PaperlayerView exact revision on arXiv

Source-linked AI summary

PixSim: a calibrated open-source simulator of instant-payment fraud, recovery and interdiction under analyst capacity constraints

Bashir Zeimarani, Alireza Khatib, Somayeh Mousavinasr, Carlos Maurício Serodio Figueiredo

arXiv:2609.30684v1cs.LGcs.CEq-fin.RM

TL;DR

Pix fraud control must act before final settlement, while recovery depends on whether funds remain traceable. PixSim models that setting and benchmarks payer-side policies under analyst-capacity constraints; within its simulated mule model, dispersal and staffing affect recovery and policy performance.

  • Problem

    Pix’s final settlement and limited MED recovery leave a need to study pre-settlement interdiction, but no public testbed jointly models irreversible settlement, regulated recovery, fund dispersal, and capacity-constrained review.

    Source: §1 · pp. 1–2

  • Method

    PixSim is an open-source Pix simulator with irreversible settlement, MED recovery regimes, mule rings, and a finite analyst queue, using sourced, calibrated, or registered-assumption parameters.

    Source: §1 · p. 2, §4.2 · p. 6, §5 · p. 8

  • Results

    Within the simulated mule model, recovery is constrained by dispersal speed and policy performance depends on capacity; staffing by arrivals cuts fixed-rule alert expiry from 52% to 2%.

    Source: §10 · p. 21

  • Takeaways & Limitations

    The benchmark treats fraud review as a capacity-dependent control problem with irreversible actions, a decision deadline, and a random recovery clock.

    Source: §10 · p. 21

    The calibrated values are one fitted configuration, structural calibration error on policy comparisons is unbounded, and February–April 2026 is not reproduced.

    Source: §9 · p. 20

Abstract

from arXiv · show

Brazil's Pix settles about 5.9 billion instant, irreversible transfers a month. A fraudulent transfer can be recovered only while the funds remain in a traceable account, and in 2025 the Central Bank's recovery mechanism (MED) returned 9% of accepted contested value. Interdiction therefore has to happen before settlement, by routing each transaction to pass, human review or block, under a finite analyst team and a regulatory hold window. To our knowledge no public simulator jointly models irreversible settlement, a regulated recovery mechanism, downstream fund dispersal and capacity-constrained review. We present PixSim, an open-source simulator of the Pix rail with these elements, calibrated to Banco Central do Brasil open data, with every parameter sourced, calibrated to one published observable, or registered as an assumption. With the model frozen, full-scale runs reproduce the 2025 recovery rate within 0.006 and its decomposition within 0.02; the February-April 2026 window is reported as a misfit and the May 2026 tracing regime as a projection. On a benchmark with a payer-side scorer, four reference policies and ten scenarios, within the simulated mule model: recovery after settlement is constrained by dispersal speed; staffing by the arrival profile cuts a fixed rule's alert expiry from 52% to 2% at constant hours; halving the team removes a fixed threshold-and-block rule's advantage over a queue-aware rule, on loss and on loss plus false-block harm (+0.106 of victim value, positive on all twenty paired seeds), while a reversal at two thirds of the team was not confirmed on independent seeds; and a synthetic scorer of held-out AUC 0.82 cuts lost value by about a quarter. Code and data: https://doi.org/10.5281/zenodo.22948895

1 Introduction

Pix’s final settlement and low recovery of contested value make pre-settlement fraud control important, but existing work and public data leave no testbed for this setting. PixSim provides a calibrated simulator and benchmark for payer-side interdiction under analyst-capacity constraints.

Motivation

  • The 2025 MED returned 8.96% of accepted contested value, while rapid mule forwarding can move funds beyond the reach of a first-account block.The cited case describes funds moving through four hops in under five hours, with first-layer mules forwarding within minutes.Source: §1 · pp. 1–2

Research gap

  • The literature lacks a public testbed combining irreversible settlement, regulated recovery, downstream fund dispersal, and capacity-constrained review.Existing simulators omit these mechanisms, while the BCB publishes aggregate MED statistics but no transaction-level data.Source: §1 · p. 2

Contributions

  • PixSim models irreversible settlement, the MED recovery clock, reconstructed mule rings, time-varying analyst staffing, and the regulatory hold window.The simulator is open source.Source: §1 · p. 2
  • PixSim’s calibrated parameters are sourced, fitted to one published observable, or registered as assumptions, and frozen runs reproduce 2025 recovery statistics within stated deviations.The February–April 2026 window is reported as a misfit.Source: §1 · p. 2

