Anomaly identification for fraud detection

A method of anomaly identification for fraud detection, the method comprising:

• receiving sales data from at least a first transaction node, the sales data indexed with one of a plurality of customer IDs;
• receiving refund data from at least a second transaction node, the refund data indexed with one of the plurality of customer IDs;
• determining, based at least on the sales data and the refund data, a plurality of metric data sets indexed with one of the plurality of customer IDs, wherein the plurality of metric data sets includes at least a return amount data set, a return frequency data set, and a return rate data set;
• determining a plurality of statistical distributions for the plurality of metric data sets, wherein the return amount data set, the return frequency data set, and the return rate data set are each fit to a different statistical distribution;
• determining, for each of the plurality of statistical distributions, a risk threshold to produce a plurality of risk thresholds;
• determining, for each selected customer ID within the plurality of customer IDs and based at least on the plurality of risk thresholds, whether at least one metric value from the plurality of metric data sets, indexed with the selected customer ID, meets a corresponding risk threshold;
• and
• based at least on the metric value indexed with the selected customer ID meeting the corresponding risk threshold, reporting a risk transaction.

One or more computer storage devices having computer-executable instructions stored thereon for anomaly identification and fraud detection, which, on execution by a computer, cause the computer to perform operations comprising:

• receiving sales data from at least a first transaction node, the sales data indexed with one of a plurality of customer IDs;
• receiving refund data from at least a second transaction node, the refund data indexed with one of the plurality of customer IDs;
• determining, based at least on the sales data and the refund data, a plurality of metric data sets indexed with one of the plurality of customer IDs, wherein the plurality of metric data sets includes at least a return amount data set, a return frequency data set, and a return rate data set;
• determining a plurality of statistical distributions for the plurality of metric data sets, wherein the return amount data set is fit to an exponential distribution, wherein the return frequency data set is fit to a Poisson distribution, and wherein the return rate data set is fit to a beta distribution;
• determining, for each of the plurality of statistical distributions, a risk threshold to produce a plurality of risk thresholds;
• determining, for each selected customer ID within the plurality of customer IDs and based at least on the plurality of risk thresholds, whether at least one metric value from the plurality of metric data sets, indexed with the selected customer ID, meets a corresponding risk threshold;
• and
• based at least on the metric value indexed with the selected customer ID meeting the corresponding risk threshold, reporting a risk transaction.