Real-Time Fraud Interdiction Cuts Losses by Over 10 million Dollars

How the third largest US credit card brand replaced an aging Teradata fraud stack with an event-driven interdiction platform combining real-time ML scoring, cognitive case management, and a zero-disruption 50TB cloud migration, sustaining sub-second scoring at 4,000-plus transactions per second.

Net annual fraud losses cut by over 10 million dollars, with sub-second scoring sustained at 4,000-plus transactions per second.

This was a rebuild of the fraud operating model, from detection to investigation, executed alongside live production without disruption.

Overview

The third largest US credit card brand, processing more than 4,000 transactions per second for over 40 million cardholders, faced escalating fraud losses that its aging Teradata-based infrastructure could no longer contain. Excessive false positives consumed investigator capacity, novel fraud patterns went undetected in real time, and the legacy warehouse constrained advanced risk profiling. Myridius designed and deployed an event-driven fraud interdiction platform combining real-time ML scoring, cognitive case management, and a phased 50TB cloud migration, all engineered to run as a non-disruptive sidecar alongside live production. Net annual fraud losses fell by over 10 million dollars, alert accuracy passed 90 percent, case resolution became 42 percent faster, and the migration completed with zero production disruption. 

Key Outcomes

• Net annual fraud losses reduced by over 10 million dollars with sub-second scoring at 4,000-plus transactions per second.
• Over 90 percent alert accuracy and 42 percent faster case resolution.
• 50TB of data migrated to a modern cloud analytics platform with zero production disruption.

Client Context

The client is the third largest US credit card brand, serving more than 40 million active cardholders and processing over 4,000 transactions per second. In a payments business of this scale, fraud detection quality lands on the bottom line twice: every missed pattern is a direct financial loss, and every false positive spends investigator time and cardholder goodwill on a threat that was never there. The systems that make these split-second decisions are therefore core to both profitability and customer trust. As bad actors and their fraud techniques grew more sophisticated, the aging Teradata foundation increasingly limited both detection accuracy and the advanced analytics needed to stay ahead. 

The Challenge

The brand's fraud infrastructure had been built for an earlier era of threats. Processing more than 4,000 transactions per second for over 40 million active cardholders, the aging Teradata-based data warehouse still did its core job, but against increasingly sophisticated fraud techniques it was losing ground. Excessive false positives consumed investigator capacity, novel fraud patterns went undetected in real time, and the platform constrained the advanced analytics needed for deeper risk profiling. Compounding the challenge, modernizing the analytics foundation meant migrating 50TB of data without any disruption to live transaction processing, in a 24x7x365 business where downtime is not an option. The brand was already moving off the aging, costly Teradata warehouse, and Snowflake was its platform of choice for what came next, so the modernization rode onto a cloud platform the business had chosen for its lower cost and easier day-to-day use.

Status Quo and Desired State

Transformation Goals

The engagement was guided by three north stars: cut fraud losses through real-time, ML-driven detection, sharpen alert quality so investigators spend their time on genuine threats, and modernize the analytics foundation without disrupting a single payment transaction.

• Revenue protection: Reduce net fraud losses through precision real-time ML scoring and automated intervention at transaction speed.
• Operational control: Raise alert accuracy and accelerate case resolution so investigator capacity focuses on real threats, not false positives.
• Scale and trust: Migrate 50TB from Teradata to a cloud-native analytics platform with zero disruption to live transaction processing.

Myridius Solution Approach

Myridius approached the engagement as a rebuild of the fraud operating model rather than a model deployment. The platform was designed and deployed as an event-driven system combining real-time ML scoring, intelligent case management, and a phased cloud migration, all engineered to operate as a non-disruptive sidecar alongside live production systems processing thousands of transactions every second.

• Orchestrated the foundation: Built a Confluent Kafka-based event streaming platform integrating legacy IBM MQ systems with real-time KSQL stream processing, and executed a phased 50TB migration from Teradata to Hadoop and Snowflake on AWS using an event-driven framework with automated source-to-target data balancing for integrity assurance. Consolidating the fraud data into Snowflake as the central analytics platform gave the ML models a single, consistent place to run against, which was simpler and quicker to work with than the legacy Teradata environment. Its standard SQL interface also exposed the data to analysts directly, so risk and investigation teams could explore patterns themselves instead of waiting on long IT request cycles.
• Embedded intelligence into the workflow: Deployed a Gradient Boosted Trees model with 32 variables using the H2O framework, with auto-optimized hyperparameters via grid search, packaged as a high-speed JAR for sub-millisecond scoring. The fraud score, probability of fraud times transaction value times cost factor, enabled ROI-optimized detection at five dollars per intervention.
• Reimagined the operating model: Implemented cognitive case management with configurable alert thresholds, auto-escalation for high-value transactions, visualization dashboards for investigator workflow, and established a continuous feedback loop so investigation outcomes improve model performance over time.

