Many Credit card fraud prevention systems such as the Falcon Fraud Manager use both Rules and ML (Neural Network modelling) to tackle this issue. I am not sure that a purely data centric approach with no rules even makes sense.
but, rules are rather easy for fraudsters to circumvent, and they require merchants to play whack-a-mole. with today's technologies, it's easier than ever to analyze massive amounts of data, and we believe that machine learning can go a really long way in detecting fraud.
does that make sense? happy to discuss further, and we'd be happy to put you in touch with our customers if you'd like to hear more about our results.
Having worked in this space a bit, I know where the dragons be in such an approach. I imagine that you are doing some kind of Pattern Matching: e.g. known Fraudster uses these signals (Browser +OS + Email+Time of shopping + something else... + type of Card) to teach the system what to look for. The real trick is to avoid over training and evolving the patterns to keep pace with the fraudsters by incorporating feedback from the merchants.
Can you point to some blog posts/text that provides a sneak peak into the kinds of technology that you use to cut down on false positives?
Fraudsters generally follow fairly specific patterns that can definitely be picked up in a rich enough dataset, and the consortium-based approaches of Falcon and Sift allow the models to generalize pretty well. Rules are way less expressive than complex-enough machine learning methods (combined with good data).
Rules composed into cascdes or manual decisions trees are not as powerful as ml.
But rules can be converted into features, which you use as primitives in an ml model.
In fact, one pattern for feature engineering is to build a good rules-based system. You then can treat that as features of a degenerate model, with weights of plus or minus infinity. By training, you can induce better weights.
Edit: in a sense, rules and training method are almost orthogonal concerns.
"Rule" has a very specific meaning in this industry, and it's basically a manual decision that exists outside the ML model - usually written by experts. The people who build the models never see the rules (per se), and the rules are integrated after the models are deployed. I wouldn't describe a modeler integrating logic into the modeling process a "rule" because it would confuse terminology.
The whole rule-based thing is sort of a testament to how old-fashioned the industry is IMO. The problem is two-fold: banks don't fully trust ML (or the "experts" want to keep their jobs), and they don't tolerate much change in their computing platforms. That last point is pretty important: banks/issuers don't refresh their fraud models very often, so they can miss new types of fraud, which ends up being a great use-case for rules.