Benchmark findings

  • Within the calibrated model, recovery is strongly constrained by dispersal speed, while the relative performance of tested rules depends on analyst capacity; fixed rules fail through score saturation below held-out AUC about 0.9.Source: §1 · p. 2

Scope

  • PixSim covers payer-side interdiction under universal rail-wide policy adoption; it excludes receiving-side mule detection because simulated receiver accounts are unusually separable.No public figure anchors how much value real payer-side scoring prevents, so absolute losses at the reference scorer are optimistic.Source: §1 · p. 2

2 Background: Pix, DICT and the MED

Pix transfers settle in seconds, and MED provides recourse for contested fraud while the funds remain available. PixSim represents distinct MED regimes and uses published aggregate data, but some operational configurations and statistics remain unavailable or mixed.

Pix and MED

  • Pix settles transfers in seconds and finally; the MED blocks available contested funds for analysis and return under regulated deadlines.The receiving PSP may also apply a cautelary block for up to 72 hours, with later credits retained toward the requested value.Source: §2 · p. 3

DICT

  • The DICT supplies payer institutions with receiver-account fields including age, settlement history, fraud markers, and open reports, but PixSim does not model newer marking rules.The passage describes later regulations changing marking, rejection, contest, and duration rules.Source: §2 · p. 3

MED regimes

  • The MED regimes differ in complaint and block procedures, and the tracing regime has no published statistic anchoring its production graph depth.February–April 2026 mixes old and new flows in unknown proportions; Table 1 summarizes the three regimes distinguished by PixSim.Source: §2 · pp. 3–4, Table 1 · p. 4

Hold window and data

  • The payer may hold a suspicious transfer for up to 30 minutes by day and 60 minutes at night, after which an unresolved alert settles by default.The BCB’s open-data series include monthly Pix and MED counts and values, including return decompositions.Source: §2 · p. 3

3 Related work

Prior work addresses human deferral, admission control, risk control, and transaction simulation, but not their joint application to irreversible Pix fraud review. PixSim compares implemented mechanisms with these neighboring approaches.

Learning to defer under capacity

  • Existing learning-to-defer frameworks model capacity, but use discrete-time or round-based binary decisions without irreversible harmful actions, deadlines, or behavior-dependent recovery windows.PixSim makes those three features the object of study.Source: §3 · p. 4

Stochastic control

  • Admission control with deadlines and restless-bandit methods offer relevant control tools, but neither has been applied to fraud review on a payment rail.The benchmark tests policies derived from these tools; their derivation is left to a companion paper.Source: §3 · p. 4

Risk control under drift

  • Risk-control methods address exchangeability and drift, while PixSim records ground truth even for blocked transactions to test guarantees under policy-induced censoring.A blocked transaction is never observed as fraud or not in ordinary operation.Source: §3 · p. 4

Simulators and Pix

  • The compared transaction simulators and review frameworks lack PixSim’s joint mechanisms for settlement finality, regulated recovery, review queues, and flow-level policy decisions.Table 2 compares implemented mechanisms across PixSim and the closest alternatives.Source: §3 · p. 5, Table 2 · p. 5

4 The simulator

PixSim generates legitimate and fraudulent Pix traffic, routes each transaction through a policy and queue, and models settlement and recovery under MED rules. Its modular implementation recomputes published BCB quantities from simulated transaction logs.

4 The simulator

  • Each PixSim run generates traffic, applies a policy, settles or refuses transactions, and runs the selected MED regime on settled fraud.The discrete-event simulator has a module for each stage, and published BCB quantities are recomputed using BCB definitions.Source: §4 · p. 5

4.1 Population and legitimate traffic

  • Legitimate traffic follows BCB hourly and weekday profiles, with lognormal amounts fitted to published means and medians; the checkpoint matched several aggregate series closely but had an excess of small transactions.At the 50-thousand-account checkpoint, monthly count and value were within 1% of BCB series, while 36% of simulated transactions were under R$ 20 versus 26% in the cited BCB distribution.Source: §4.1 · p. 5

4.2 Fraud scenarios and mule networks

  • Fraud scenarios use assumed scenario shares and layered mule rings, with accepted-MED incidence, forwarding delays, reporting delays, and chain depth represented in the model.Fraud never reported or never reaching MED is not represented; the scenario mix and chain depth are registered assumptions.Source: §4.2 · pp. 5–6

4.3 Rail, hold window and MED clock

  • Policies choose pass, alert, or block using transaction and context; alerts settle by default after the hold window, while settled fraud enters a regime-specific recovery clock.The recovery accounting distinguishes interdiction, hop-held value, cautelary returns, MED recovery, and losses.Source: §4.3 · pp. 6–7, Figure 1 · p. 6