Governance and Trust Layer

In a live payments environment, security and integrity are not features layered on at the end. They run through every layer of the platform. Active Directory, encryption, and access controls secured the streaming platform, while IAM, KMS encryption, VPC isolation, and multi-AZ failover protected the cloud infrastructure. Critically, the entire 50TB migration was executed with zero disruption to live transaction processing, and automated source-to-target data balancing assured data integrity throughout, so modernization never put the business it protects at risk. 

Measurable Impact

The transformation moved the brand from a legacy detection stack losing ground to sophisticated fraud to a real-time interdiction platform that learns from every case. Outcomes manifest themselves across fraud losses, alert quality, investigator productivity, and platform scale, each reinforcing the others as the feedback loop refines the models.

The result:

• Net annual fraud losses reduced by over 10 million dollars through precision ML scoring and automated real-time intervention, with the platform sustaining consistent sub-second fraud scoring at 4,000-plus transactions per second across all channels.
• Over 90 percent alert accuracy with dramatically fewer false positives, letting investigators focus on genuine threats, and 42 percent faster case resolution through automated prioritization and cognitive case workflows, achieving five-dollars-per-case intervention efficiency.
• 50TB of historical and transactional data migrated from Teradata to a modern cloud analytics platform with zero production disruption, establishing the foundation for deeper risk profiling and continuous model improvement.

The machine learning models were the primary driver of these results, with Snowflake as a strong enabler: bringing all the data into one place is what let the models run effectively and gave analysts direct, self-service access. The savings figures reflect the solution as a whole rather than Snowflake alone.

Operational Transformation

Technology Stack

Frequently Asked Questions

How much did the fraud interdiction platform reduce losses?

Net annual fraud losses fell by over 10 million dollars through precision ML scoring and automated real-time intervention. The platform sustains sub-second fraud scoring at 4,000-plus transactions per second across all channels. It also reached over 90 percent alert accuracy and 42 percent faster case resolution, so gains compound across losses, alert quality, and investigator productivity.

How does the platform score transactions in real time without slowing payments?

It runs as an event-driven, non-disruptive sidecar alongside live production. A Confluent Kafka streaming platform with KSQL processing feeds a Gradient Boosted Trees model built in H2O with 32 variables, packaged as a high-speed JAR for sub-millisecond scoring. Because the platform operates beside production rather than inside the transaction path, it delivers real-time scoring without pausing the payments business.

How was 50TB migrated without disrupting live transactions?

Myridius executed a phased migration from Teradata to Hadoop and Snowflake on AWS using an event-driven framework, with automated source-to-target data balancing to assure integrity. The entire 50TB migration completed with zero disruption to live transaction processing. Layered security, including IAM, KMS encryption, VPC isolation, and multi-AZ failover, protected the environment throughout. Moving onto Snowflake as the central analytics platform gave the fraud models one consistent source to run against and let analysts query the data directly through standard SQL, which was easier and lower in running cost than the legacy Teradata setup it replaced.

How does the system keep improving over time?

A continuous feedback loop connects investigation outcomes back to the ML models, so every case helps refine detection. Cognitive case management with configurable thresholds and auto-escalation prioritizes the highest-value alerts. Over time this reduces false positives and improves accuracy, turning each investigation into training signals for sharper future detection.

Real-Time Interdiction as a Bottom-Line Advantage

For a card issuer, fraud detection quality lands directly on the bottom line twice: every missed pattern is a direct loss, and every false positive spends investigator time and cardholder goodwill on a threat that was never there. This case shows how a real-time ML decision engine, an event-driven architecture, and cognitive case management can move both numbers at once, reducing net fraud losses by over 10 million dollars while making every alert investigators see more likely to matter, all without pausing a live payments business for a single transaction.

This was not a model deployment. It was a rebuild of the fraud operating model, from detection to investigation, executed alongside live production without disruption.

What's Next

If your organization fights fraud, risk, or abuse at transaction speed and your detection stack is losing ground to false positives and novel patterns, Myridius can help you build the real-time interdiction platform and feedback loop that cut losses without disrupting the business they protect.

Talk to a Myridius expert and send us a message at Contact Myridius.