fraud.ai — mortgage application fraud, made visible

Not marketing language — verifiable disciplines

Three disciplines this demo doesn't let itself skip

Every vendor says "real AI." Here's what that has to mean, mechanically, for every number you're about to interact with below — not a claim, a description of how the rest of this page actually works.

Held-Out Discipline Every proof number on this page comes from 141 applications the model never saw while it was built, tuned, or thresholded — scored one at a time in Step 5, never batch-approximated.

Composite, Not a Black Box The risk score isn't one opaque number from a neural net. It's five named, individually-adjustable signals blended by a formula you can read — and reweight yourself — in the derivation.

Live, Not Cached Nothing here is a canned screenshot or a pre-rendered chart. Drag a slider or click a button and the server recomputes the real math against the real fitted model, right now.

Two colleagues reviewing a finding together at a desk, both smiling — The other half of "trustworthy AI": a system whose reasoning a person can actually walk through with you, out loud.

01Meet Devon

Every number below is real — computed live by the same Isolation Forest this whole demo runs on, not a canned example. Click the button to score Devon's application the way the model actually would.

Loading Devon's application…

Click "Score this application" to send Devon's exact feature values through the real, fitted model and see the composite risk score it produces — the same formula used everywhere else in this demo.

Curious what a typical clean application looks like next to Devon's?

Next: Move the Threshold →

02Move the Threshold

Devon's score either clears the review line or it doesn't — and where that line sits is a real, adjustable decision, not a fixed constant.

Drag the red line left or right across the chart below. Every one of the 880 synthetic applications is plotted by its real composite risk score; the "flagged" and "cleared" counts update instantly as you move the line — this is the exact same threshold mechanism described in the composite score formula below.

–flagged for review

–cleared

–current threshold

What moving the line actually costs you

Precision and recall pull in opposite directions — drag the line above and watch why, live. Computed across all 880 synthetic applications (train + validation + held-out combined), so you can feel the trade-off yourself before Step 5's held-out-only proof gives you the real accuracy claim.

– precision at this line of what you flag, how much is real fraud

– recall at this line of all real fraud, how much you catch

– F1 (balance of both) harmonic mean — punishes lopsided trade-offs

Next: Reweight the Signals →

03Reweight the Signals

The composite score isn't just the Isolation Forest's raw anomaly number — it's a weighted blend of five real signals, and the weights are yours to adjust.

Drag any slider to change how much that signal counts toward the composite score. The other sliders automatically rescale so the weights always sum to 1 — a real constraint, not a display trick — and every application's score, the threshold chart above, and Devon's score all recompute live using the exact weighted-sum formula in the evidence panel.

–flagged at current weights

–Devon's score right now

Next: Explore the Feature Space →

04Explore the Feature Space

Any two of the seven engineered signals can become the x/y axes below — not a fixed, permanently-chosen pair.

Pick an X-axis and a Y-axis from the dropdowns. The scatter re-renders using the real value of whichever two features you chose. Position is exact for those two dimensions only — color is never limited to 2D: every dot's color always reflects the full five-signal composite score (current weights included), computed from all seven engineered features, not an approximation of just the two you're viewing.

X axis Y axis

Position: exact on the two chosen axes. Color: exact full composite score across all 7 signals — nothing here is silently frozen or approximated.

Next: Verify the Proof →

05Verify the Proof

Everything above was exploration. This section is the actual evidence: what the model does on 141 applications it never saw while being built or tuned.

An analyst reviewing model output — 141 held-out applications, scored one at a time below — the same discipline used to produce every number in this panel.

Loading evidence…

Draw one held-out application at a time first, then run the whole set — this mirrors how the proof itself was computed: one application, scored, one at a time, never batch-approximated.

Once you've seen a few individually, run the complete held-out set and watch the running recall/precision converge on the exact numbers in the evidence panel above.

Full derivation (formulas, training procedure, threshold selection)

Isolation Forest anomaly score

Plain English: a point is anomalous if it takes very few random feature splits to separate it from everything else. The score turns "average number of splits to isolate this point" into a 0–1 number where higher means more anomalous.

s(x, n) = 2^{−E[h(x)] / c(n)}

s (x, n) = 2^{- \frac{E [h (x)]}{c (n)}}

Liu, Ting & Zhou (2008), the paper this method is from, defines c(n) — the normalizing constant — as the average binary-search-tree unsuccessful-search path length for n points:

c(n) = 2H(n−1) − 2(n−1)/n, H(i) ≈ ln(i) + 0.5772…

c (n) = 2 H (n - 1) - \frac{2 (n - 1)}{n}

Composite risk score (the Reweight-the-Signals formula)

Plain English: blend the standardized Isolation Forest score with four domain-specific FinCEN/Fannie Mae-grounded red-flag signals, weighted so the weights always sum to 1 — the same constraint the sliders enforce live.

composite(x) = w_iso·z_iso + w_ami·z_ami + w_dtigap·z_dtigap + w_vel·z_vel + w_addr·addr_flag, Σw = 1

composite (x) = w_{iso} \cdot z_{iso} + w_{ami} \cdot z_{ami} + w_{dtigap} \cdot z_{dtigap} + w_{vel} \cdot z_{vel} + w_{addr} \cdot addr_flag

Held-out recall (the proof's metric)

Plain English: of every genuinely fraudulent application in the held-out set, what fraction did the model actually flag?

recall = TP / (TP + FN)

recall = \frac{TP}{TP + FN}

Training procedure and threshold selection

sklearn.ensemble.IsolationForest, n_estimators=200, contamination="auto", random_state=20260824, fit on 563 training applications only, no fraud labels used in fitting — the entire point of an unsupervised method. The threshold is the 85th percentile of the composite score computed on that same training population before the 141-application held-out set was scored even once. This run's named self-deception risk is train/test leakage via held-out-set reuse: the Step 2 algorithm-selection bakeoff already used one held-out split to compare methods, so a second, differently-seeded split (never touched by that comparison or by model fitting) was carved out specifically for this proof — see the full write-up for the exact guard.

⬇ Download the complete technical write-up (Markdown)

Why trust this family of method at all? Isolation Forest is one of the most cited anomaly-detection algorithms in the field (Liu, Ting & Zhou 2008 has been cited thousands of times) and ships as a standard model in scikit-learn — it's already in production use for exactly this kind of rare-event scoring, including anomaly-based scoring integrated with classification models for Residential Mortgage-Backed Securities (RMBS) payment-risk prediction and widely in card-transaction fraud engines.

Next: Know the Limits →

06Know the Limits

Everything above is real. It is also incomplete on purpose — a model is only as trustworthy as what its builders admit it can't yet do. This step isn't a disclaimer in a footer; it's the same held-out discipline from Step 5, pointed at the demo's own methodology instead of at an application.

Read the algorithm-selection record below — pulled live from the same evidence payload Step 5 renders, word for word, not written separately for marketing purposes.

Loading the algorithm-selection record…

Four specific, named ways this run's proof can mislead a reader who stops at the headline recall number — each one is also in expected_failure_modes on the raw technical write-up, not softened for this page.

Loading known limitations…

Why show this at all? A technical buyer's next question after any accuracy number is always "where does this break?" Naming the answer first — specifically, not generically — is the fastest way to earn the benefit of the doubt on everything else on this page.

An underwriter has about forty seconds to decide whether the income someone just typed into a form is real.