Why Feature Freshness Makes or Breaks Fraud Detection

TL;DR: Fraud moves fast, and your features should too. Batch processing creates delays that fraudsters exploit, while real-time feature computation enables instant threat detection, reducing losses and improving accuracy. This post breaks down why feature freshness is critical and how to achieve it.

Fraud detection has come a long way. Many financial services and fintech companies began with simple rules engines and batch processing, analyzing transactions hours or even days after they occurred. As digital commerce accelerated, the focus shifted to more sophisticated models—developing better algorithms and incorporating more data—but still largely within batch architectures.

Fraudsters operate in near real-time across multiple channels, making any delay in data processing an increasingly exploitable weakness. Batch-centric architectures struggle to keep up, but even systems with real-time data ingestion can fall short if features aren’t computed and served fast enough. 

A 2024 LexisNexis study found that every dollar lost to fraud costs financial institutions $4.41, with digital channels accounting for half of all fraud losses. And with 63% of financial firms reporting fraud increases of at least 6% in just 12 months, the financial stakes of stopping fraud have never been higher.

In this post, we’ll explore why the next critical evolution in fraud detection is feature freshness—calculating and delivering model inputs using data collected seconds ago. This shift from batch to real-time processing is how leading financial companies such as Coinbase, Block, and North detect fraud.

Limits of batch-centric architectures in fraud detection

Even the most sophisticated ML models face inherent limitations when working with stale data. Multi-channel commerce and digital banking introduce complex data patterns that change by the minute.

For sophisticated fraudsters, stale features create a significant advantage. Bad actors leverage automation to execute fraudulent transactions in rapid succession, often completing multiple transactions in the brief window between when an event occurs and when batch features reflect it.

“At some point, you will reach a certain performance plateau in terms of what you can optimize if you have batch features. The next level of performance comes from incorporating real-time signals.”
-Stephan Claus, Director of Data Analytics at HomeToGo

This plateau represents the ceiling on fraud detection capabilities without incorporating fresh features. The gap between when data is generated and when it becomes available creates significant operational and financial risks that fraudsters quickly exploit.

Consider a common scenario: a customer’s credit card is used in one location, then minutes later in another location 2,000 miles away. Effective fraud detection requires contextual awareness to recognize that the simultaneous presence in two locations is physically impossible.

“If someone used their credit card five minutes ago in San Francisco and they’re trying to do a card-present transaction in New York, we have to have the contextual information to understand that you’re probably not going to be on two coasts at the same time.”
-Ben Orkin, Vice President of Engineering – MLOps at North

Without timely data, systems miss critical signals that only emerge when examining minute-by-minute activities. This leads to undetected transaction sequences and makes it difficult to distinguish between legitimate customer activities and genuine fraud. The vulnerability extends to sophisticated fraud rings targeting multiple accounts simultaneously, which can operate undetected when systems lack fresh, cross-account context.

When fraud detection systems miss these signals, someone pays the price. As Ben Orkin from North said in a recent conversation about fighting fraud in real time: “If you get one wrong, which obviously does happen, someone’s going to take the hit for that, be that us, be it a merchant, be it a cardholder.”

Why real-time feature computation matters

Millisecond-level data responsiveness allows ML models to capture signals while they still retain their highest predictive value. With real-time computation across transaction data, fraud teams gain critical insights that would be impossible with batch processing. 

What becomes possible with this approach? Here are just a few examples:

• Device intelligence signals look at IPs and device fingerprints to determine if someone is legitimately using their card where they claim to be located
• Recent transaction context helps systems understand what a customer did minutes ago, versus relying solely on historical patterns
• Email risk indicators help models analyze how legitimate an email address is—was it created six hours ago or six years ago?
• Velocity anomalies enable detection of suspicious patterns in transaction frequency that indicate coordinated fraud attempts

Fresh features enable organizations to identify threats faster and gain critical context to understand the who, what, where, and how of an attack as it’s occurring. 

“When you swipe your card, you are not waiting there for seconds or minutes. All these systems must be optimized to an extreme to make sure we can return a good answer within a fraction of a second.”
-Niccolò Ronchetti, Staff Machine Learning Engineer at Block

This agility can be the difference between stopping a fraudster after the first transaction or allowing them to complete dozens of fraudulent purchases.

Building an effective framework for feature freshness in fraud detection

The growing sophistication of fraud has shown that attacks can escalate at unprecedented speeds, going from the first transaction to dozens of fraudulent purchases in minutes. To combat this, organizations need to implement a comprehensive approach to feature freshness:

1. Real-time feature computation calculates features within seconds of events occurring, capturing fraud signals immediately
2. Consistent feature definitions ensure training and serving use identical feature logic, eliminating skew and maintaining model accuracy
3. Low-latency feature serving delivers context to models within milliseconds, enabling rapid decision-making
4. Holistic time window management maintains both recent and historical context, capturing all relevant patterns

Payment processors and financial services companies are increasingly shifting from general-purpose models to more specialized models targeted at specific industries or merchant types. This specialization requires even greater feature flexibility, as different business contexts may need unique signals while maintaining core fraud indicators across all models.

By implementing these capabilities, organizations can significantly reduce both fraud losses and false positives, limiting fraudsters’ success while maintaining a positive experience for legitimate customers.

Achieve up-to-the-second data signals without infrastructure complexity

While the benefits of real-time feature freshness are clear, implementing the required infrastructure has traditionally required significant engineering resources and specialized expertise.

Tecton’s feature platform enables organizations to leverage fresh data without the massive engineering investment typically required. Tecton abstracts away the complex data engineering needed to compute, store, and serve ML features at scale, ensuring millisecond data freshness and enterprise-grade reliability for fraud detection systems.

Want to know how it works? Watch this quick fraud detection demo to see how Tecton helps ML teams get fresh features and respond quickly to evolving fraud tactics.

If you’re ready to overcome feature freshness challenges and improve your fraud detection outcomes with real-time data, set up time with one of our engineers to talk through your use case and requirements.