after the feature exclusion,
• wherein the performing of the feature exclusion includes each of excluding one or more null columns, one or more universal exclusion variables, one or more cardinality columns, and one or more variables with volatility above a certain threshold from further processing for conserving computing resources when performing the feature generation and the feature transformation, and
• wherein the feature reduction on the generated feature space is performed via a random forest algorithm to reduce a number of features included in the generated feature space to a limited list of select features indicative of potential fraud;
• initially training a machine learning model based on an initial training data set including the limited list of select features, the initial training data set including features of a potential fraudulent event;
• monitoring the machine learning model in production to generate a new training data set comprising subsequent data and related events associated with the product;
• retraining, on a daily basis, the trained machine learning model using the new training data set, the new training data set including features of another potential fraudulent event different from the potential fraudulent event;
• developing fraud rule recommendations, on the daily basis, by applying the retrained machine learning model to the set of features to identify a decision tree model among a plurality of decision tree models having different tree depths and different number of nodes;
• based on the decision tree model, identifying a set of top recommended rules that are new using performance evaluation of the fraud rule recommendations, wherein the performance evaluation relates to a false positive rate (FPR), return on investment (ROI), and a fraud rate;
• displaying the results of the performance evaluation on the interface to allow a user to interact with a virtual analytics assistant to modify and customize the set of top recommended rules;
• testing each of the set of top recommended rules in silent mode;
• responsive to the testing, automatically approving or rejecting at least one rule of the set of top recommended rules;
• when the at least one rule is automatically approved, upgrading the at least one rule to production;
• performing rule performance evaluation and monitoring;
• automatically decommissioning the at least one rule in product when the monitoring detects a failure to meet minimum performance standards and pruning the decision tree model in response to the decommissioning;
• displaying on the interface, for user visualization, the pruned decision tree model;
• detecting and tracking a number of ATM transactions in different ATMs at different locations;
• determining whether the number of ATM transactions conducted using the different ATMs at the different locations reached a peak during a reference period of time, wherein the peak comprises a spike in the number of transactions or dollar amounts during a short window of time;
• and
• when the number of ATM transactions using the different ATMs at the different locations is determined to have reached the peak, determining, by applying the pruned decision tree, whether the detected peak corresponds to a fraud event.