ChequeMark: An Ensemble Machine Learning Framework for After-Hours Business Deposit Fraud Detection

Ann Youduo Xu; Emily Yu; Justin Leski; William Lam

Source-linked AI summary

ChequeMark: An Ensemble Machine Learning Framework for After-Hours Business Deposit Fraud Detection

Ann Youduo Xu, Emily Yu, Justin Leski, William Lam

arXiv:2608.21629v1Aug 21, 2026cs.LG

TL;DR

After-hours cheque deposits expose banks because funds may be available before cheques clear, while prior deposit-level approaches omit client history and evolving patterns. ChequeMark combines supervised, unsupervised, and graph-based models into client-level risk scores. On stable data it matches XGBoost, while under shifted data it reports stronger performance and aims to support interpretable operational decisions.

Problem
After-hours cheque deposits create fraud exposure before clearing, while deposit-level checks omit historical client behavior and evolving patterns.
Method
ChequeMark combines XGBoost, Isolation Forest, and GraphSAGE outputs into a client-level risk score and deploys the framework as an inference microservice.
Results
Under stable distribution, the ensemble achieves performance comparable to XGBoost; under shifted distribution, it reports 83.73% F1-score and 0.69% false positive rate.
Takeaways & Limitations
The framework captures fraud evidence across multiple views and targets operationally integrated, low-latency, explainable risk assessment.
Takeaways & Limitations
Training data are synthetic, so absolute performance metrics should not be interpreted as production calibration without validation on governed real data.

Abstract

from arXiv · show

Cheque fraud is a material risk in after-hours business deposit operations because funds may be released within one business day, while cheque clearing takes several days. This timing gap creates a fraud exposure window for financial institutions. Prior mitigation relies on static, deposit-level checks and therefore miss historical client behavior and evolving patterns. To address this gap, we propose a multi-view ensemble ML framework that combines: Extreme Gradient Boosting (XGBoost) for known fraud patterns, Isolation Forest for label-free anomaly detection, and Graph Sample and Aggregate (GraphSAGE) for relational patterns associated with transaction activities. We then combine the three outputs into a single client-level risk score. Under stable conditions, performance is comparable to XGBoost; under a targeted distribution shift, our framework performs best (F1: 83.77%, FPR: 0.69%) versus XGBoost (F1: 82.77%, FPR: 0.72%). These results indicate improved robustness to distribution shift while preserving interpretability through plain-language explanations grounded in behavioural, anomaly, and relational evidence.

1 Introduction

After-hours business deposits create a cheque-fraud exposure window because funds become available before cheque validity is confirmed. The paper addresses operational and research gaps with a client-level, multi-view framework designed for contextual, explainable risk assessment.

Operational problem: Next-business-day availability precedes cheque clearing, leaving receiving banks exposed when fraudulent funds are withdrawn.Domestic cheques may take up to five business days to clear, while foreign cheques may take up to thirty days.
Operational problem: Fraud teams lack individual cheque details, manually review alert images, and must compile client history from disparate systems.Manual review can consume up to twenty minutes per alert.
Motivation: Rules-based assessment cannot integrate the full behavioral and transaction context needed to detect complex, non-linear fraud patterns quickly.The paper motivates ML as a way to combine client history, deposit behaviors, and cheque details for rapid assessment.
Research gap: Prior operational fraud studies often use deposit-level classification or single models, while underaddressing client behavior, relational signals, workflow constraints, and explainability.The paper identifies four limitations affecting operational deployment and auditability.
Contributions: The proposed framework ensembles supervised, unsupervised, and graph-based models using aggregated client profiles and transaction histories.Its contributions include client-level scoring, ChequeMark microservice deployment, and plain-language explanations grounded in model attributions.

2 Related Work

Related work spans supervised, unsupervised, graph-based, and ensemble fraud-detection methods. The paper motivates combining these modalities because their strengths and weaknesses differ under evolving and relational fraud patterns.

