A Hybrid Machine Learning Framework for Real-Time Financial Transaction Fraud Detection

Abstract

Digital Transactions have certainly made our life easier, but at the same time it makes us susceptible to many threats including misuse of UPI, fraudulent refund, phishing, account hacking, and many others. The traditional rule-based system works according to predefined rules and is unable to cope with changing fraud trends, large number of transactions, false positives, and delay in the detection process. In this paper, we present Transaction Guardian, a real-time domain independent digital fraud detection system, where rule-based fraud engines, machine learning, behavioral analysis, and real time monitoring dashboard are employed. The designed system leverages Random Forests for supervised fraud detection, Isolation Forest for unsupervised anomaly detection along with velocity and geospatial analysis for the detection of burst transactions and impossible travel. Machine Learning module is exposed as a Flask service integrated with the Node.js/Express backend, MySQL for persistent storage, and React/TypeScript frontend. Real time communication is handled using Socket.IO library. Experiments carried out using 30,000 anonymized historical transaction dataset and live transaction feed prove that the proposed solution is capable of operating in real time, has reliable performance, high fraud-detection efficiency, and lower false positives.

Introduction

The text describes Activation Guardian, a real-time hybrid fraud detection system designed to identify fraudulent financial transactions before they result in significant losses. The system addresses limitations of traditional rule-based fraud detection by combining rules, machine learning, anomaly detection, behavioral analysis, and real-time monitoring.

Key points

• The rapid growth of online banking, e-commerce, and mobile payments has increased both transaction volume and fraud risks.

• Traditional rule-based systems can detect known fraud patterns using factors such as transaction amount, location, and transaction frequency, but they may struggle with new fraud patterns and can generate excessive false-positive alerts.

• The proposed system uses a hybrid approach:

  • Rule-based detection identifies known suspicious behaviors.

  • Random Forest performs supervised fraud prediction using historical labeled transactions.

  • Isolation Forest detects previously unknown or unusual transaction patterns.

  • Velocity analysis identifies unusually frequent transactions.

  • Geospatial validation detects suspicious location changes or unrealistic travel speeds.

• These signals are combined into a risk score, which determines the appropriate response:

  • Low risk → Approval

  • Medium risk → OTP verification

  • High risk → Transaction blocking

System architecture

Activation Guardian follows a multi-tier architecture consisting of:

• React.js/TypeScript frontend for analyst monitoring and investigation.

• Node.js/Express backend for transaction processing, APIs, and system logic.

• Python/Flask machine-learning service for Random Forest and Isolation Forest predictions.

• MySQL database for transactions, audit logs, user activities, and session information.

• Socket.IO for real-time communication between the backend and frontend.

The ML service is separated from the main backend. If the ML service becomes unavailable, the backend can still process transactions using the rule-based detection system, providing fault tolerance.

Dataset and methodology

The system uses an anonymized dataset called historical_transactions_30k.csv, containing approximately 30,000 transaction records. Important features include:

• Transaction amount

• Timestamp

• Location

• Transaction frequency

• Merchant category

• Risk score

• Fraud label

Transactions are simulated continuously, with a new transaction generated approximately every 2.4 seconds. The system then processes each transaction through the rule engine and machine-learning models before calculating the final risk level.

Implementation

The frontend provides analysts with a live transaction dashboard showing transactions, risk levels, alerts, system status, and investigation controls. Backend APIs support transaction retrieval, approval/blocking actions, and system control.

The system also incorporates authentication, session management, multi-organization support, and audit logging. Every important action—such as approval, OTP verification, step-up authentication, or blocking. By incorporating behavioral, velocity, and geographic analysis, the system aims to detect both Its real-time dashboard, audit logging, secure access, and fallback rule-based mechanism make it suitable as an integrated transaction monitoring and fraud-response platform—is recorded for later investigation and accountability.

Conclusion

Transaction Guardian shows a way of detecting digital fraud in real-time that is not exclusive to particular areas of expertise thanks to the use of machine learning, behavioral analysis, rules based detection, continuous recording, and visual representation techniques that solve the problem at hand. Random Forest algorithm is responsible for the correct prediction of possible fraud cases, while Isolation Forest detects odd behavior. Velocity and geolocation insights lend support to the data provided by the transaction level model. The application runs on a client-server architecture with separated frontend, backend, database, and machine learning service, which allows for independent servicing of the components. Real-time data transfer is made possible with the help of Socket.IO and MySQL registry, improving transparency and effectiveness. The project shows the capabilities of machine learning technology in its practical use, instead of just offline examples of classification. The future improvements include use of deep learning methods, cloud solutions, balanced datasets, targeted customers, other signals such as biometrics and IP addresses, stronger encryption, and explainable AI.

References

[1] A. C. Bahnsen, D. Aouada, and B. Ottersten, “Example-Dependent Cost-Sensitive Logistic Regression for Credit Card Fraud Detection,” IEEE International Conference on Machine Learning and Applications (ICMLA), pp. 263–269, 2014. [2] R. J. Bolton and D. J. Hand, “Statistical Fraud Detection: A Review”, Statistical Science, pp. 235–255, 2002. [3] F. Carcillo, A. Dal Pozzolo, Y. Le Borgne, O. Caelen, and G. Bontempi, “Combining Unsupervised and Supervised Approaches to Detect Fraudulent Credit Card Usage,” Information Sciences, pp. 448–466. [4] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly Detection: A Survey,” ACM Computing Surveys, pp. 1–58, 2009. [5] C. Clifton, M. Kantarcioglu, J. Vaidya, X. Lin, and M. Y. Zhu,“Privacy-Preserving Data Mining,” SIGKDD Explorations, pp. 12–19, 2002. [6] A. Dal Pozzolo, G. Boracchi, O. Caelen, C. Alippi, and G. Bontempi,“Credit Card Fraud Detection: Realistic Modeling and a Novel Learning Approach,” IEEE Transactions on Neural Networks and Learning Systems, pp. 3784–3797, 2018. [7] S. Jha, M. Guillen, and J. Westland, “Using Transaction Aggregation Technique for Credit Card Fraud Detection,” Expert Systems with Applications, pp. 12650–12657, 2012. [8] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation Forest,” Proceedings of the IEEE International Conference on Data Mining (ICDM), 2008. [9] E. W. T. Ngai, Y. Hu, Y. H. Wong, Y. Chen, and. Sun, “The Application of Data Mining Techniques in Financial Fraud Detection,” Decision Support Systems, pp. 559–569, 2011. [10] A. Srivastava, A. Kundu, S. Sural, and A. Majumdar, “Credit Card Fraud Detection using Hidden Markov Model,” IEEE Transactions on Dependable and Secure Computing, pp. 37–48, 2008.

Copyright

Copyright © 2026 Dr. T. Rajesh, I. Nikshitha Raj, R. Manaswini, Puram Ananya. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.