Visual Analytics for Fraud Detection

Automatic fraud detection and prevention are challenging problems that have attracted the attention of many researchers in academia and industry. Over the last few years, many improvements have been achieved, especially in predictive models based on Machine Learning. However, in many cases, these models only provide a prediction score and a short explanation which may not be enough to make an informed decision. This work presents a visualisation tool that, through the use of different graphical techniques, aims at assisting the fraud analyst to make informative decisions. The three-visualisation tool was developed to support the analysis of fraudulent transactions. With this visualisation tool, we intend to improve the daily work of the analysts by increasing their effectiveness in the detection of fraud.

The Tool

The visualisation tool is comprised of three views, each one representing different time scales and levels of detail: (i) a calendar view, where it is given an overview of the data; (ii) a monthly view, where the transactions of a specific month are visualised in more detail; (iii) and a detail view, where an attribute-wise analysis is provided for a set of transactions. The data used in each visualisation results from previously performed queries. By navigating throughout the views, from the Calendar View to the Detail View, the data is refined and a new sub-set of data visualised. Each view enriches the analysis by providing additional details about the data.

The calendar view is based on a heat map technique and resembles a typical calendar as shown in Figure 1. The visualisation is composed by twelve rectangular spaces, each one representing one month. Each day of the month is represented by a vertical bar, positioned from left to right in each rectangular space. The bars are further divided vertically into three parts, each one corresponding to a 8 hours interval. These three rectangles are coloured with a blue tone that varies depending on the number of transactions made in each period of time. The higher the number of transactions for a given day and hour, the darker its blue tone. The aggregated values are globally normalised to enable the comparison of blue tones over the different months. This view enables the analysis of daily, monthly, and annual patterns. It was developed to give an initial overview of the data-set, enabling the analysis at a higher level.

**Figure 1**
Calendar view making use of a heatmap approach.

For the second view we defined two layout approaches, radial and polar. Additionally, for each one of these layouts, we defined two types of arrangements to visualise: (i) the distribution of transactions over time; and (ii) the similarity between transactions. In the radial layout, and to visualise the transactions over time, each concentric circle represents an hour and the equally spaced lines arranged radially, represent each day of the month (Figure 2, top-left). For the second arrangement, to represent the transactions’ similarity to a given transaction of choice, 10 concentric circles are drawn to represent the similarity value, the more similar the transactions are, the closer to the centre they will be placed (Figure 2, top-right image). In the polar layout, to represent the transactions over time, each concentric circle represents one day and the hours are mapped in a clockwise direction along the equally spaced lines (Figure 2, bottom-left image).
To represent the similarity between transactions, the similarity values are distributed also along the equally spaced lines in a clockwise direction (Figure 2, bottom-right image). For both layout approaches, when in the similarity arrangement, the transaction with which the remaining ones are compared is placed at the centre of the chart.

**Figure 2**
Monthly view. One month displayed with radial layout approach with temporal arrangement (top-left), and with similarity arrangement of the transactions (top-right). Polar layout approach for the same data with temporal arrangement (bottom-left) , and with similarity arrangement of the transactions (bottom-right).

In the Detail view it is possible to analyse and compare the transactions attribute-wise (Figure 3). In this view, the transactions are displayed in a grid. Each transaction is represented in a column, and each row represents an attribute. The attribute associated to each row is indicated in the list on the left of the grid. Transactions are temporally ordered from left to right. The visual elements encode the comparison between the values of the different attributes. If the attributes are equal, a black filled rectangle is used. If they are different, a filled rectangle with double the size is used to emphasise such cases. Finally in the case of missing values, no visual mark is attributed. For the representation of the attributes: score, fraud, amount handled, and device type, we used other representations to emphasise their values and enable a faster interpretation of a given transaction.

**Figure 3**
Detail view depicting the transactions of an entire month.

Publications

P. Silva, C. Maçãs, E. Polisciuc, and P. Machado, “Visualisation Tool to Support Fraud Detection,” in Proceedings of the 25th International Conference Information Visualisation (IV), 2021.
- Bibtex
- |
- Link
- |
- PDF

Author