Artificial intelligence based fraud detection system

1. A method of detecting fraud of risk targets, the risk targets comprising customer accounts and cashiers, the method comprising:

receiving historical point of sale (POS) data;

dividing the POS data into store groupings;

creating a first aggregation of the POS data corresponding to the customer accounts and a second aggregation of the POS data corresponding to the cashiers;

calculating first features corresponding to the customer accounts and second features corresponding to the cashiers;

filtering the first aggregation and the second aggregation based on filtering rules, the filtering rules comprising thresholds for counts of transactions and/or transaction values;

separating the filtered first aggregation and the second aggregation into a plurality of data ranges;

for each combination of store groupings and data ranges, training an unsupervised machine learning models;

applying the unsupervised machine learning models after the training to generate first anomaly scores for each of the customer accounts and cashiers; and

based on the first anomaly scores, outputting information identifying likely fraudulent risk targets.

2. The method of claim 1 , further comprising:

training a first supervised machine learning model for the customer accounts and a second supervised machine learning model for the cashiers, wherein the training comprises using the store groupings and data ranges as third features in addition to the first features and the second features;

applying the supervised machine learning models after the training to generate second anomaly scores for each of the customer accounts and cashiers.

3. The method of claim 2 , wherein the unsupervised machine learning models each comprise a 1-class support vector machine and the first supervised machine learning model and the second supervised machine learning model each comprise random forests.

4. The method of claim 1 , wherein activity of each customer account is generated by a loyalty account.

5. The method of claim 1 , wherein activity of each of the cashiers is tracked by one or more corresponding POS systems.

6. The method of claim 1 , wherein the first features and the second features each comprise count ratios, amount ratios, and ratios of an amount divided by a corresponding count.

7. The method of claim 1 , wherein the outputting information comprises:

generating a user interface that displays a listing of a most likely fraudulent customer accounts and cashiers and a numerical weight indicating how strongly each feature contributed to the first anomaly scores.

8. A non-transitory computer-readable medium storing instructions which, when executed by at least one of a plurality of processors, cause the processor to detect fraud of risk targets, the risk targets comprising customer accounts and cashiers, the detecting comprising:

receiving historical point of sale (POS) data;

dividing the POS data into store groupings;

creating a first aggregation of the POS data corresponding to the customer accounts and a second aggregation of the POS data corresponding to the cashiers;

calculating first features corresponding to the customer accounts and second features corresponding to the cashiers;

filtering the first aggregation and the second aggregation based on filtering rules, the filtering rules comprising thresholds for counts of transactions and/or transaction values;

separating the filtered first aggregation and the second aggregation into a plurality of data ranges;

for each combination of store groupings and data ranges, training an unsupervised machine learning models;

applying the unsupervised machine learning models after the training to generate first anomaly scores for each of the customer accounts and cashiers; and

based on the first anomaly scores, outputting information identifying likely fraudulent risk targets.

9. The computer-readable medium of claim 8 , the detecting further comprising:

training a first supervised machine learning model for the customer accounts and a second supervised machine learning model for the cashiers, wherein the training comprises using the store groupings and data ranges as third features in addition to the first features and the second features;

applying the supervised machine learning models after the training to generate second anomaly scores for each of the customer accounts and cashiers.

10. The computer-readable medium of claim 9 , wherein the unsupervised machine learning models each comprise a 1-class support vector machine and the first supervised machine learning model and the second supervised machine learning model each comprise random forests.

11. The computer-readable medium of claim 8 , wherein activity of each customer account is generated by a loyalty account.

12. The computer-readable medium of claim 8 , wherein activity of each of the cashiers is tracked by one or more corresponding POS systems.

13. The computer-readable medium of claim 8 , wherein the first features and the second features each comprise count ratios, amount ratios, and ratios of an amount divided by a corresponding count.

14. The computer-readable medium of claim 8 , wherein the outputting information comprises:

generating a user interface that displays a listing of a most likely fraudulent customer accounts and cashiers and a numerical weight indicating how strongly each feature contributed to the first anomaly scores.

15. A fraud detection system for detecting fraud of risk targets, the risk targets comprising customer accounts and cashiers, the system comprising:

one or more processors executing instructions;

historical point of sale (POS) data received by the processors; and

a plurality of unsupervised machine learning models;

the processors configured to:

divide the POS data into store groupings;

create a first aggregation of the POS data corresponding to the customer accounts and a second aggregation of the POS data corresponding to the cashiers;

calculate first features corresponding to the customer accounts and second features corresponding to the cashiers;

filter the first aggregation and the second aggregation based on filtering rules, the filtering rules comprising thresholds for counts of transactions and/or transaction values;

separate the filtered first aggregation and the second aggregation into a plurality of data ranges;

for each combination of store groupings and data ranges, train the unsupervised machine learning models;

apply the unsupervised machine learning models after the training to generate first anomaly scores for each of the customer accounts and cashiers; and

based on the first anomaly scores, output information identifying likely fraudulent risk targets.

16. The system of claim 15 , further comprising:

a first supervised machine learning model for the customer accounts;

a second supervised machine learning model for the cashiers:

the processors further configured to:

train the first supervised machine learning model for the customer accounts and the second supervised machine learning model for the cashiers, wherein the training comprises using the store groupings and data ranges as third features in addition to the first features and the second features;

apply the supervised machine learning models after the training to generate second anomaly scores for each of the customer accounts and cashiers.

17. The system of claim 16 , wherein the unsupervised machine learning models each comprise a 1-class support vector machine and the first supervised machine learning model and the second supervised machine learning model each comprise random forests.

18. The system of claim 15 , wherein activity of each customer account is generated by a loyalty account.

19. The system of claim 15 , wherein activity of each of the cashiers is tracked by one or more corresponding POS systems.

20. The system of claim 15 , the processors further configured to:

generate a user interface that displays a listing of a most likely fraudulent customer accounts and cashiers and a numerical weight indicating how strongly each feature contributed to the first anomaly scores.