Financial Data Science & Enterprise Fraud Analytics

Probability Distributions

Bernoulli, Binomial, Poisson, Uniform, Exponential, Normal, Log-Normal, and Pareto distributions — the mathematical models behind financial data shapes.

The Normal Distribution

PDF, CDF, the 68-95-99.7 rule, standardisation, normality testing with Shapiro-Wilk and Jarque-Bera, and the limits of normality in finance.

Non-Normal Distributions in Finance

Log-normal from multiplicative processes, Pareto heavy tails, exponential inter-arrival times — the distributions that actually describe financial data.

The Central Limit Theorem

Sampling distributions, standard error σ/√n, convergence rates for skewed financial data, and how the CLT justifies every entity-level z-test.

Z-Scores and Percentile Ranks

Standard z-score, modified z-score using MAD, masking effects, percentile ranks, and composite multi-signal scoring for vendor anomaly detection.

Benford's Law Introduction

The logarithmic leading-digit law, chi-squared goodness-of-fit (df=8), MAD effect size, applicability conditions, and forensic evidence use in fraud trials.

Classical and Frequentist Probability

Sample spaces, events, axioms, probability rules, counting principles, and frequentist interpretation applied to financial event modelling.

Conditional Probability

P(A|B), the multiplication rule, independence, and how conditioning on approval context changes the fraud probability of any transaction.

Bayes' Theorem

Prior, likelihood, posterior — the full Bayesian framework for fraud risk assessment and how new evidence updates vendor risk scores.

Joint and Marginal Distributions

Joint PMFs and PDFs, marginal distributions, covariance, correlation, and how financial variables co-move in fraudulent vs. legitimate transactions.

Combinatorics and Coincidence Detection

Permutations, combinations, the Birthday Problem, and collision probability — quantifying whether financial 'coincidences' are statistically plausible.

Bayesian Fraud Risk Models

Constructing informative priors from historical fraud rates, updating with transaction evidence, and building a Bayesian vendor fraud risk score.

Hypothesis Testing Framework

Null and alternative hypotheses, test statistics, p-values, critical regions, and the formal logic of making statistically defensible fraud claims.

T-Tests for Financial Comparisons

One-sample, two-sample, and paired t-tests applied to vendor invoice amounts, employee expense claims, and account transaction means.

Chi-Squared and F-Tests

Chi-squared goodness-of-fit and independence tests, the F-test for variance equality, applied to digit distributions and category-level fraud detection.

Type I & II Errors in Fraud Detection

False positives (wasted investigations), false negatives (missed fraud), the precision-recall trade-off, and designing alert thresholds with cost functions.

Multiple Testing Corrections

Bonferroni correction, Benjamini-Hochberg FDR control, and why running hundreds of fraud rules simultaneously inflates Type I error without correction.

A/B Testing for Fraud Model Evaluation

Designing controlled experiments to compare fraud detection models, computing required sample sizes, and interpreting lift, precision, and recall changes.

Chart of Accounts and the General Ledger

Account structure, journal entries, debits and credits, the trial balance, and where in the ledger financial fraud leaves its footprints.

The Purchase-to-Pay Cycle

Requisition → PO → receipt → invoice → payment: the P2P workflow, its internal controls, and the fraud risks at every stage.

The Order-to-Cash Cycle

Quote → order → fulfilment → invoice → collection: the O2C workflow, revenue recognition risks, and fraudulent returns and refund schemes.

ERP Data Structures: SAP and Oracle

Table schemas, key fields, transaction codes, and the data landscape of SAP FI/MM and Oracle EBS — where to look and what to look for.

Master Data and Fraud Risk

Vendor master, employee master, customer master — how fraudsters manipulate master data to create ghost vendors, duplicate employees, and fictitious customers.

SQL for Financial Data Analysis

CTEs, window functions, aggregation, joins, and CASE logic applied to general ledger, AP, AR, and payroll queries for fraud detection.

Customs, Tax, and Insurance Data

The structure of customs declarations, VAT/GST filings, insurance claim forms, and the high-risk fields and patterns specific to each domain.

Three-Way Matching Control

PO, goods receipt, and invoice matching — the canonical AP control, its two-way and four-way variants, and how it is bypassed in practice.

