Sardine finds fraud-detection gains by modelling the order of card purchases

The order of card purchases can reveal something that a monthly total misses. Sardine reports that adding features learned from transaction sequences helped its existing fraud model detect 24–35% more labelled fraud at the same share of payments flagged for action in offline tests.[1]

The payments-risk company trained a model to predict the next transaction from a customer’s history, then fed its representations into a conventional scoring system. The experiment applies a language-model idea—learning from sequences—to a setting where a purchase becomes more informative when placed alongside what came before it.[1]

Spending habits have a syntax

Consider two hypothetical customers, each spending the same monthly total. One buys groceries on Saturdays and pays regular subscriptions during the week. Another makes frequent small travel purchases followed by infrequent large transfers. Their aggregate totals may match, but their routines are different. The context in which a surprising transaction occurs may therefore be a stronger warning than the transaction amount alone.[1]

Sardine's system represents each payment through attributes such as merchant, category, amount, channel and time since the preceding payment. It learns relationships by predicting the next event in a sequence, without initially training on fraud labels. In that pretraining stage, ordinary legitimate behaviour supplies much of the signal. The model then produces a numerical representation of a customer's history and a measure of how unexpected a proposed transaction looks.[1]

Crucially, the researchers did not replace the bank's entire fraud decision engine with a chatbot. They added the new sequence-derived features to an existing gradient-boosted-tree model built using XGBoost and 77 engineered inputs, then retrained it. That is a more pragmatic engineering design than asking a generative model to make a raw approve-or-decline decision under strict real-time processing constraints.[1]

More fraud detected at the same flag rate

At the operating point that flagged the riskiest 1% of transactions, the enriched model detected 28% more labelled fraud. The denominator matters: this is a relative increase in detections at a matched flag rate, rather than a 28% fall in total fraud losses.[1]

The company also reports improved ranking performance. For a card issuer, the next question is how those rankings behave in live authorisations: whether the model catches fraud before money moves, avoids unnecessary declines and returns a decision within the payment’s time budget.[1]

The team also reports a gain for a card portfolio excluded from the sequence model’s pretraining. That test offers evidence that the representation learned something useful beyond the clients supplying its original training data.[1]

Why integration mattered

Sardine acknowledges that its first attempt performed worse than the original system. Adding many features created noise as well as information, and it took tuning and more decision trees to take advantage of the representations. This is an important detail: a sophisticated foundation model can make a traditional system worse if integration is careless.[1]

The evidence is first-party research. Sardine says production latency and explainability were left outside the research phase. A live evaluation would therefore have to test both whether the added context arrives quickly enough and whether the resulting decisions can be explained.[1]

The practical design is a hybrid. A sequence model supplies context that hand-built summaries can lose; the existing risk engine uses that context alongside its familiar inputs. That may be a more deployable route for foundation-model research than asking a generative system to make every payment decision directly.[1]

Report an error or suggest a correction