4.4 Analyst queue

  • Analyst review uses assumed service times and fraud-type accuracy, while capacity is scaled against the threshold policy’s alert stream and results remain conditional on those assumptions.The baseline team of six reviews that stream at 80% utilization; half capacity is three analysts.Source: §4.4 · pp. 7–8

4.5 Engineering and reproducibility

  • Full-scale evaluation uses chunked 30-day segments verified against the single-pass rail, a 365-day burn-in, pinned software, and a released test suite.The package reports 78 tests and records configurations, seeds, and part counts behind tables.Source: §4.5 · p. 8

5 Calibration protocol

PixSim’s calibration protocol ties each parameter to one source, one observable measured under matching rules, or a registered assumption. It fits selected parameters at development scale, verifies them on held-out seeds at full scale, and records limitations where the model or its anchors do not support stronger claims.

Calibration protocol

  • Each parameter is sourced, calibrated to exactly one observable under the modeled rules, or registered as an assumption; misfits are checked for missing behaviors before adding parameters.Three behaviors were added this way: the burn rule, notification latency, and legitimate payments to new keys; parameters sharing a denominator are fitted jointly.Source: §5 · p. 8
  • Three MED-denominator parameters are fitted by alternating bisections in two passes, while burn probability is fitted to mule reuse and dormant mule activity is fixed at zero.Development-scale calibration uses six-seed means; verification uses six seeds not used in bisections.Source: §5 · p. 8
  • The full-year reuse anchor is retained despite a 3.32 versus 3.19 discrepancy, about four verification standard errors; it would fail the stated criterion on January–September alone.The full-year calibration window is retained because the 2025 window’s last quarter mixes configurations and the BCB records rising contestations and falling acceptance from October.Source: §5 · pp. 8–9
  • Chain depth is assumed at 2.0 because no published statistic anchors it for the tracing regime; that regime is therefore a projection, not a calibrated result.The verification criterion tests agreement within the chosen model at the tested seed counts, not parameter confidence; several parameter combinations could produce the same aggregates, and local sensitivity is deferred.Source: §5 · p. 9
  • The simulator compares its single “nothing to block” outcome with 0.613 total BCB non-returns, not the 0.523 no-balance category alone.The model does not represent account closure or other non-return reasons separately; the development-scale check is 2.3 standard errors high, while full scale is within 0.02.Source: §5 · p. 9

6 Validation

Full-scale validation tests traffic fidelity and recovery across modeled MED regimes without refitting parameters. The 2025 recovery result is within the stated tolerance, whereas February–April 2026 remains a reported misfit and the tracing regime is a projection.

6.1 Traffic fidelity

  • 23 of 26 in-sample traffic targets fall within 10% of published values; three older amount-band comparisons fall outside, while 2026 monthly count and value fall short by 11.7% and 15.8%.The 2026 mean ticket and individual-payer share are within 10%; the accepted contested ticket is 12.6% below the BCB value, with scenario amounts assumed.Source: §6.1 · pp. 9–10

6.2 The regime test

  • 0.096 simulated recovery versus the BCB’s 0.090 is a +0.006 deviation, within the 0.02 check tolerance, with full and partial returns and cautelary returns within seed noise.The 0.595 simulated non-return value is within 0.02 of the 0.613 sum of BCB non-return categories; development and full scale agree on every recovery component within 0.03.Source: §6.2 · p. 10, Table 4 · p. 10
  • 0.114 recovery under February–April 2026 rules reaches only about a third of the observed 0.142, and the unchanged model is reported as a misfit.The window mixes MED 1.0 and 2.0 flows during an enforcement waiver; tested rule changes do not reproduce the observations, and changed case composition is a plausible but unidentified explanation.Source: §6.2 · pp. 10–11
  • 0.237 recovery is a tracing-regime projection at assumed depth 2.0 and MaxHops 2, with layer blocks contributing 0.095 and 0.76 accounts notified per case.The tracing regime has no published target yet; the paper sweeps both assumptions separately.Source: Table 4 · p. 10, §6.2 · p. 11

6.3 Leakage and structure

  • The scorer uses payer-visible features and DICT fields with 12-hour staleness; oversampling preserves ring structure within 5% but inflates DICT fraud-marker prevalence 50–135 times.About 40% of victim transfers at full scale, or 57% under drift, reach a key already carrying a fraud marker; no public figure anchors that share.Source: §6.3 · p. 11

7 Benchmark

The benchmark trains a payer-side scorer, freezes reference policies before testing scenarios, and evaluates victim-transfer outcomes with paired comparisons. The supplied benchmark passages describe the scorer and evaluation design but do not report the overall policy comparison.

