Another prediction: "fraudsters work on weekends" would yield the same graph if displayed as a percentage of total transactions.
Edit: http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statisti...
Another prediction: "fraudsters work on weekends" would yield the same graph if displayed as a percentage of total transactions.
Edit: http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statisti...
The "outside of business hours" explanation is still a valid explanation but definitely not the whole story. Overall, I'd caution that when building fraud detection models understanding the stories behind the data is extremely important, or you risk having an algorithm that works for the wrong reasons.
For example, if suddenly your user base because more international (for example if you start allowing non-US users to use your website), you'll suddenly have a lot of false positives if you're not cautious because to your system it'll look like they're "operating outside of business hours".
As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly.
The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.
Another way to put it: fraudsters are more likely to be night-owls than the rest of us.
As I've said earlier, you can see in the users count that fraudulent users are indeed the lowest at night (which makes sense, since fraudsters sleep as well). However, we are looking at the "fraud rate" (#fraud / all users in a given hour). I'm not sure what you even mean by "misrepresent" the data. The data speaks for itself.
The argument for misinterpreting the data is easy to use when you account for time zones. If (a) I'm in the US and (b) I notice that most of my fraudulent transactions occur around 3AM, then it follows that (c) most of my fraud occurs at night. However, if the corollary of "Most of my fraud occurs from India/Singapore/etc", then it's simply a matter of time zones. Does most of my fraud occur at night? It does if I'm in the US but, if I'm the hacker in India/etc, then it occurs during the day. It's 3:45AM where I am in the US (CDT) but it's 2:15PM somewhere in India...
However, if I was to write a training manual for my employees who worked in the same building as me (US CDT), then I'm not misinterpreting the data. The data is the "truth" here - if it shows that most fraudulent transactions occur around 3AM local time, then that's the truth and I'd be foolish to over-complicate the issue when trying to train new hires on how to spot fraud.
Statistically speaking, I'm suspicious regarding the conclusion about lunch hours. In order to identify that feature robustly, it's necessary to very accurately know the variability of the background signal. Does it always dip at lunch hours and all at the same time? Does it always have the same shape? Recall what's being done here is separating the background "non-fraud transactions" from "fraud transactions". If the latter are much smaller in number than the former, and the determination of fraud has a finite miss rate or a finite false alarm rate, then all the implications of Bayes Rule apply, and the fraud signals being seen could be just some transfer function of the fraud mechanism applied to the background signal.
Moreover, do fraudulent signals increase in proportion to total background? Or are they a constant amount?
I think more work needs to go into deconvolving the two kinds of signals before assigning meaning to their parts and features of their parts.
No doubt the story assigned to these is plausible and compelling, but it is based upon unproven inferences. And, in my opinion, assuming that identifying and acting on these signals is simpler than it looks is getting way ahead of the art.
honestly... frack the internet, you'r giving it too much weight
http://www.wired.co.uk/news/archive/2013-04/11/malwarebytes
The time difference would explain the prevalence of night owls and other factors often used in fraud detection. Only on my direct office phone number, I receive 5-10 such calls a week.