Confidential Payments Client - Fraud Risk Scoring (KSA).
Cairo, Egypt
Source: resume + original portfolio + LinkedIn
Two integrated fraud-detection models for a confidential payments client, consumed by SAS Fraud Management in real time: a KYC-stage onboarding risk scorer and a behavioral account-risk model for ongoing monitoring.
The platform needed instant onboarding decisions while also maintaining a separate continuous-monitoring view of account behavior over time.
The behavioral model had to leverage both unlabeled anomaly signals and historical confirmed fraud without exploding false positives on sparse or shifting populations.
I built a real-time onboarding scorer using customer profile, document, device, IP, geolocation, channel, and early behavioral signals to return a risk score and three-way decision into the middleware layer.
For ongoing risk monitoring, I designed a semi-supervised architecture where Isolation Forest first measured account abnormality, then fed that continuous anomaly score into an XGBoost classifier alongside 50+ engineered features derived across micro, short, medium, and baseline windows.
To keep the system reliable in production, I added non-sufficient-data routing, cohort-aware standardization, PSI-based drift checks, Platt-scaled calibration, and SHAP attribution for Medium and High-risk accounts before both models were exposed to SFM through REST API middleware.
- →Built a real-time onboarding model returning Approve / Review / Block decisions during KYC
- →Designed a two-stage behavioral risk architecture combining Isolation Forest and XGBoost
- →Engineered 50+ account-level behavioral features across four temporal windows
- →Integrated calibrated risk scores and SHAP-based explanations into SAS Fraud Management workflows
- →Enabled real-time account gating at onboarding with direct Approve / Review / Block recommendations.
- →Combined unsupervised and supervised fraud signals into an operational risk-scoring workflow instead of relying on either method alone.
- →Delivered calibrated, explainable risk outputs that can be routed directly into analyst investigation queues.