Duplicate Invoice Detection

Exact duplicates, near-duplicates, split invoices, and the SQL and string-matching logic to catch each variant at scale.

Split Invoices and Threshold Avoidance

Detecting invoice splitting to stay below approval thresholds — Benford, digit analysis, and velocity methods applied to structuring detection.

Phantom Vendors and Ghost Employees

Master data fraud: fictitious vendor creation, ghost payroll entries, and the data patterns that distinguish fraudulent from legitimate entities.

String Similarity and Vendor Collusion

Edit distance, phonetic matching, and TF-IDF for detecting vendor name variants, address collisions, and employee-vendor collusion in master data.

SQL-Based Matching Pipelines

Building production-grade three-way matching, duplicate detection, and cross-entity linkage pipelines in SQL with performance optimisation.

Benford's Law Deep Dive

Second-digit and first-two-digit Benford analysis, multi-population testing, MAD thresholds, and enterprise-scale Benford audit pipelines.

Round-Number and Digit-Ending Analysis

Detecting psychological rounding, 9-ending prices, and threshold-clustering using digit frequency histograms and chi-squared tests.

Z-Score Outlier Detection

Univariate outlier detection using standard and modified z-scores, entity-level scoring, and building alert rules with controlled false-positive rates.

Mahalanobis Distance

Multivariate outlier detection accounting for feature correlations — detecting transactions that are anomalous across multiple dimensions simultaneously.

Control Charts for Financial Monitoring

Shewhart X̄ charts, CUSUM, EWMA — statistical process control applied to transaction volume, spend rate, and approval patterns.

KS Test and Distribution Shift Detection

Kolmogorov-Smirnov test, Anderson-Darling, and population stability index — detecting when a transaction population has changed due to fraud or regime shift.

Alert Threshold Design

ROC curve analysis, cost-function-based threshold selection, alert volume budgeting, and false-positive rate management in production fraud systems.

Time-Series Decomposition

Trend, seasonality, and residual decomposition of financial time series — separating expected from anomalous transaction patterns.

Velocity and Frequency Anomalies

Transactions-per-hour, daily spend spikes, and frequency bursts — Poisson-based velocity testing for real-time fraud monitoring.

ARIMA for Transaction Monitoring

ARIMA and exponential smoothing for forecasting expected transaction behaviour — flagging residuals that exceed statistical confidence bands.

Temporal Fraud Patterns

Weekend/holiday transactions, after-hours approvals, last-minute payment timing, and the clock-pattern signatures of internal fraud.

Window Dressing and Period-End Fraud

Channel stuffing, revenue pull-forward, and balance sheet manipulation at period end — detecting temporal clustering at month/quarter/year boundaries.

Change-Point Detection

PELT, binary segmentation, and BOCPD for detecting structural breaks in financial time series — identifying when a vendor or account behaviour regime changed.

Behavioral Baseline Construction

Building stable statistical baselines for vendors, employees, and accounts — defining normal before anomaly detection can begin.

Peer Group Analysis

Identifying cohort membership and comparing entity behaviour to statistical peer groups — detecting anomalies that are invisible against population benchmarks.

Behavioral Drift Detection

Gradual change detection in entity transaction patterns — distinguishing legitimate business evolution from slow-burn fraud accumulation.

Clustering for Peer Group Discovery

K-Means, DBSCAN, and GMM clustering for unsupervised peer group formation — grouping entities by transaction behaviour without predefined categories.

Feature Engineering for Behavioral Fingerprinting

Constructing behavioural features: recency, frequency, monetary, timing, approval patterns, and category mix for entity risk profiling.

Account Takeover and Identity Fraud

Detecting behavioural signatures of account takeover, synthetic identity fraud, and credential sharing in financial systems.

Behavioral Risk Scoring

Aggregating behavioural deviation metrics into an entity risk score — weighted combination, score stability, and score-to-alert translation.

SoD Principles and Internal Controls

Authorisation, custody, recording, and reconciliation — the four pillars of SoD and why combining any two in one role creates fraud opportunity.

Role Conflict Matrix

Defining toxic combinations in SAP and Oracle roles, building a conflict matrix, and scoring role assignments for SoD violation risk.

