Online Calibration of Account-Specific Risk Sensitivity from Local Behavioural Distances in Streaming Banking Transactions

In the invisible world of digital banking, every time a card is swiped or a payment is sent, a silent calculation happens in milliseconds. This is the realm of fraud detection, where systems must decide in a heartbeat whether a transaction is a genuine purchase by a customer or a theft by a criminal. For decades, these systems have relied on a simple idea: compare the new transaction to what the customer has done before. If a person who usually buys coffee in Lagos suddenly buys a luxury watch in a different country, the system flags it. This method, known as nearest-neighbour comparison, works by measuring the distance between a new action and past actions. The bigger the difference, the higher the risk. However, a critical flaw exists in this approach: not all customers behave the same way. Some people have rigid, predictable routines, while others have chaotic, ever-changing spending habits. A single, fixed rule for measuring "difference" fails to account for this reality. A small change might be a massive red flag for a rigid spender, while a huge change might be completely normal for a chaotic one. If the system treats everyone with the same sensitivity, it will either miss fraud from the rigid spenders or falsely accuse the chaotic ones.

This is the specific problem two researchers, Musa Olowo Alabi and Morufat Damilola Gbolagade, set out to solve. They asked a fundamental question: can a banking system learn to adjust its own sensitivity for each individual account, based on that specific person's history? Instead of using a single, unchanging ruler to measure every customer, they developed a method where the ruler itself stretches or shrinks depending on the account it is measuring. Their work, tested on a large dataset of real banking transactions, demonstrates that this adjustment is not only possible but necessary. They found that the "sensitivity" of a system—the degree to which it reacts to a change in behavior—varies wildly from person to person. For some accounts, the system needs to be hyper-alert to even the smallest deviation, while for others, it must be much more relaxed to avoid raising false alarms.

To test this idea, the researchers looked at thousands of bank accounts, but they were careful to select only those with enough history to be meaningful. They focused on 608 accounts that had at least twenty transactions and a history spanning thirty days. For each of these accounts, they built a local reference pool, a collection of that specific person's past legitimate transactions. They then watched how the system reacted to new transactions by measuring four specific types of behavioral changes: how recently the person usually shops, the time of day they transact, the amount of money involved, and the structural relationships of the transaction, such as the location and the recipient.

The core of their experiment involved a continuous loop. When a new transaction arrived, the system first calculated how different it was from the person's past behavior. It then used this difference to update its understanding of that specific person's "normal." If the transaction was later confirmed to be legitimate, the system used that data point to slightly adjust its internal sensitivity setting for that account. This adjustment was done incrementally, meaning the system learned on the fly without needing to re-read the entire history of the account every time. This allowed the system to maintain a constant, up-to-date measure of how much deviation was typical for that specific user.

The results revealed a striking diversity in how different accounts should be treated. The researchers grouped the accounts into categories based on their activity levels and history length. They found that the sensitivity setting for high-activity accounts, those with many transactions, averaged at a low value of 0.7113. In contrast, the sensitivity for low-activity accounts, those with fewer transactions, averaged much higher at 1.2534. To put this in perspective, if the standard, unadjusted setting is considered a baseline of one, the system for active users was nearly thirty percent more sensitive to changes, while the system for inactive users was twenty-five percent less sensitive. This proves that a single, fixed rule cannot work for everyone; the "ruler" must be different for every person.

The study also showed exactly how this adjustment changes the final risk score. When the system used a lower sensitivity value for an active account, the same behavioral difference resulted in a higher risk score. For example, one active account with a sensitivity of 0.6819 produced a risk score of 0.7973 for a specific transaction, whereas using the standard fixed setting would have only produced a score of 0.7284. The system correctly interpreted the small change as a significant warning because it knew that this particular user rarely deviates from their routine. Conversely, for a low-activity account with a sensitivity above one, the same type of behavioral difference resulted in a lower risk score. The system understood that for this user, who has a more variable history, the change was less alarming.

Crucially, the researchers emphasized that the underlying data—the actual distance between the new transaction and the past ones—did not change. The only thing that changed was the interpretation of that distance. By calibrating the sensitivity, the system altered the continuous risk score without altering the raw behavioral evidence. This distinction is vital because it means the system is not inventing new data; it is simply reading the existing data more accurately for each individual. The study confirmed that this calibration can be maintained over time using a constant-memory process, meaning the system does not need to store vast amounts of historical data to keep learning. It can update its understanding of a user's behavior with every new, confirmed legitimate transaction, making it suitable for the fast-paced, streaming nature of modern banking.

While the study was a simulation using historical data rather than a live deployment in a bank, the findings offer a clear path forward for fraud prevention. The research suggests that the future of security lies not in building better global rules, but in creating systems that adapt their own rules to the unique rhythm of every single customer. By moving away from a one-size-fits-all approach, banks can potentially refine how they interpret behavioral deviations to better align with individual account regularity. The work demonstrates that the most effective defense against fraud is a system that understands the individual, adjusting its vigilance to match the specific regularity of the person it is protecting.