Red flag at midnight, how Zainab’s screen became the front line of AI fraud defence

By Muhammad Essa

The fluorescent glow of the bank’s monitoring wall flickered as Zainab, a mid level analyst in Karachi, stared at a scarlet alert that popped up just as she was about to log off. The message read “Potential fraud, 3-digit mismatch, high value, overseas IP”. She could hear the distant hum of the air-conditioner, the clatter of a colleague’s keyboard, and the soft thud of the coffee mug she’d set down minutes earlier. Instead of the usual “good night”, her fingers hovered over the mouse, the weight of a single decision pressing against the quiet of the empty office.

Why this matters now

Every day Pakistani banks move billions of rupees through digital channels. A single undetected breach can erode trust, push customers back to cash, and invite regulatory penalties. The State Bank of Pakistan’s 2023 guidelines on electronic payments demand banks to detect and act on suspicious activity within minutes, not hours. For a country where mobile wallets now outnumber ATMs, that speed is not a luxury, it is a necessity. Zainab’s alert is a micro-cosm of a system that protects the savings of millions, fuels confidence in online banking, and creates a new class of data scientists, engineers and risk officers for the local fintech ecosystem.

Here's how it works:

VisualInteractive

Data pipeline and feature work

The first layer of defence begins with data ingestion. Transaction streams from the bank’s core, card network and mobile app are fed into a Spark Structured Streaming job running on a private cloud. Each event is captured in near real time, enriched with customer profile fields, age, average spend, typical merchant categories, and with contextual signals such as device fingerprint and geolocation.

A practical step for any fintech team: set up a Kafka topic for raw transactions, then attach a Spark job that writes the enriched records to a Delta Lake table. This gives you a single source of truth that can be queried by downstream models without latency.

Feature engineering happens on the fly. Simple rules like “transaction amount exceeds three times the monthly average” are calculated alongside more subtle patterns such as velocity of purchases across different merchants within a ten minute window. Zainab’s team uses Python libraries, Pandas for batch calculations, but for streaming they rely on PySpark’s map functions to keep the pipeline lightweight.

The output is a feature vector for each transaction, ready for the model to score.

Model scoring and human verification

Two classifiers sit behind the alert screen. The first is a gradient boosted tree model trained on historic fraud cases, tuned to flag high risk scores above 0.85. The second is an unsupervised anomaly detector that watches for deviations from a customer’s usual behavior profile. Both models are served via a REST endpoint hosted on a cloud AI service that scales automatically during peak hours.

When a transaction triggers a combined risk score above the bank’s threshold, the system writes a record to a “fraud queue”. Zainab receives it in the monitoring UI, where she can see the raw features, the model’s confidence, and a SHAP explanation that highlights the top three contributors, for example, “IP address in a high risk country” and “amount 4× usual spend”.

A concrete idea for practitioners: integrate SHAP visualisations into your analyst dashboard. It turns a black-box score into a narrative that the human reviewer can trust, reducing false positives.

Zainab reviews the case, cross-checks the merchant’s KYC status, and decides whether to freeze the transaction. If she confirms fraud, an automated workflow kicks in: the transaction is reversed, the card is temporarily blocked, and a templated SMS is sent to the customer with a link to verify the activity. The bank’s compliance engine logs the incident, satisfying SBP reporting requirements within the mandated 24-hour window.

The human in the loop is not a bottleneck; it is a safety net that catches the rare edge cases where the model’s confidence is high but the context is ambiguous, for instance, a legitimate overseas purchase that matches a customer’s travel itinerary but violates a static rule.

Concrete outcome

Last quarter, the same bank reported a 30 percent drop in successful fraud attempts after deploying the AI driven workflow. That reduction translates to roughly 1.2 billion rupees saved, enough to fund a small community school in a rural district. For Zainab, the job has shifted from manually scanning spreadsheets to interpreting model outputs, a change that demands both statistical literacy and domain intuition. The bank, meanwhile, can market “instant fraud protection” as a differentiator, attracting new digital-first customers and reinforcing the SBP’s vision of a secure payments ecosystem.

The future is already arriving. As more Pakistani startups feed anonymised transaction data into shared model hubs, the collective intelligence of the sector will sharpen, and analysts like Zainab will become the custodians of that intelligence.

About the author

Editor, FintechBulletins. Muhammad Essa is a FinTech writer and editor at FintechBulletins, covering digital payments, banking policy and startups across Pakistan. Follow on LinkedIn.