# Building fraud and KYC/AML detection pipelines
An account opens on a Tuesday morning. It passes identity checks in under 90 seconds. Three weeks later, that same account receives 14 small deposits from strangers and immediately forwards the money to a crypto exchange. You just watched a money mule launder funds, and every step of it left data behind.
This lesson follows that account from onboarding to payout, and shows you how to build the systems that catch it: device fingerprinting, transaction monitoring, and the machinery that files a Suspicious Activity Report (SAR), a mandatory disclosure banks send to regulators when they spot possible criminal activity.
Fraud is not one event. It is a pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →, and your detection has to match it stage for stage.
Stage 1: Onboarding. A synthetic identity (a fake person built from a real Social Security number plus fabricated details) or a stolen identity applies. This is where KYC (Know Your Customer, the legal requirement to verify who your customers are) and
Stage 2: Dormancy. Good mules stay quiet. The account behaves normally for days or weeks to build a "trust history" and slip past simple rules.
Stage 3: Activation. Money arrives, often in structured amounts (deliberately kept under reporting thresholds like the US $10,000 Currency Transaction Report line).
Stage 4: Payout. Funds move out fast, usually to a channel that is hard to reverse: crypto, gift cards, or another mule account.
Each stage produces a different data signal. Miss one and the whole chain completes.
At signup you have very little transaction history, so you lean on who and what is applying.
Device fingerprinting is the practice of building a semi-unique identifier from a device's attributes: operating system, browser version, screen resolution, installed fonts, timezone, and IP address. No single attribute is unique, but the combination usually is. The key fraud signal is not the fingerprint itself. It is repetition: one device fingerprint opening 50 accounts is a screaming red flag, even if each identity looks clean.
Other high-value onboarding signals:
For the regulatory baseline, the US Treasury's FinCEN publishes the Customer Due Diligence rule that governs what you must collect and verify.
The design tension here is real. Add too many checks and legitimate customers abandon the flow. This is onboarding friction, and in fintech it directly kills conversion. So you tier it: light checks for low-risk profiles, step-up verification (extra document, video call) only when signals cross a threshold.
Once the account is live, you shift from "who are you" to "what are you doing." Transaction monitoring is a continuous scoring system.
Two broad approaches, used together:
Rules-based monitoring. Explicit, human-written logic. Examples:
Rules are transparent and easy to explain to a regulator, which matters. But criminals learn them and stay just under the line.
Machine learning models. These score transactions on hundreds of features at once and catch patterns humans did not hand-code. The catch: they are harder to explain, and regulators expect model explainability (being able to justify why a customer was flagged).
Most mature fintechs run both: rules as a transparent safety net, ML for the subtle stuff.
Here is a simplified example of a velocity feature and a rule, the kind of logic that sits inside a monitoring engine:
# Flag rapid pass-through: money in, money out, minimal balance kept
def is_passthrough(account):
inflow = sum(t.amount for t in account.txns_24h if t.direction == "in")
outflow = sum(t.amount for t in account.txns_24h if t.direction == "out")
retained = inflow - outflow
# Mule accounts forward almost everything, fast
if inflow > 1000 and outflow >= 0.9 * inflow:
return True, "pass_through_pattern"
return False, NoneThis is intentionally basic. Real systems combine dozens of such signals into a single risk score.
This is the heart of the discipline. A fraud system that flags everything catches all the criminals and destroys the business.
Every alert costs money in two ways:
1. Investigation cost. A human analyst must review flagged accounts. Analysts are expensive and slow.
2. Customer harm. A wrongly frozen account means an angry customer, a support ticket, and often a lost relationship.
Industry commentary consistently notes that the large majority of AML alerts turn out to be false positives (figures above 90 percent are widely cited, though exact rates vary by institution and are hard to verify). That means most of your analysts' time is spent clearing innocent people.
The trade-off is captured in two terms:
Push recall up (catch more fraud) and precision usually drops (more false alarms). You cannot maximize both. The business, compliance, and risk teams must jointly decide the acceptable point, because the "right" answer depends on risk appetite and regulatory exposure, not on math alone.
A practical tactic: risk tiering the response. Not every alert needs an account freeze. Options escalate in severity:
This preserves customer experiencecustomer experienceThe overall perception a customer forms of your brand across every interaction, from first touch to post-purchase support.View full definition → while still containing risk.
Knowledge check
1. Why does the lesson describe fraud as a 'pipeline' that detection must match 'stage for stage' rather than as a single event to catch?
2. An account behaves completely normally for three weeks after opening, then suddenly begins receiving and forwarding funds. Which stage of the fraud lifecycle does the quiet period represent, and what is its purpose?
3. Why does the lesson say onboarding detection must lean on 'who and what' is applying (e.g., device fingerprinting) rather than on behavioral transaction patterns?
4. Select ALL correct answers. Which of the following are characteristics of money-laundering activity as described in the lesson?
Select all the correct answers.
5. Select ALL correct answers. Which statements correctly describe the roles of KYC and AML in a detection pipeline?
Select all the correct answers.
When investigation confirms suspicion, the pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → reaches its regulatory endpoint: the Suspicious Activity Report.
A SAR is a confidential report filed with the financial intelligence unit (FinCEN in the US, the National Crime Agency in the UK, and equivalents elsewhere). Two rules matter:
Good SAR pipelines are built for evidence, not just detection. Every alert should carry its supporting data: the device fingerprint links, the transaction chain, the velocity spikes. Investigators need a clear narrative, and regulators may audit it later.
This is why data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → (the ability to trace every score back to its source data) is not optional. If your ML model flags an account, you must be able to reconstruct why months later.
Trace our mule account one more time, now through the full system:
1. Onboarding: device fingerprint matches four prior accounts. Score elevated but not blocked (identity docs were valid). Account approved with a monitoring flag.
2. Dormancy: quiet period. Rules see nothing. The flag persists.
3. Activation: 14 small inboundinboundA strategy that attracts prospects organically via valuable content (blog, SEO, social) rather than interrupting them.View full definition → deposits from unrelated senders trigger a network anomaly (many-to-one funding is unusual for a personal account).
4. Payout: pass-through rule fires when funds route to a crypto exchange within hours.
The combined score crosses the critical threshold. The outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.View full definition → transaction is held (not the whole account, to limit harm if wrong). An analyst reviews the assembled evidence, confirms the pattern, and a SAR is filed within the deadline. The customer is never told why.
No single signal caught this account. The layering of weak signals across the lifecycle is what worked.