Real-time transactional fraud detection with private models

Context

NovaPay Mexico is a payments and electronic-voucher fintech processing B2B2C transactions for over 4,000 affiliated companies (payroll, meal vouchers, corporate payments). Facing growing digital fraud in Mexico, NovaPay found its static rules engine generated too many false positives and couldn't react to emerging patterns: synthetic identities, coordinated attacks, and "card testing."

The challenge

• Maximum acceptable authorization latency: 200 ms.
• Transactional and biometric data classified as sensitive under LFPDPPP, with no ability to send it to third-party APIs outside Mexico.
• Need for explainability for CNBV audits and chargeback disputes.
• Overwhelmed fraud-analyst team: manually reviewing thousands of daily alerts with a high false-positive rate.

The solution: private on-premise models

Instead of relying on an external SaaS provider, NovaPay chose to deploy proprietary models, hosted on its own infrastructure (private VPC on national territory), trained on its own historical transaction data.

ARCHITECTURE

• Streaming ingestion: Kafka captures every transaction at the moment of authorization.
• Real-time feature store: behavioral variables (device, geolocation, transaction velocity, keystroke fingerprint) computed in milliseconds.
• Hybrid model: gradient boosting (XGBoost) for a low-cost initial score + graph neural network (GNN) to detect coordinated fraud rings across related accounts.
• Two-step scoring: fast decision on the first pass; if the result is uncertain, additional signals get added (device verification, liveness) and re-scored before authorizing or blocking.
• The whole pipeline runs inside NovaPay's infrastructure — no transactional data leaves to third parties, meeting regulatory and data-sovereignty requirements.
• Continuous retraining: models retrain weekly with feedback from human analysts, who validate edge cases.

Results at 8 months

Metric	Before	After
Decision time per transaction	~1.2 s (static rules)	<150 ms
False positives	Base 100%	-58%
Fraud detected before settlement	41%	89%
Direct fraud losses	Base 100%	-63%
Alerts manually reviewed per analyst/day	~220	~70 (highest risk)

The analyst team stopped reviewing trivial transactions and focused on investigating complex patterns and improving model rules — the role shifted from operational to analytical.

Key success factors

• Private models, not third-party dependence: full control over data and regulatory compliance without legal friction.
• Low-latency architecture by design, not as a later optimization.
• Human in the loop for edge cases, avoiding blocking legitimate customers.
• Continuous retraining as an operational process, not a one-time project.

Lesson to replicate

The differentiator wasn't just "using AI" — it was running the model inside its own infrastructure, trained on proprietary data, without exposing sensitive transactional information to external services — especially relevant for financial and payments institutions in Mexico subject to CNBV and LFPDPPP.