Z-score, IQR and Isolation Forest against ground truth. IF has the best F1 (50.4%), catching amount, night-hour and frequency anomalies; Z-score is precise but cautious.
Volta — Anomaly Detection
Situation
Fraud/anomalies are a heavily imbalanced problem: detectors must be compared honestly against ground truth.
Task
My job was to compare the fraud and anomaly detectors honestly against ground truth, given how imbalanced the problem is and how easily the scores mislead.
Actions
Features: amount, hour, frequency.
Z-score, IQR, Isolation Forest; precision/recall/F1 against truth.
Result
Isolation Forest has the best F1 (50.4% , 401 detections).Z-score is precise but cautious: precision 80.5% at recall 24.7% (123 detections).IQR is a compromise but trails IF.
Recommendations
IF for broad screening, Z-score for high-precision alerts.
Monitor the ‘night hours × large amount’ clusters.
Calibrate the threshold to the acceptable false-positive rate.
Documentation
Charts Source: github.com/NikitaBoyarkin/volta-banking — 22 projects; figures recomputed from the repo's own datasets (data/*.csv) via its analysis scripts. Funnel counts from data/volta_funnel_data.csv (10,000 users); A/B, retention, segmentation, churn, RFM, CLV, attribution, anomalies, spend, support, NPS, JTBD, unit economics, premium, KYC deep-dive, referral, assisted CAC, FX sourcing, premium offers, anchor CAC and dormant win-back follow the published project narrative (README + part pages).
Anomaly detectors: precision / recall / F1 Three detectors compared against ground truth: Z-score, IQR and Isolation Forest. IF has the best F1.
0 50 100 Z-score — Precision: 80.5 80.5 IQR — Precision: 50.7 50.7 Isolation Forest — Precision: 50.4 50.4 Z-score — Recall: 24.7 24.7 IQR — Recall: 28.7 28.7 Isolation Forest — Recall: 50.4 50.4 Z-score — F1: 37.8 37.8 IQR — F1: 36.6 36.6 Isolation Forest — F1: 50.4 50.4 Z-score IQR Isolation Forest Method Metric, % Precision Recall F1 Key takeaways Isolation Forest has the best F1 (50.4%): it catches amount, night-hour and frequency anomalies (401 detections). Z-score is precise but cautious: precision 80.5% at recall 24.7% (123 detections). Anomalies: hour × amount 380 transactions (260 normal + 120 ground-truth anomalies) plotted as hour-of-day × amount (log10 €).
-1.68 8.32 18.32 0.33 1.33 2.33 3.33 Normal x=14, y=2.18 Normal x=18, y=0.87 Normal x=8, y=1.73 Normal x=20, y=1.81 Normal x=8, y=1.56 Normal x=15, y=2.52 Normal x=17, y=1.26 Normal x=12, y=2.18 Normal x=13, y=1.93 Normal x=17, y=1.5 Normal x=15, y=1.45 Normal x=9, y=1.38 Normal x=11, y=1.84 Normal x=14, y=1.34 Normal x=8, y=1.69 Normal x=20, y=1.11 Normal x=12, y=1.66 Normal x=16, y=2.44 Normal x=18, y=1 Normal x=13, y=1.71 Normal x=15, y=1.7 Normal x=18, y=1.39 Normal x=17, y=1.15 Normal x=20, y=0.99 Normal x=14, y=1.3 Normal x=13, y=1.72 Normal x=11, y=1.8 Normal x=10, y=2.42 Normal x=10, y=1.92 Normal x=12, y=2.43 Normal