UPI Transaction Fraud Detection System
Real-time fraud detection pipeline for UPI payment flows, processing 50K+ transactions per minute at sub-100ms decision latency using a tiered rule-based and ML classifier architecture.
Detected 94% of fraudulent transactions with a false positive rate of 0.3%, down from 2.1%. System processes 50K+ transactions per minute at p99 latency of 82ms.
False positives on legitimate transactions were a bigger product problem than fraud itself.
In UPI payment flows, a blocked legitimate transaction causes immediate, visible harm. Fraud is often discovered later and sometimes refunded. The original single-threshold ML model caught fraud effectively but blocked 2.1% of legitimate transactions. At 50K TPS, that is over 1,000 good transactions blocked per minute. User complaints spiked every time the fraud catch rate improved — the wrong optimisation target entirely.
A tiered architecture: fast rule engine for clear cases, ML model only for ambiguous ones.
Separated the decision pipeline into two tiers. The rule engine handles velocity checks, known fraud patterns, and device fingerprint blacklists — processing 70% of transactions in under 5ms. The ML model only runs on transactions that pass the rule engine but still trigger heuristic flags, reducing its throughput requirement by 70%. Each tier has an independently tuned threshold optimised for its own precision-recall target.
The rule engine filters easy cases, leaving the ML model with a biased training distribution.
Because the rule engine filters obvious fraud before the ML model sees any data, the model trains only on ambiguous transactions — structurally different from the full distribution. Standalone model metrics did not reflect combined system performance. We built a historical simulation harness to evaluate the full pipeline retrospectively. The operational complexity was worth it: false positives dropped from 2.1% to 0.3%.
- Incoming UPI transaction event (Kafka)
- Rule engine — velocity / device / blacklist checks (< 5ms)
- Fast-path decision — approve or block for clear cases
- Feature extractor — 47 derived features for ambiguous cases
- ML classifier — gradient boosting, risk score 0-1
- Threshold decision — approve / flag / block
- Event log — PostgreSQL (full audit trail)
- Feedback loop — confirmed fraud labels for model retraining