Card transactions & fraud
A decade of US card transactions from a bank’s book: what was spent, what the bank declined, and what turned out to be fraud. The interesting part is not the fraud rate. It is that the obvious way to calculate it is wrong by a third, and the data does not tell you so.
The same fraud, two denominators
The source adjudicated 67% of transactions and left the rest unlabelled. Join the labels on and treat every miss as clean — the obvious thing to do — and the fraud rate reads a third lower. Same numerator both times. The only difference is what you divide by.
That is not an EMV migration
Chip transactions are 0.0% of the file in December 2014 and 68% in January 2015, then flat within a point of that for five years. The real US liability shift was October 2015 and took years to work through the estate. A switch that clean is a property of how this file was generated, not of anything a bank did — so the report describes the channel mix and stops short of calling it adoption.
Fraud follows the channel, and what resells
Year by year
The file stops on 31 October 2019, so 2019 holds ten months. Comparing it whole against 2018 shows a collapse that is entirely the calendar; the column below compares January to October against January to October instead.
| Year | Approved | Spend | Like-for-like vs PY | Decline rate | Fraud per 10k |
|---|
Why a transaction was declined
What the source needed before any of this was true
- Two in five clients never transact. 781 of the 2,000 clients in the customer file never appear in the transaction file at all, and 2,075 of the 6,146 cards never transact. That is the extract, not dormancy. Spend per customer computed over the customer table rather than over the fact would be 39% low. The panel here is drawn from the 1,219 clients that do transact — and this was caught by a cross-check, not by reading the data: the model returned 97 active clients against a 160-row dimension.
- The fraud labels stop at 67%. Not 67% of one year — 67.0% of every year, which makes it a sampling decision by whoever built the file rather than a period nobody reviewed. Both rates are in the model and the report shows them side by side, because the honest thing to do with a denominator you cannot verify is to display it.
- Amount is the amount attempted, not the amount settled. It is populated on declined rows too. Summing it whole overstates spend by $1.64m over the ten years, which is not an error in the data — it is the money the bank declined to move.
- The location column holds two different things. 199 distinct values, 147 of them full country names sitting alongside two-letter US state codes — and “Georgia” the country next to “GA” the state. A map fed the raw column plots Tbilisi onto Atlanta. A blank is not one thing either: almost every blank is an online transaction with no merchant location, but 845 card-present travel-agency rows are blank too, and they net to minus $44,657. Those get their own member rather than being relabelled “online”, which would have moved card-present spend into the online channel.
- The merchant codes are not the standard. ISO 18245 reserves 3000–3999 for named airlines, car-rental firms and hotel chains; this file uses that block for “Steelworks”, “Welding Repair” and “Ship Chandlers”. Grouping the codes by range — the obvious way — files a steel mill under travel. All 109 codes are mapped one at a time instead, and the ETL fails if the source ever adds one it does not know.
- The “Other” bucket was the highest-fraud category. The first cut of the category grouping had one, and it turned out to hold electronics, computers and jewellery — the things that resell — at eleven times the book’s fraud rate. Which is the argument against ever having an “Other” bucket: findings go in and do not come out.
- Nothing sensitive left the extract. Card number, CVV, expiry date and the cardholder’s street address are dropped in the ETL rather than hidden in the model. A column that never leaves the extract cannot leak out of a report.
- The data is synthetic, and says so in places. Beyond the chip switch, decline rates barely move across credit-score bands — 1.4% for the poorest, 1.7% for the best — which is not how a real credit book behaves. Worth knowing before anyone reads a risk story into it.