💻 computer science

PayGuard AI: An Explainable Hybrid Framework for Corporate Payment-Anomaly Detection and Working-Capital Decision Support

This paper introduces PayGuard AI, an explainable hybrid framework that integrates business rules, machine learning, and statistical simulations to detect payment anomalies and support working-capital decisions, demonstrating high precision and interpretability on synthetic transaction data while acknowledging the need for real-world validation.

Original authors: Tanisi Das

Published 2026-10-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Tanisi Das

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Every day, corporations move vast sums of money to pay for goods and services, a process known as accounts payable. This workflow involves checking invoices, matching them to purchase orders, and sending payments to suppliers. While this system keeps businesses running, it is also a prime target for fraud. Bad actors can slip in duplicate invoices, impersonate legitimate suppliers, or alter bank account details to steal funds. Traditionally, companies have relied on rigid, rule-based systems to catch these errors. These systems act like a checklist: if an invoice amount exceeds a purchase order by a certain percentage, or if a payment is made on a weekend, the system flags it for human review. However, these rules are limited; they can only catch the specific mistakes they were programmed to find, leaving them blind to new, clever tricks that fraudsters invent.

To overcome these limitations, researchers have turned to machine learning, where computers learn to spot unusual patterns by studying thousands of past transactions. Yet, these advanced systems often operate as "black boxes," offering a warning without explaining why they are worried. In high-stakes financial environments, knowing why a payment is suspicious is just as important as knowing that it is suspicious. Furthermore, when a payment is flagged, finance teams face a difficult dilemma: delay the payment to investigate and risk damaging a relationship with a supplier, or pay it and risk losing money. The challenge is to build a system that not only detects anomalies but also explains its reasoning, quantifies how sure it is, and helps leaders understand the financial impact of their decisions.

In a recent study, independent researcher Tanisi Das introduced a new framework called PayGuard AI, designed to bridge the gap between automated detection and human decision-making. Rather than relying on a single method, this system combines the transparency of traditional business rules with the adaptability of machine learning. The researchers tested this framework using a carefully constructed set of 5,600 simulated supplier payments. Within this synthetic dataset, they deliberately planted 280 specific types of anomalies, such as exact duplicate invoices, payments made to the wrong bank account, or invoices that were significantly higher than the original order. Because the researchers knew exactly which transactions were "fake," they could rigorously test how well the system identified them.

The PayGuard AI framework operates in layers. First, it applies a set of clear, understandable business rules to scan for known red flags, such as a payment being made on a Saturday or an invoice amount exceeding the purchase order. Simultaneously, a machine learning model called an Isolation Forest analyzes the data to find transactions that look statistically strange compared to normal behavior, even if they don't break a specific rule. The system then merges these two sources of evidence into a single risk score. If a transaction triggers a rule and also looks statistically unusual, it receives a higher score and is prioritized for human review. Crucially, the system does not just output a number; it provides a plain-language explanation of which rules were broken and how unusual the transaction appears, allowing a human investigator to quickly understand the context.

When tested on the unseen portion of the simulated data, the hybrid system performed with high accuracy. It correctly identified about two-thirds of the planted anomalies while maintaining a very low rate of false alarms, flagging only about 4 out of every 100 legitimate transactions. The system was particularly effective at catching specific types of fraud, such as payments made to recently changed bank accounts or invoices with mismatched currencies, where it achieved a perfect detection rate. However, the study also revealed that the system struggled to catch certain subtle patterns, such as exact duplicate invoices or payments made unusually quickly, suggesting that no single system is perfect and that human oversight remains essential.

Beyond simply flagging suspicious transactions, the framework adds a layer of statistical reasoning to help humans trust the results. It uses a method called Bayesian inference to estimate how confident the model is in its predictions. Instead of giving a single, fixed answer, it provides a range of possibilities, helping finance teams distinguish between a high-risk alert that is very certain and one that is more ambiguous. The researchers also demonstrated how this data could be used for broader financial planning. By running thousands of simulations, they showed how delaying payments to investigate fraud might affect a company's cash flow, weighing the potential savings from holding onto money against the risk of losing early-payment discounts or upsetting suppliers.

The study concludes that while this hybrid approach offers a powerful proof-of-concept for modernizing fraud detection, it is not yet ready for real-world deployment without further testing. The results were generated using synthetic data, which, while realistic, cannot fully capture the complex, evolving nature of actual corporate fraud. The researchers emphasize that the specific numbers and thresholds used in the experiment were designed for testing and would need to be carefully calibrated by individual organizations based on their own risk tolerance and financial goals. Nevertheless, PayGuard AI demonstrates a promising path forward: a system that does not just find errors, but explains them, quantifies the uncertainty, and helps businesses make smarter, more informed decisions about their money.

Technical Summary: PayGuard AI: An Explainable Hybrid Framework for Corporate Payment-Anomaly Detection and Working-Capital Decision Support

Problem Statement
Corporate Accounts Payable (AP) processes face significant challenges in detecting payment fraud and processing errors due to high transaction volumes, diverse suppliers, and complex payment conditions. Traditional rule-based detection systems offer high interpretability but lack adaptability to emerging fraud patterns and often generate false positives. Conversely, machine learning (ML) models, particularly unsupervised anomaly detectors, can identify novel patterns but often function as "black boxes," lacking the interpretability, uncertainty quantification, and financial decision context required by finance professionals. Furthermore, existing detection systems typically stop at classification, failing to quantify the monetary exposure of flagged transactions or model the working-capital implications of payment delays. This study addresses the need for a unified framework that combines effective anomaly detection with explainability, uncertainty estimation, and actionable financial decision support.