x=19, y=1.79 Normal x=16, y=1.18 Normal x=21, y=1.91 Normal x=17, y=1.29 Normal x=16, y=1.38 Normal x=11, y=1.99 Normal x=18, y=1.9 Normal x=20, y=1.35 Normal x=20, y=1.61 Normal x=15, y=1.54 Normal x=15, y=1.25 Normal x=15, y=1.54 Normal x=18, y=1.65 Normal x=9, y=1.63 Normal x=15, y=1.42 Normal x=19, y=1.19 Normal x=21, y=1.62 Normal x=11, y=1.56 Normal x=12, y=1.46 Normal x=10, y=1.14 Normal x=14, y=0.84 Normal x=20, y=1.58 Normal x=10, y=1.09 Normal x=17, y=1.42 Normal x=11, y=1.26 Normal x=21, y=1.78 Normal x=18, y=1.18 Normal x=16, y=1.63 Normal x=20, y=2.04 Normal x=13, y=2.09 Normal x=20, y=2.05 Normal x=17, y=1.67 Normal x=8, y=1.03 Normal x=16, y=1.97 Normal x=15, y=1.66 Normal x=19, y=1.53 Normal x=17, y=1.91 Normal x=18, y=1.67 Normal x=12, y=1.64 Normal x=17, y=1.39 Normal x=21, y=1.96 Normal x=20, y=1.22 Normal x=10, y=2.08 Normal x=18, y=1.61 Normal x=20, y=1.74 Normal x=9, y=1.91 Normal x=21, y=1.9 Normal x=17, y=1.29 Normal x=15, y=1.31 Normal x=14, y=1.6 Normal x=19, y=1.35 Normal x=21, y=1.52 Normal x=19, y=1.28 Normal x=13, y=1.34 Normal x=19, y=2.14 Normal x=19, y=1.62 Normal x=21, y=1.88 Normal x=15, y=1.1 Normal x=10, y=2.44 Normal x=13, y=1.91 Normal x=9, y=1.88 Normal x=16, y=1.24 Normal x=13, y=1.56 Normal x=21, y=1.75 Normal x=13, y=1.1 Normal x=8, y=1.73 Normal x=16, y=1.74 Normal x=17, y=1.35 Normal x=14, y=0.77 Normal x=15, y=1.76 Normal x=9, y=1.44 Normal x=13, y=1.56 Normal x=9, y=1.28 Normal x=18, y=2.19 Normal x=8, y=1.48 Normal x=13, y=1.48 Normal x=11, y=1.39 Normal x=19, y=2.03 Normal x=12, y=1.57 Normal x=20, y=1.57 Normal x=13, y=1.62 Normal x=16, y=1.26 Normal x=11, y=1.88 Normal x=16, y=1.74 Normal x=20, y=1.62 Normal x=21, y=1.24 Normal x=11, y=1.29 Normal x=16, y=1.51 Normal x=19, y=1.1 Normal x=21, y=1.41 Normal x=15, y=1.41 Normal x=12, y=2.28 Normal x=8, y=1.74 Normal x=9, y=1.51 Normal x=18, y=1.43 Normal x=9, y=1.29 Normal x=13, y=1.76 Normal x=13, y=1.2 Normal x=20, y=1.35 Normal x=13, y=0.96 Normal x=18, y=2.03 Normal x=11, y=1.72 Normal x=10, y=0.73 Normal x=19, y=1.59 Normal x=17, y=1.64 Normal x=13, y=2.14 Normal x=14, y=1.86 Normal x=8, y=1.83 Normal x=15, y=1.7 Normal x=17, y=0.94 Normal x=9, y=1.63 Normal x=16, y=1.24 Normal x=17, y=1.33 Normal x=8, y=1.52 Normal x=8, y=1.31 Normal x=18, y=2.2 Normal x=17, y=1.72 Normal x=12, y=1.18 Normal x=14, y=1.83 Normal x=21, y=1.36 Normal x=20, y=1.23 Normal x=19, y=1.91 Normal x=8, y=0.72 Normal x=11, y=1.61 Normal x=9, y=0.94 Normal x=8, y=1.75 Normal x=18, y=1.87 Normal x=11, y=1.25 Normal x=9, y=0.69 Normal x=21, y=1.59 Normal x=8, y=1.33 Normal x=11, y=1.47 Normal x=20, y=1.6 Normal x=20, y=2.28 Normal x=9, y=1.79 Normal x=21, y=1.76 Normal x=20, y=1.99 Normal x=19, y=1.98 Normal x=16, y=1.66 Normal x=9, y=1.03 Normal x=12, y=1.58 Normal x=12, y=1.97 Normal x=18, y=1.59 Normal x=10, y=1.62 Normal x=16, y=1.35 Normal x=16, y=0.98 Normal x=18, y=1.13 Normal x=9, y=1.78 