FraudFrog

Tinder for fraud ops — swipe right to approve, swipe left to block, swipe up for AI triage. Clear 1,000 logs in minutes.

Overview

FraudFrog combines a Python fraud-scoring engine with a modern reviewer UI built for speed. Upload a transactions CSV, let the engine score every row, then work through flagged cases using a full review queue or the Tinder-inspired quick-swipe mode. Every decision is logged with its score, severity, and the exact signals that triggered the flag.

The goal is not to block every suspicious transaction automatically. The goal is to rank likely fraud, explain each flag in plain language, and help a human reviewer make fast, confident decisions.

Screenshots

Features

🃏 Quick Review — Swipe to Decide

Tinder-inspired swipe cards let you move through obvious cases at high speed without losing context:

• Swipe right → Approve as legitimate
• Swipe left → Escalate as fraud
• Swipe down → Dismiss the flag
• Swipe up → Pull up AI summary
• Keyboard shortcuts mirror every gesture for power users

🔍 Review Queue — Full Detail

For uncertain cases that need a closer look:

• Baseline comparison — card's normal spend, countries, devices, and IPs vs. this transaction
• Related activity — other recent transactions on the same card
• Timeline — sequence of events leading up to the flag
• AI Summary — plain-English explanation of why the case is suspicious
• Three-action verdict bar: Approve Legitimate, Dismiss Flag, Escalate Fraud
• Full keyboard shortcut bar (A / D / E / U / N / P)

📊 Dashboard & Analytics

• Metric cards: total transactions, cases needing review, high-priority cases, review progress
• Transaction category donut chart and flagged vs. unflagged ratio
• Priority mix breakdown (Critical / High / Medium / Low)
• Review Cost Tuning: switch between Conservative, Balanced, and Aggressive sensitivity live

🗂 All Cases Table

• Score distribution histogram (green → amber → red heat ramp)
• Top merchants by flag count, top fraud signals, and channel breakdown
• Sortable, filterable, searchable table with severity badges and status tracking

🤖 Fraud Engine

Python scoring engine (fraud_detector.py) runs at analysis time via the Next.js API route:

• Per-card behavioral baselines — median spend, 95th-percentile threshold, known countries, devices, and IPs
• Amount anomaly — flags transactions significantly above the card's normal range
• Card-testing detection — symmetric ±1 h burst counter catches every probe in a testing burst, not just the trailing ones a backward-only window misses
• Cross-card shared device/IP signals — detects coordinated fraud rings using the same infrastructure across multiple cards
• Merchant and category burst detection — catches cross-card merchant ring patterns
• Velocity windows — short-window transaction frequency per card
• Rare category, country, and channel signals — contextual rather than blindly additive

📋 Audit Log

Full decision history: timestamp, transaction ID, action, previous status, fraud score, severity, and the signals visible at decision time. Exportable as CSV.

↩️ Undo & Session Persistence

• Undo the last decision at any time
• Full session persists across page reloads via localStorage
• Confirmation dialog prevents accidental data loss when a review is in progress

Getting Started

1. Set up the Python scoring engine

python3 -m venv .venv
.venv/bin/pip install -r requirements.txt

2. Start the reviewer app

cd fraudfrog
npm install
npm run dev

Open http://localhost:3000, upload a transactions CSV (or click Try with sample data), and click Analyse Transactions. The app calls fraud_detector.py automatically — no manual scoring step needed.

Detection Signals

Signal	Description
amount_anomaly	Transaction amount exceeds card's historical baseline
card_testing	Burst of small transactions in a tight time window (symmetric ±1 h)
shared_device	Device used across multiple different cards
shared_ip	IP address used across multiple different cards
rare_country	Cardholder or merchant country not seen on this card before
rare_channel	Transaction channel (online/in-person/ATM) unusual for this card
rare_category	Merchant category not in the card's typical spend profile
velocity_burst	High transaction frequency in a short window
merchant_burst	Same merchant flagged across many different cards simultaneously

Sensitivity	Score threshold	Optimised for
Conservative	≥ 70	Highest precision
Balanced	≥ 60	Best F1
Aggressive	≥ 50	Highest recall

Repository Layout

FraudFrog/
├── fraud_detector.py       # Python scoring engine
├── transactions.csv        # Sample dataset (1,000 transactions)
├── requirements.txt        # pandas, numpy
├── tests/                  # Unit + regression tests
├── docs/                   # Hypothesis log, design notes
├── images/                 # Screenshots
└── fraudfrog/              # Next.js reviewer app
    ├── app/
    │   ├── fraudfrog-app.tsx      # Main application
    │   ├── csv-analysis.ts        # CSV parsing + fraud case building
    │   └── api/score/             # API route → calls fraud_detector.py
    ├── components/ui/
    │   └── fraud-swipe-stack.tsx  # Quick Review swipe cards
    └── public/
        └── sample-transactions.csv

Running Tests

.venv/bin/python -m unittest discover -s tests -v

Why Not Pure ML?

The dataset has no ground-truth labels, so a supervised model would either train on guesses or overfit to assumptions. FraudFrog uses explainable rules and behavioral features as the source of truth — every flag has a concrete, reviewer-facing reason. Unsupervised anomaly detection could be layered in as a supporting signal later, but explainability stays non-negotiable.

What's Next

• Supervised model once confirmed reviewer labels accumulate from audit log exports
• Graph-based entity detection across cards, IPs, devices, and merchants
• Strictly backward-looking features with persisted historical baselines for production use
• Drift monitoring and automatic threshold recalibration
• Role-based access and exportable reviewer notes