Methodology
The study introduces PayGuard AI, a multi-stage hybrid framework evaluated on a synthetic dataset of 5,600 supplier-payment transactions (5% controlled anomaly rate). The methodology integrates four distinct layers:

Hybrid Detection Layer:
- Rule-Based Screening: A deterministic engine flags transactions violating predefined business rules (e.g., duplicate invoices, payment > invoice, recent bank changes). Rules are weighted by severity (0–80 points).
- Unsupervised Anomaly Detection: An Isolation Forest model (200 estimators, 5% contamination) is trained on engineered features (e.g., paid-to-invoice ratio, payment-term deviation) to assign a statistical anomaly percentile.
- Hybrid Scoring: A weighted score ( $H_i = 0.72 R_i + 0.28 A_i$ ) combines the rule-based score ( $R_i$ ) and the Isolation Forest percentile ( $A_i$ ). Alerts are triggered if $H_i \geq 45$ . The framework prioritizes rule-based evidence but uses statistical unusualness to refine ranking.
Interpretable Statistical Modelling:
- Logistic Regression: An L2-penalized logistic regression model is fitted to the synthetic ground-truth labels to estimate odds ratios for feature associations, providing interpretable coefficients.
- Bayesian Logistic Regression: A Bayesian variant using Automatic Differentiation Variational Inference (ADVI) estimates posterior distributions for model parameters. This layer quantifies predictive uncertainty, generating credible intervals for feature associations and transaction-level anomaly probabilities.
Financial Risk Analysis:
- Review Exposure Estimation: For flagged transactions, a monetary "review exposure" is calculated. If a direct discrepancy exists (e.g., overpayment), the exposure is the difference; otherwise, an illustrative scenario exposure is derived using the hybrid score and a prototype loss factor.
- Bootstrap Resampling: 20,000 resamples of the flagged transactions are used to generate a distribution of aggregate review exposure, quantifying uncertainty in total potential loss.
- Monte Carlo Simulation: A simulation evaluates the net financial benefit of extending Days Payable Outstanding (DPO) by 10, 20, and 30 days. It models uncertainty in cost of capital, early-payment discount erosion, and supplier-friction costs to produce a distribution of net financial outcomes.

Key Results

Detection Performance: On held-out test data, the hybrid framework achieved a ROC-AUC of 0.982 and an Average Precision of 0.770. While the rule-only system achieved a slightly higher ROC-AUC (0.989), the hybrid approach yielded superior average precision (0.770 versus 0.680 for rules alone).
Operational Metrics: At the selected threshold, the system achieved a precision of 0.848, recall of 0.667, and specificity of 0.994, flagging approximately 3.93% of transactions.
Anomaly Sensitivity: Detection varied significantly by anomaly type. The framework achieved 100% detection for bank changes, currency mismatches, and overpayments. However, sensitivity was lower for rapid payments (30.8%) and near duplicates (15.4%), with zero detection for exact duplicates at the chosen threshold.
Statistical Interpretability: Logistic regression identified currency mismatches and recent bank changes as having the strongest associations with anomalies (odds ratios >300, driven by synthetic construction). Bayesian analysis provided 95% credible intervals, confirming positive associations for paid-to-invoice ratios and negative associations for payment-term deviations.
Financial Analysis:
- Exposure: Bootstrap analysis of 66 flagged transactions estimated a mean aggregate review exposure of ~302,564 Synthetic Monetary Units (SMU), with a 95th percentile of ~514,441 SMU.
- Working Capital: Monte Carlo simulations indicated that a 30-day DPO extension had a 97.8% probability of yielding a positive net financial benefit under the simulated assumptions, whereas a 10-day extension had only a 37.2% probability.

Significance and Claims
The paper positions PayGuard AI as a proof-of-concept demonstrating the feasibility of integrating transaction screening, interpretability, uncertainty representation, and financial decision support into a single workflow. The author claims that the framework:

Bridges the Gap: Successfully combines the transparency of rule-based systems with the adaptability of data-driven anomaly detection.
Enhances Transparency: Moves beyond binary classification by providing interpretable feature associations (via logistic regression) and explicit uncertainty estimates (via Bayesian inference) to aid human-in-the-loop decision-making.
Extends to Financial Context: Demonstrates how fraud detection outputs can be translated into monetary exposure estimates and working-capital scenarios, addressing the gap between fraud classification and treasury decision-making.

Limitations and Modesty
The author explicitly states that the results are derived from a synthetic dataset and do not represent expected performance in real-world corporate environments. Key limitations include:

Synthetic Nature: The 5% anomaly rate and specific anomaly categories were controlled experimental choices, not reflective of real fraud frequencies.
Calibration: The rule weights, hybrid weighting (0.72/0.28), and alert threshold (45) are prototype design choices, not empirically optimized parameters.
Deterministic Links: Certain indicators (bank changes, currency mismatches) were deterministically linked to anomalies in the synthetic data, inflating their statistical significance.
Operational Readiness: The framework requires real-world validation, organizational calibration, and integration with existing governance protocols before operational deployment. The author emphasizes that the financial simulations are illustrative and not calibrated forecasts for specific organizations.

In conclusion, PayGuard AI offers a methodological foundation for a human-centred, financially informed decision-support system, but its practical efficacy remains to be validated against real operational data.

More like this