Single-learners: Single-modality fraud detectors include supervised learning, unsupervised learning, and graph-based representation learning.The paper calls these approaches single-learners to distinguish them from ensembles.
Supervised learning: Supervised methods can struggle with pattern drift and complex fraud scenarios such as fraud-ring networks or laundering behaviors.Simpler probabilistic methods offer rapid inference and interpretable coefficients but may be too limited for effective fraud detection.
Unsupervised learning: Unsupervised methods adapt to evolving fraud tactics by identifying statistical deviations without requiring labeled retraining data.Prior work reports anomaly detection capturing contextual irregularities missed by supervised methods.
Graph representation learning: Graph representation learning models relationships among entities to capture network information that tabular transaction features may miss.Graph methods construct fraud graphs involving receivers and senders, although the cited discussion highlights limitations of transductive approaches.
Ensemble learning: Ensemble frameworks combine complementary algorithmic perspectives to add robustness, reduce variance, and bridge individual-model performance gaps.Examples include hard voting, soft voting, weighted averaging, and learned combinations of base-model outputs.

3 Problem Formulation

The paper formulates fraud detection as estimating client fraud probability from tabular features and relational graphs despite incomplete labels, evolving tactics, dependence, and rare behaviors. It decomposes evidence into predictive, anomaly, and relational components and combines them through an interpretable weighted estimator.

Problem formulation: The target is conditional fraud probability P(Y = 1|X, G), where X contains client features and G encodes entity relationships.The classifier maps a feature instance and graph to a probability score between 0 and 1.
Problem formulation: Estimating fraud risk from labeled tabular data alone is difficult because labels are incomplete, tactics evolve, graph dependence violates independence, and novel fraud may resemble rare legitimate behavior.The decision rule applies a hard threshold τ to the estimated probability.
Multi-view decomposition: The framework decomposes fraud evidence into predictive scores from labeled covariates, anomaly scores from distributional deviation, and relational scores from graph neighborhoods.These components target direct client-risk associations, atypical observations, and dependence patterns such as connectivity and flow concentration.
Aggregation: The final estimator combines the three component outputs through a weighted linear combination to preserve interpretability.The aggregation is written as F(fpred, fanom, frel) = w1 · fpred + w2 · fanom + w3 · frel.
Learning objective: The learning objective minimizes a classification loss while approximating the difficult-to-estimate fraud function with three estimators.The cited formulation gives cross-entropy as an example classification loss.
Explainability objective: Explainability is framed as identifying salient tabular features and influential graph neighbors contributing to each prediction.The objective seeks quantifiable feature contributions and neighbor influences in the graph component.

4 Proposed Framework

The proposed framework combines supervised tabular learning, unsupervised anomaly detection, and graph representation learning, then aggregates their outputs into a client-level risk score. Its design addresses complementary weaknesses of single learners while supporting stratified evaluation and explainability for operational fraud detection.

Constituent algorithms: XGBoost estimates fraud probability from client features using sequential decision trees, regularization, and class weighting for imbalance.The model captures complex non-linear feature interactions and uses binary cross-entropy loss.
Constituent algorithms: Isolation Forest detects anomalies without labels by recursively partitioning feature space with an ensemble of random isolation trees.Scores closer to 1 indicate anomalies, whereas scores near 0 indicate normal instances.
Constituent algorithms: GraphSAGE learns relational representations by aggregating neighborhood features and classifies learned node embeddings for fraud probability.Hybrid max, mean, and sum pooling captures individual high-risk neighbors and collective neighborhood characteristics.
Multi-view ensemble: The framework combines modalities because supervised, unsupervised, and graph models respectively address known patterns, evolving tactics, and network structures.The authors position this combination as improving robustness against concept drift while maintaining high precision and recall.
Multi-view ensemble: The ensemble independently processes tabular, anomaly, and graph inputs, normalizes outputs, and combines them using PR-AUC-proportional weights.Clients are flagged when the resulting risk score meets the operational threshold τop.
Training and explainability: Training uses independent constituent-model development on a deterministic client-level stratified split, while explanations combine feature attribution, graph influence, and plain-language mechanisms.SHAP values explain tabular predictions, gradient-based analysis identifies influential transaction partners, and LLMs translate attributions into business-focused narratives.

