Learning Payment Fraud Sequences to Train Better Detectors

Why the sequence matters

Payment fraud detection is not just about spotting an unusual transaction. The relationship between successive attempts can also matter: what happened before, what response the payment system returned, and how the next attempt changed.

In an unreviewed preprint, Huilin He and colleagues from Tongji University, Ant International and East China Normal University introduce PaySeqGen. Their system generates synthetic payment sequences to supplement fraud-detector training. The central claim is that modeling responses to payment feedback can produce more useful examples than matching transaction attributes alone.

The researchers also use the model’s learned scores to highlight parts of real payment histories for analysts. These scores describe alignment with learned behavioral patterns, not proof of someone’s intentions.

Learning a reward from observed behavior

PaySeqGen uses inverse reinforcement learning. Ordinary reinforcement learning starts with a reward and learns which choices increase it. The inverse approach starts with observed choices and learns a reward that helps explain them.

Here, the demonstrations are payment histories whose target transactions were labeled fraudulent. A policy—the model’s rule for choosing the next payment—learns from those histories. Its choices include payment amount, waiting time, card, device and payment-context attributes.

Rather than consider every possible combination, the system constructs 64 candidate actions at each step. Most come from jointly observed changes in historical payments under similar conditions; the remainder explore alternative combinations subject to resource and time constraints. This balances resemblance to recorded behavior with some variation.

A separate feedback model approximates whether a generated payment would succeed or encounter a rejection or another failure. That response becomes part of the history used for the next decision. The feedback model remains fixed during training; the generator does not make real payment attempts.

The learned reward combines explicitly defined behavioral features with adjustable weights. It also includes interactions between prior feedback and subsequent actions. Consequently, the same action can receive a different score depending on what preceded it. Reward learning and policy optimization alternate until the policy can generate additional sequences for detector training.

What the reported tests show

The main dataset comes from an Ant International payment platform. It contains approximately 1.29 million users, 26.28 million distinct payment events and 3.46 million labeled detection examples. Target payments span March 2025 through January 2026. The authors report chronological training, validation and test splits, with generator demonstrations and sampling statistics drawn only from training data.

For the main comparison, synthetic fraud examples added approximately 2.5% to the original detector training-set size. On the production Transformer detector, PaySeqGen increased AUC, a measure of risk-ranking quality, by 0.393 percentage points. It increased Recall@2 by 1.621 points. Recall@2 measures the fraction of fraudulent examples captured within the highest-risk 2% of examples—not detection accuracy across all payments.

The results were not uniformly positive. On TabFormer, PaySeqGen’s Recall@2 remained 1.613 points below training without augmentation, although it performed better than the other augmentation approaches on that metric. XGBoost also showed small declines in recall and class separation.

The authors additionally report a 30-day online A/B evaluation involving two production detectors and a segment of payment traffic. Recall@2 rose from 40.66% to 43.85% for one detector and from 41.79% to 44.63% for the other. They attribute 393 additional detected fraudulent payments and US$9,738 in additional prevented losses to augmentation. Those operational figures are reported by the research team, not independently verified outcomes.

Interpretability without certainty

For analysis, PaySeqGen compares the reward of an observed action with the average reward of candidate alternatives under the same history. Feature contributions then show which modeled factors raised or lowered that relative score.

One illustrated pattern involved repeated failures, card changes and a subsequent lower payment amount. A rule derived from the example matched 3.95% of eligible fraud-target histories and 0.25% of legitimate-target histories in a validation cohort. That is an exploratory association, not a standalone fraud verdict; legitimate histories also matched.

Where the evidence stops

The strongest evidence comes from one provider’s payment environment. The feedback simulator approximates outcomes because underlying business information, including account balances, is not fully observable. Generated behavior therefore depends partly on that approximation.

A public-dataset evaluation gives a more cautious picture. That dataset lacked payment outcomes and reliable card/device identifiers, requiring a reduced version of the method. PaySeqGen lowered Recall@2 for all four detectors there, while improving some other metrics. The authors also note limited long histories and few fraud-target training windows.

The reported performance tables do not provide uncertainty intervals. Overall, the preprint supports a promising, context-dependent training approach—not a demonstrated universal improvement or a recovery of fraudsters’ true motives.