ERP Access Log Analysis

Parsing SAP SM20 and Oracle audit trails — detecting privilege use, sensitive transaction execution, and access patterns outside normal working hours.

Dormant Accounts and Shared Credentials

Detecting reactivated dormant accounts, shared login patterns, and credential hand-off — the access control signatures of internal collusion.

Graph-Based Collusion Detection

Modelling role overlap as a bipartite graph — detecting indirect collusion where no single user has both roles but two colluding users together do.

SoD Risk Scoring Framework

Quantifying SoD violation severity, compensating controls, and building an enterprise SoD risk score aligned to SOX, GDPR, and PCI-DSS.

Financial Networks and Graph Theory

Modelling transactions, entities, and accounts as directed weighted graphs — the foundational representation for all network fraud detection.

Centrality Measures

Degree, betweenness, closeness, PageRank, and eigenvector centrality — identifying structurally important nodes in financial transaction networks.

Community Detection Algorithms

Louvain, Girvan-Newman, and label propagation — finding fraud rings, collusion clusters, and money laundering communities in transaction graphs.

Shell Companies and Round-Trip Transactions

Detecting shell company networks, circular payment flows, and layering patterns using cycle detection and ownership graph analysis.

Link Analysis and Shared Attributes

Connecting entities through shared phone numbers, addresses, bank accounts, and IP addresses — building the entity resolution graph for fraud investigation.

Money Laundering Typologies

Placement, layering, and integration — the three-stage laundering model and the graph signatures of smurfing, trade-based laundering, and real estate schemes.

Graph Databases and Cypher

Neo4j data model, Cypher query language, pattern matching, and practical fraud investigation queries on financial transaction graphs.

Temporal Graph Analysis

Time-stamped edges, network evolution, burst detection, and identifying when fraud rings form, activate, and dissolve in temporal transaction networks.

Text Preprocessing for Financial Documents

Tokenisation, normalisation, stemming, lemmatisation, and stop-word handling — preparing invoice descriptions, expense narratives, and contract text for analysis.

TF-IDF and Cosine Similarity

Term frequency-inverse document frequency, cosine distance, and the duplicate invoice description detection pipeline — catching copy-paste fraud at scale.

Named Entity Recognition for Finance

Extracting vendor names, amounts, dates, bank details, and invoice numbers from unstructured financial documents using spaCy and fine-tuned NER models.

Expense Narrative Classification

Classifying expense claim descriptions by category, detecting misclassification, personal-expense fraud, and fabricated justifications using text classifiers.

Contract and Document Similarity

Detecting copied or minimally altered contracts, bid rigging through near-identical proposals, and document recycling using MinHash and LSH.

Sentiment Analysis and Tone Detection

Analysing earnings call transcripts, audit communications, and board minutes for sentiment anomalies, hedging language, and stress indicators preceding restatements.

Transformers and FinBERT

BERT architecture, FinBERT fine-tuning for financial text, zero-shot and few-shot classification, and detecting fabricated invoice narratives with language models.

Class Imbalance in Fraud Detection

Fraud base rates of 0.01%–2%, the failure of accuracy as a metric, SMOTE, ADASYN, cost-sensitive learning, and threshold optimisation for imbalanced data.

Logistic Regression for Fraud

Log-odds, sigmoid function, feature interpretation, regularisation, and building an interpretable baseline fraud classifier for regulatory compliance.

Decision Trees and Random Forests

Information gain, Gini impurity, tree ensembles, feature importance, and applying Random Forest to financial fraud classification with full interpretability.

Gradient Boosting: XGBoost and LightGBM

Gradient boosting mechanics, XGBoost and LightGBM for fraud classification, hyperparameter tuning, and handling missing ERP data gracefully.

Unsupervised Anomaly Detection

Isolation Forest, One-Class SVM, Local Outlier Factor, and Autoencoder-based anomaly detection — finding fraud without labelled training data.

Neural Networks and Autoencoders

Feedforward networks for fraud classification, autoencoder reconstruction error as an anomaly score, and VAE for generating synthetic fraud examples.