5 Experimentation Results

The experiments evaluate the multi-view ensemble on stable and shifted client-level test distributions. Results confirm comparable stable performance and improved robustness under distribution shift through complementary supervised, anomaly, and relational signals.

Experimental Setup: 13,675 clients train the models and 3,418 held-out clients evaluate them, with client-level stratification preserving 2.57% fraud prevalence.The synthetic dataset contains after-hours deposit, cheque, client-profile, and account-history sources.
Experimental Setup: The evaluation compares stable-distribution performance with robustness on a shifted test subset representing emerging fraud scenarios.The shifted subset increases clients with account_age_months < 18 from 5.6% to 20.7% while maintaining 2.57% fraud prevalence.
Stable Distribution: 0.8586 F1 is achieved by the full ensemble on the stable test distribution at a 3% operational flagging threshold.The ensemble also records Precision 0.8058, Recall 0.9432, and a 0.63% false positive rate, capturing 83 of 88 fraud cases.
Stable Distribution: The ensemble closely tracks XGBoost under stable conditions, where well-represented fraud patterns allow the supervised component to dominate.The ensemble combines the three model outputs using PR-AUC proportional weighting.
Distribution Shift: Under distribution shift, the ensemble achieves graceful degradation by combining supervised, unsupervised, and graph-based models.When the supervised model fails to generalize to novel patterns, anomaly and relational components detect outliers and network anomalies without labeled historical precedent.

6 Deployment and Operations

ChequeMark deploys the ensemble through an inference microservice designed for time-constrained deposit processing. Its operations include asynchronous explanations, validated latency, fault recovery, scalability provisions, and proposed—but not yet deployed—retraining and monitoring pipelines.

Deployment Architecture: The ML inference microservice integrates the proposed ensemble into ChequeMark’s after-hours business deposit workflow.The deployment is implemented as a REST API within the fraud detection system.
Deployment Architecture: Synchronous risk scoring is separated from asynchronous explainability, so computationally expensive explanations do not delay hold decisions.The explanation worker generates SHAP values, graph influence scores, and plain-language rationales while polling the database every 10 seconds.
Operational Performance: 2–3 seconds per batch is the documented end-to-end latency for typical workloads of 100–500 clients per request.Performance is validated through QAT, UAT, CI/CD-integrated testing suites, and local load testing.
Scalability: Horizontal scaling is proposed through multiple FastAPI pods behind a load balancer, with database optimizations providing additional capacity.The current synthetic-data pipeline is in-memory and Pandas-based, while the stated scalability enhancements are not currently implemented.
Reliability: Fault handling supports graceful degradation, retries, and checkpoint-based recovery, while unrecoverable scoring errors return HTTP 500 and trigger alerts after three attempts.Processing resumes from saved chunks, and explanation failures are retried up to three times.
Retraining and Monitoring: Model retraining and versioning pipelines are not deployed yet, and frequent retraining may degrade performance under accumulated concept shift.Monitoring-triggered retraining, approval workflows, and centralized model-version registries are proposed enhancements.

7 Conclusion

The framework combines three complementary fraud-detection views and performs comparably to XGBoost under stable conditions while showing stronger robustness under targeted distribution shift. Its operational value is paired with explainability, but production use requires validation beyond the synthetic and non-temporal evaluation setting.