7.1 Scorer

  • Held-out victim transfers score at AUC 0.954 ± 0.019 across twenty baseline seeds, after training at AUC 0.990 ± 0.005.The scorer is trained on payer-side features and DICT fields with 12-hour staleness; automatic early stopping failed at the rare positive rate, so the run uses 200 iterations.Source: §7.1 · pp. 11–12

7.2 Reference policies

  • The reference policies range from pass-all to budgeted alerts, threshold-plus-block, and a queue-aware alert cutoff; cutoffs and queue-response settings are frozen before scenarios run.The rank-space variant alerts a shrinking share of each hour’s scores, has no cap, and is more robust to saturated scores but worse on average in other scenarios.Source: §7.2 · p. 12

7.3 Scenarios

  • The scenario suite varies environment, analyst capacity, scorer quality, tracing assumptions, and fraud rate; all scenarios run at full scale with a 30-day part after a 365-day feature-history burn-in.For drift, parts are 90 days with a 20-day warm-up and 70-day evaluation window; S7’s scorer-noise sweep spans held-out AUC 0.93 to 0.70.Source: Table 5 · p. 12, §7.3 · p. 12

7.4 Metrics and the value waterfall

  • Headline metrics cover victim transfers only, and paired policy comparisons use the same world per seed with bootstrap intervals and a shared-seed difference-in-differences for capacity.The value waterfall assigns each unit of victim value to one of five states, while the MED rate uses contested value net of cautelary returns and is not the same as the waterfall’s MED share.Source: §7.4 · p. 13

8 Results

Across the benchmark, recovery after settlement is constrained by dispersal, and policy performance depends on analyst capacity and scorer quality. Staffing aligned with arrivals sharply reduces alert expiry at fixed hours; the capacity sweep did not confirm a policy reversal on independent seeds.

8.1 Recovery is constrained by dispersal speed

  • Under pass all, 0.065 of victim value is recovered via MED and 0.785 is lost; the tracing projection raises MED recovery to 0.237 but still loses 0.61 to 0.72.These figures use all victim value as the denominator; recovery remains constrained by how quickly funds disperse.Source: §8.1 · p. 13

8.2 Staffing profile

  • At fixed analyst hours, arrival-proportional staffing cuts threshold-plus-block alert expiry from 0.518 to 0.021 at full scale.The development runs showed expiry falling from 42% to 6%.Source: §8.2 · p. 14, Table 6 · p. 14

8.3 Policy ordering and the capacity contrast

  • Halving the team shifts the fixed rule’s relative loss by +0.106 [0.087, 0.124], positive on all twenty paired seeds; the four-analyst reversal was not confirmed on independent seeds.The authors report that reduced capacity erodes and then removes the fixed rule’s advantage, but the precise crossing remains uncertain; these are frozen reference implementations, not optimized policy families.Source: §8.3 · pp. 14–15, Table 7 · p. 15

8.4 Where the value goes

  • Under threshold plus block, genuine post-settlement recovery falls from 0.065 under pass all to 0.019, while 0.230 of victim value is held at a hop.The simulated universal-adoption setting and forwarding structure make hop holds a model property, not an estimate for one institution.Source: Table 9 · p. 16, §8.4 · p. 17

8.5 Scorer quality

  • For the evaluated synthetic scorer at held-out AUC 0.82, threshold plus block leaves 0.574 lost versus 0.782 under pass all, a 27% reduction relative to no intervention.Below about 0.9 AUC, each fixed rule fails through score saturation; the three-seed sweep does not resolve small adjacent-point differences.Source: §8.5 · pp. 17, 19, Table 10 · p. 18

8.6 The tracing projection

  • Under pass all, the tracing projection’s MED-route share rises from 0.139 to 0.248 as MaxHops and depth increase; under threshold plus block, loss stays between 0.083 and 0.095.The tracing regime awaits calibration against published months, and its sensitivity range is not an empirical or analytical bound.Source: §8.6 · p. 19

8.7 Fraud prevalence

  • At five times the accepted-MED incidence, every rule catches only 0.09 to 0.16 before settlement and losses rise to 0.37 to 0.59.These results apply only to sampled multipliers; they do not establish actual fraud prevalence or whether a larger team restores the policy ordering.Source: §8.7 · p. 19

8.8 False blocks

  • Under drift, false-block counts are 12.6 and 23.0 a day for budget threshold and threshold plus block, respectively, 5 to 14% above baseline.The paper attributes this increase to a scorer trained on a warm-up period whose fraud mix has moved.Source: §8.8 · pp. 19–20

9 Limitations

The paper bounds its findings by the simulated mule and balance structure, calibration uncertainty, rail-wide adoption, and empirical data limits.

