Detecting organized eCommerce fraud using scalable categorical clustering

TL;DR

This paper presents a scalable clustering-based method to detect organized eCommerce fraud by grouping related fraudulent orders, significantly improving detection rates while maintaining low false positives.

Contribution

It introduces a novel bulk order clustering approach using agglomerative clustering and sampling, effectively identifying organized fraud groups in large-scale eCommerce data.

Findings

Clusters 35-45% of fraudulent orders

Detects 26.2% of fraud with 0.1% false positives

Processes hundreds of thousands of orders in hours

Abstract

Online retail, eCommerce, frequently falls victim to fraud conducted by malicious customers (fraudsters) who obtain goods or services through deception. Fraud coordinated by groups of professional fraudsters that place several fraudulent orders to maximize their gain is referred to as organized fraud. Existing approaches to fraud detection typically analyze orders in isolation and they are not effective at identifying groups of fraudulent orders linked to organized fraud. These also wrongly identify many legitimate orders as fraud, which hinders their usage for automated fraud cancellation. We introduce a novel solution to detect organized fraud by analyzing orders in bulk. Our approach is based on clustering and aims to group together fraudulent orders placed by the same group of fraudsters. It selectively uses two existing techniques, agglomerative clustering and sampling to recursively group orders into small clusters in a reasonable amount of time. We assess our clustering technique on real-world orders placed on the Zalando website, the largest online apparel retailer in Europe1. Our clustering processes 100,000s of orders in a few hours and groups 35-45% of fraudulent orders together. We propose a simple technique built on top of our clustering that detects 26.2% of fraud while raising false alarms for only 0.1% of legitimate orders.