Conclusion: 83.73% F1-score and 0.69% false positive rate were achieved under shifted-distribution testing, exceeding each constituent model.Under stable distribution, performance was comparable to XGBoost alone.
Conclusion: Client-level scoring uses full behavioral history rather than isolated deposit-level rules, supporting more context-aware decisions and fewer avoidable false positives.The inference microservice targets low latency and integration with existing deposit workflows.
Conclusion: Plain-language explanations combine SHAP attributions, graph influence analysis, and LLM-generated rationales for transparent decision-making and traceable case review.The explainability layer is designed to support auditability and human-in-the-loop decisions.
Limitations and Future Work: Production calibration remains uncertain because the training data are synthetic and may contain learnable generation rules absent from governed real-world data.Retrospective validation on confirmed outcomes is proposed for threshold tuning and policy calibration.
Limitations and Future Work: The evaluation split prevents client overlap but does not preserve temporal ordering, allowing training cases to occur chronologically after test cases.This differs from realistic deployment scenarios.
Limitations and Future Work: The stress test covers only account-age shift, whereas real fraud landscapes may involve interacting multidimensional drifts.Future evaluation should test shifts such as industry-sector fraud bursts and other combined changes.

A.1 XGBoost Hyperparameters

The appendix reports the optimized XGBoost hyperparameter configuration used for the fraud detection model.

A.1 XGBoost Hyperparameters: Table 4 presents the optimal hyperparameters for the XGBoost fraud detection model.The configuration was obtained from 50 Optuna trials with MedianPruner.

A.2 Isolation Forest Hyperparameters

The appendix reports optimized configurations for Isolation Forest and GraphSAGE, including preprocessing and graph feature dimensions.

A.2 Isolation Forest Hyperparameters: Table 5 presents the optimal hyperparameters for the Isolation Forest anomaly detection model.The model used 50 Optuna trials with MedianPruner.
A.2 Isolation Forest Hyperparameters: Features were standardized, median-imputed, and filtered for correlations above |r| > 0.8.These preprocessing steps were applied to the Isolation Forest features.
A.2 Isolation Forest Hyperparameters: GraphSAGE used 89-dimensional node features and 10-dimensional edge features.The node features aggregate ten transaction features plus an external indicator.

B.1 Data Preparation.

The study uses a fully synthetic dataset designed to reproduce after-hours business deposit data while preserving structural, behavioral, and domain properties.

B.1 Data Preparation: The dataset was generated through a rule-based probabilistic simulation pipeline modeled on after-hours business deposit service data.Deposit and cheque schemas, data types, and relational constraints were validated against typical production systems.
B.1 Data Preparation: Fraud injection preserves overlap between fraudulent and legitimate behavior rather than making fraud perfectly separable.This is intended to simulate real-world detection challenges.
B.1 Data Preparation: The process preserves schema shapes, key joins, domain mechanics, and macro-level class balance while regenerating identifiers and sensitive content.Preserved examples include deposit, client, and account relationships and cheque-routing structure.
B.1 Data Preparation: Validation checks structural integrity, behavioral constraints, and stress scenarios including anomaly-fraud overlap and high-velocity bursts.The checks also cover seasonal spikes, dormant-then-burst behavior, and edge cases.

B.2 Data scope

The study uses a synthetic, relational dataset representing after-hours business deposit operations across clients, accounts, deposits, cheques, and transaction histories. It engineers multi-view features spanning business profiles, deposit behavior, cheque history, and account health to capture complementary fraud signals.

Data scope: 17,093 client profiles, 480,000 deposit slips, 2,000,000 cheques, and 1,500,000 transaction-history entries span 12 months.The linked datasets are designed to reflect operational realities within a unified relational data model.
Data scope: The relational data model organizes linked entities hierarchically across client, business-account, and deposit levels.Clients are associated with beneficial owners and deposit activity, while accounts contain currency and transaction-history attributes.
Data scope: The synthetic population emphasizes domestic-currency accounts while including a smaller foreign-currency subset and varied business sectors identified by SIC codes.Sampled sectors include restaurants, caterers, hotels, business services, auto dealers, software vendors, retail, and financial services.
Feature representation: The framework engineers multi-view features to capture complementary fraud signals across tabular and graph modalities.Feature groups cover business profile, deposit behavior, cheque history, and account health.