Fraud Detection Patterns

Fraud Detection Patterns

Review Checklist

• Rate limiting on account creation and authentication
• Velocity checks on financial transactions (coins, entries)
• Statistical anomaly detection on competition results
• Account correlation data collected (IP, user agent, creation time)
• Abuse reports have automated escalation thresholds
• Fraud detection is async (doesn't block user experience)

Behavioral Analytics

Session Fingerprinting

// Collect behavioral signals (privacy-respecting, no PII)
interface SessionFingerprint {
  userAgent: string
  screenResolution: string
  timezone: string
  language: string
  colorDepth: number
  platform: string
  // Combined hash = device fingerprint (not unique, but discriminating)
}

// Store with each login for correlation analysis
async function recordLogin(userId: string, fingerprint: SessionFingerprint) {
  await supabase.from('login_events').insert({
    user_id: userId,
    fingerprint_hash: hashFingerprint(fingerprint),
    ip_address: getClientIP(), // hashed, not raw
    created_at: new Date().toISOString(),
  })
}

Behavioral Baselines

Build a normal behavior profile per agent/user, then flag deviations:

Statistical Anomaly Detection

Z-Score for Performance Outliers

function detectPerformanceAnomaly(
  agentId: string,
  recentScores: number[],
  historicalMean: number,
  historicalStdDev: number
): AnomalyResult {
  const recentMean = recentScores.reduce((a, b) => a + b) / recentScores.length
  const zScore = (recentMean - historicalMean) / Math.max(historicalStdDev, 1)
  
  return {
    agentId,
    zScore,
    anomalous: Math.abs(zScore) > 3, // 3 sigma = 0.13% chance of being normal
    direction: zScore > 0 ? 'overperforming' : 'underperforming',
    confidence: Math.abs(zScore) > 4 ? 'HIGH' : Math.abs(zScore) > 3 ? 'MEDIUM' : 'LOW',
  }
}

Benford's Law for Financial Fraud

// Arena Coins: legitimate transactions follow Benford's distribution
// Fraudulent transactions (coin duplication, fake purchases) don't
function checkBenford(amounts: number[]): boolean {
  const expectedFirst = [0, 30.1, 17.6, 12.5, 9.7, 7.9, 6.7, 5.8, 5.1, 4.6] // %
  const actualFirst = new Array(10).fill(0)
  
  for (const amount of amounts) {
    const firstDigit = parseInt(String(Math.abs(amount))[0])
    actualFirst[firstDigit]++
  }
  
  // Chi-squared test against expected distribution
  // Significant deviation → flag for review
  return chiSquaredTest(actualFirst, expectedFirst, amounts.length) > 0.05
}

Velocity Checks

// Rate-based fraud prevention
const VELOCITY_LIMITS = {
  account_creation_per_ip: { limit: 3, window: '24 hours' },
  login_attempts_per_account: { limit: 10, window: '15 minutes' },
  coin_purchases_per_day: { limit: 5, window: '24 hours' },
  challenge_entries_per_hour: { limit: 10, window: '1 hour' },
  votes_per_minute: { limit: 5, window: '1 minute' },
  password_resets_per_day: { limit: 3, window: '24 hours' },
} as const

async function checkVelocity(
  key: string, // e.g., "account_creation:192.168.1.1"
  rule: keyof typeof VELOCITY_LIMITS
): Promise<{ allowed: boolean; remaining: number }> {
  const config = VELOCITY_LIMITS[rule]
  return checkRateLimit(key, config.limit, parseWindow(config.window))
}

Multi-Account Detection

-- Find accounts that share characteristics
SELECT a.id as account_a, b.id as account_b,
  CASE 
    WHEN a.creation_ip = b.creation_ip THEN 'same_ip'
    WHEN a.fingerprint_hash = b.fingerprint_hash THEN 'same_device'
    WHEN similarity(a.agent_config, b.agent_config) > 0.8 THEN 'similar_config'
  END as correlation_type
FROM users a
JOIN users b ON a.id < b.id -- avoid self-join and duplicates
WHERE a.creation_ip = b.creation_ip
   OR a.fingerprint_hash = b.fingerprint_hash;

Abuse Pattern Catalog

Implementation Architecture

User action → Normal processing (synchronous)
     ↓ (async, non-blocking)
Fraud signal queue → Fraud analysis worker
     ↓
Decision: ALLOW / FLAG / BLOCK
     ↓
If FLAG: log to fraud_events table, notify moderator
If BLOCK: suspend action, notify user

Key principle: Fraud detection runs ASYNC. Never block the user experience to check for fraud (except velocity limits, which are fast). Analyze patterns after the fact and take action retroactively.

Sources

• Chess.com Fair Play system (behavioral analytics at scale)
• Stripe Radar (payment fraud detection patterns)
• Kaggle competition integrity enforcement
• Benford's Law for financial fraud detection

Changelog

• 2026-03-21: Initial skill — fraud detection patterns