Model Evaluation with Fraud Metrics

ROC-AUC, PR-AUC, F1, precision@k, lift charts, and the dollar-value cost matrix — evaluating fraud models on the metrics that matter operationally.

Explainability: SHAP and LIME

SHAP values for global and local feature attribution, LIME for individual prediction explanation, and meeting SR 11-7 and GDPR Article 22 explainability requirements.

Model Drift and Champion-Challenger

Detecting model performance decay, population stability index, champion-challenger deployment, and designing a continuous model monitoring pipeline.

Risk Scoring Ontology

Designing the taxonomy of signals, sub-scores, and composite scores — the information architecture of an enterprise fraud risk scoring system.

Weighted Scoring Frameworks

Linear weighted scoring, logistic combination, and ensemble aggregation — merging statistical, behavioural, graph, NLP, and ML signals into one score.

Score Normalisation and Calibration

Min-max normalisation, z-score standardisation, isotonic regression calibration, and monotone score transformations for interpretable risk scores.

Rules-to-Score Translation

Translating rule-firing events into score increments — mapping deterministic rule results to probabilistic risk contributions in a unified scoring layer.

Alert Threshold Design and Triage

ROC-based threshold selection, alert volume budgeting, tiered triage queues, investigator capacity modelling, and alert fatigue measurement.

Feedback Loops and Score Recalibration

Closing the loop: confirmed fraud labels → feature updates → model retraining → score recalibration — designing a self-improving fraud detection system.

Fraud Platform Architecture

End-to-end architecture of an enterprise fraud detection platform: ingestion, feature store, detection engine, scoring layer, alert manager, and case management.

Real-Time vs. Batch Detection

Streaming detection with Kafka and Flink vs. batch detection on data warehouses — trade-offs in latency, coverage, cost, and detection power.

Data Pipeline Design

Ingestion → normalisation → feature engineering → detection → scoring → alerting — designing resilient, auditable, low-latency fraud data pipelines.

Enterprise Integration Patterns

Connecting to SAP, Oracle EBS, SWIFT, core banking, customs systems, and insurance platforms — ERP connectors, APIs, and CDC patterns for fraud data ingestion.

Case Management and Investigation Workflow

Alert → triage → investigation → resolution → reporting: designing the investigator workflow and case management system for a fraud operations team.

Regulatory Reporting

SAR, STR, CTR, and MIS reporting — the regulatory obligations of a financial institution and how the fraud platform generates compliant reports automatically.

Model Lifecycle and Governance

Training → validation → deployment → monitoring → retirement: the model lifecycle, SR 11-7 model risk management, and GDPR/PCI-DSS compliance in fraud ML.

Capstone: Project Sentinel — Specification

Full specification for Project Sentinel: a 500,000-row synthetic multi-domain dataset with 12 seeded fraud typologies across AP, payroll, insurance, and customs.

Milestone 1: Data Profiling and EDA

Complete statistical profiling of the Sentinel dataset — descriptive statistics, distribution fitting, missing-data analysis, and anomaly surface mapping.

Milestone 2: Statistical Detection Layer

Benford's Law audit, z-score and modified z-score rules, round-number analysis, and a documented statistical detection rule engine with precision/recall report.

Milestone 3: Temporal and Behavioral Analytics

Time-series decomposition, velocity anomaly detection, behavioral baselines, peer group analysis, and entity-level behavioral risk scores for all entities.

Milestone 4: Graph and NLP Analysis

Transaction network construction, centrality and community detection, entity resolution, NLP on invoice descriptions — graph and text fraud signal extraction.

Milestone 5: Machine Learning Models

Supervised fraud classifier (XGBoost + SHAP), unsupervised anomaly detector (Isolation Forest + Autoencoder), and a fully evaluated model comparison report.

Milestone 6: Composite Fraud Risk Scoring

Integrating all detection signals into a unified composite risk score — normalisation, calibration, threshold selection, alert queue, and triage framework.

Milestone 7: Architecture and Regulatory Reporting

Enterprise architecture design document, SAR/STR regulatory report generation, model governance documentation, and the full fraud detection platform blueprint.

Final Presentation: Project Sentinel

The capstone final deliverable: a structured presentation of the complete fraud detection platform, findings, model performance, and business recommendations.