9 Limitations

  • Policy findings remain conditional on the mule and balance model, since neither tested configuration validates mule activity, balances, and recovery together.The authors suggest active but near-empty mules as a hypothesis, not a demonstrated property.Source: §9 · p. 20
  • The simulator omits a marking-based interdiction channel and treats cautelary blocks as an accounting route, leaving some recovery effects uncharacterized.Under tracing, overlap can overstate MED recoveries by at most 0.019 at quarter scale; queue service time and review accuracy are also assumed.Source: §9 · p. 20
  • Structural calibration error’s effect on policy comparisons is unbounded, and the model does not reproduce February–April 2026 or identify the cause of its composition change.Some scenario and graph parameters are registered assumptions rather than publicly sourced values.Source: §9 · p. 20
  • Rail-wide policy adoption is assumed, partial adoption is not simulated, and absolute prevented-value levels are unanchored and described as optimistic.The synthetic scorer makes the quality-curve ordering and moderate-AUC range more informative than its reference-score level.Source: §9 · p. 21
  • Accepted-MED fraud may differ from unreported or rejected cases, marker prevalence lacks a public anchor, and validation targets are monthly aggregates.The authors state that transaction-level validation requires an institutional pilot.Source: §9 · p. 21

10 Conclusion and the control problem ahead

PixSim reproduces the 2025 recovery targets within stated deviations, while reporting a 2026 misfit and a tracing projection. Its benchmark findings depend on the simulated mule model and analyst capacity.

10 Conclusion and the control problem ahead

  • Frozen full-scale runs reproduced the 2025 recovery rate within 0.006 and decomposition within 0.02; February–April 2026 was a misfit, and tracing remains a projection.The paper distinguishes calibrated results, observed failure, projection, conditional benchmark findings, and exploratory results.Source: §10 · p. 21
  • Staffing by arrival profile cut fixed-rule alert expiry from 52% to 2%, while held-out AUC 0.82 cut lost value by about a quarter.Halving analyst capacity removed the fixed threshold-and-block rule’s advantage over the queue-aware rule on loss and loss plus harm; the suggested reversal at two-thirds capacity was not confirmed on independent seeds.Source: §10 · p. 21
  • The capacity-dependent benchmark is framed as a continuous-time control problem with irreversible action, deadlines, a random recovery clock, and analyst capacity as a state.The objective is expected lost value plus harm; the optimal policy is left to a companion paper, and no port to another instant rail is demonstrated.Source: §10 · p. 21

Code and data availability

The paper provides archived code, data, configurations, and reproducibility materials for its published runs.

Code and data availability

  • PixSim v1.0.0 is released under Apache-2.0 with archived code, table-summary CSVs, run configurations, source data, assumptions, and reproducibility documentation.The repository includes tests and a reduced-scale end-to-end configuration; full-scale per-part outputs are available from the corresponding author on request.Source: Code and data availability · p. 22

Use of AI tools

The authors distinguish tool assistance from responsibility for the model and research claims.

Use of AI tools

  • An agentic coding tool assisted implementation and text editing, while the authors retain responsibility for the model, experiments, interpretation, and published text.Grammarly and Claude were used for grammar checking and editing.Source: Use of AI tools · p. 22

A The rank-space capacity-aware policy

The rank-space capacity-aware policy is worse on average than the probability-space policy with a good scorer, but holds up when the scorer saturates. The reported tables are backed by completed full-scale runs.

A The rank-space capacity-aware policy

  • Rank-space alerts a fixed hourly share rather than a fixed probability, so it expires more alerts; its share adjusts with queued alerts per analyst and has no probability cap.The operating share is k = k0/(1 + 0.25 Q/N); the slope and 1024-bin histogram are assumptions.Source: A The rank-space capacity-aware policy · p. 24
  • 0.012 [0.005, 0.019] in the baseline and 0.085 [0.074, 0.096] at half capacity: rank-space has higher loss share than probability-space on average with a good scorer.Under drift, rank-space is worse on four of five seeds; it holds through σ = 12 only when the scorer saturates and probability-space has collapsed.Source: A The rank-space capacity-aware policy · p. 24, Table 11 · p. 25

B Runs behind the tables

  • 155 distinct full-scale parts and twelve MED-clock validation cells without interdiction underpin the tables; every part was complete.The benchmark file lists per-configuration hashes for S7, S8, and S11.Source: B Runs behind the tables · p. 24, Table 12 · p. 25
Loading 2609.30684v1…