Telco Payment Fraud Detection Platform
Enterprise-grade real-time payment fraud detection system designed for Telco/MSP environments. Built to handle high-throughput transactions with sub-10ms decision latency.
The Challenge
Payment fraud in the telecommunications industry costs operators billions annually. Traditional batch-processing approaches fail because:
- Too slow: Fraudsters complete SIM activations, device purchases, and service upgrades before detection
- Too rigid: Static rules can't adapt to evolving attack patterns like SIM farms and device resale fraud
- Poor UX: Blocking legitimate subscribers hurts revenue more than the fraud itself
The Solution
A real-time decisioning engine that:
| Capability | Achievement |
|---|---|
| Decision Latency | Sub-10ms P99 |
| Detection Coverage | 5 fraud signal types |
| Policy Updates | Hot-reload without restart |
| Evidence Trail | Complete audit for disputes |
Key Features
Real-Time Decisioning
Every transaction receives an instant decision:
ALLOW → Proceed normally
FRICTION → Request additional verification (3DS, OTP)
REVIEW → Queue for manual review
BLOCK → Decline transaction
Multi-Signal Detection
The platform analyzes five distinct payment fraud patterns targeting Telco/MSP:
- Card Testing - Rapid small topups probing stolen card validity
- SIM Farm / Velocity Attacks - Multiple SIM activations from same card (fraud ring indicator)
- Device Resale Fraud - Subsidized device upgrades with intent to resell
- Bot/Automation - Emulators, datacenter IPs, Tor exit nodes (automated fraud)
- Friendly Fraud - Historical dispute patterns and subscriber behavioral signals
Configurable Policy Engine
Business rules are defined in YAML and can be updated without deployment:
thresholds:
block_score: 85
review_score: 60
friction_score: 35
rules:
- name: device_upgrade_new_subscriber
condition: event_subtype = device_upgrade AND subscriber_age_days < 30
action: REVIEW
- name: high_risk_sim_swap
condition: event_subtype = sim_swap
action: REVIEW
Architecture at a Glance
┌─────────────────────────────────────────────────────────────┐
│ Payment Gateway │
└─────────────────────────────┬───────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Fraud Detection API │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Feature │ │Detection │ │ Risk │ │ Policy │ │
│ │ Engine │ │ Engine │ │ Scoring │ │ Engine │ │
│ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ │
└───────┼─────────────┼─────────────┼─────────────┼──────────┘
│ │ │ │
┌────▼────┐ ┌────▼────┐ ┌────▼────┐ ┌────▼────┐
│ Redis │ │ Detect │ │ Score │ │ YAML │
│Counters │ │ Signals │ │ Combine │ │ Config │
└─────────┘ └─────────┘ └─────────┘ └─────────┘
│
▼
┌─────────────────┐
│ PostgreSQL │
│ Evidence Vault │
└─────────────────┘
Technical Stack
| Component | Technology | Purpose |
|---|---|---|
| API | FastAPI | High-performance async endpoints |
| Feature Store | Redis | Sub-ms velocity counter lookups |
| Evidence Store | PostgreSQL | Immutable audit trail |
| Monitoring | Prometheus + Grafana | Real-time metrics and alerting |
| Dashboard | Streamlit | Demo and testing interface |
| Infrastructure | Docker Compose | Local development environment |
Results
The Sprint-1 MVP delivers:
- 5 detection signals covering major fraud patterns
- Sub-10ms latency for decision responses
- Hot-reload policy updates without restarts
- Complete evidence capture for dispute resolution
- 45+ unit tests with comprehensive coverage
- Load tested to 1000+ requests/second
Documentation
| Section | Description |
|---|---|
| Getting Started | Quick setup and first API call |
| Architecture | System design and component details |
| API Reference | Endpoint specifications |
| Demo Dashboard | Interactive testing interface |
Author: Uday Tamma