Normal x=20, y=1.35 Normal x=13, y=1.77 Normal x=16, y=1.15 Normal x=20, y=1.2 Normal x=18, y=0.73 Normal x=11, y=2.04 Normal x=8, y=0.96 Normal x=8, y=1.26 Normal x=11, y=1.5 Normal x=8, y=2.09 Normal x=14, y=1.18 Normal x=13, y=1.58 Normal x=14, y=1.78 Normal x=12, y=1.55 Normal x=8, y=1.71 Normal x=10, y=1.04 Normal x=16, y=1.37 Normal x=12, y=1.92 Normal x=8, y=1.58 Normal x=11, y=0.68 Normal x=17, y=0.93 Normal x=18, y=2.32 Normal x=13, y=1.84 Normal x=8, y=2.62 Normal x=12, y=1.74 Normal x=13, y=1.85 Normal x=16, y=2.26 Normal x=12, y=0.86 Normal x=17, y=1.19 Normal x=14, y=1.71 Normal x=16, y=1.6 Normal x=13, y=1.63 Normal x=13, y=0.96 Normal x=17, y=1.98 Normal x=8, y=1.48 Normal x=8, y=1.32 Normal x=14, y=1.26 Normal x=14, y=1.46 Normal x=16, y=1.53 Normal x=20, y=1.54 Normal x=8, y=1.15 Normal x=13, y=1.98 Normal x=10, y=1.75 Normal x=8, y=1.69 Normal x=15, y=1.34 Normal x=9, y=1.28 Normal x=13, y=1.35 Normal x=17, y=1.23 Normal x=14, y=1.56 Normal x=15, y=1.56 Normal x=14, y=1.06 Normal x=18, y=0.72 Normal x=10, y=2.03 Normal x=15, y=1.63 Normal x=13, y=1.47 Normal x=13, y=1.85 Normal x=11, y=1.11 Normal x=19, y=1.82 Normal x=10, y=1.32 Normal x=15, y=1.7 Normal x=12, y=1.66 Normal x=8, y=1.57 Normal x=17, y=1.46 Normal x=16, y=1 Normal x=15, y=1.32 Normal x=8, y=1.84 Normal x=21, y=0.63 Normal x=14, y=1.59 Normal x=18, y=1.19 Normal x=12, y=1.54 Normal x=12, y=1.51 Normal x=12, y=2.12 Normal x=13, y=1.22 Normal x=14, y=1.68 Normal x=14, y=0.83 Normal x=8, y=1.82 Normal x=8, y=1.86 Normal x=12, y=1.54 Normal x=13, y=1.61 Normal x=14, y=1.11 Normal x=12, y=1.36 Normal x=11, y=1.73 Anomaly x=11, y=1.1 Anomaly x=0, y=1.81 Anomaly x=2, y=1.93 Anomaly x=1, y=1.82 Anomaly x=2, y=1.08 Anomaly x=0, y=1.39 Anomaly x=14, y=2.56 Anomaly x=3, y=1.33 Anomaly x=12, y=2.7 Anomaly x=0, y=1.79 Anomaly x=14, y=2.41 Anomaly x=0, y=1.21 Anomaly x=10, y=2.18 Anomaly x=21, y=1.41 Anomaly x=9, y=1.22 Anomaly x=0, y=2.09 Anomaly x=13, y=2.72 Anomaly x=18, y=3.05 Anomaly x=11, y=2.12 Anomaly x=16, y=1.32 Anomaly x=3, y=1.47 Anomaly x=3, y=1.65 Anomaly x=11, y=1.8 Anomaly x=15, y=0.84 Anomaly x=0, y=1.59 Anomaly x=2, y=1.9 Anomaly x=11, y=2.82 Anomaly x=18, y=2.37 Anomaly x=12, y=1.39 Anomaly x=3, y=0.87 Anomaly x=16, y=1.38 Anomaly x=11, y=1.19 Anomaly x=2, y=1.2 Anomaly x=19, y=1.78 Anomaly x=13, y=1.58 Anomaly x=0, y=1.89 Anomaly x=1, y=1.48 Anomaly x=18, y=3.51 Anomaly x=12, y=2.69 Anomaly x=13, y=1.69 Anomaly x=8, y=1.48 Anomaly x=2, y=1.36 Anomaly x=3, y=1.64 Anomaly x=0, y=0.79 Anomaly x=0, y=1.37 Anomaly x=17, y=3.23 Anomaly x=21, y=2.28 Anomaly x=10, y=1.56 Anomaly x=14, y=1.36 Anomaly x=2, y=1.34 Anomaly x=11, y=1.97 Anomaly x=15, y=2.93 Anomaly x=18, y=1.88 Anomaly x=18, y=2.59 Anomaly x=3, y=1.73 Anomaly x=13, y=1.78 Anomaly x=15, y=2.73 Anomaly x=11, y=3.5 Anomaly x=18, y=2.36 Anomaly x=8, y=2.87 Anomaly x=11, y=1.47 Anomaly x=0, y=1.34 Anomaly x=19, y=2.2 Anomaly x=8, y=2.68 Anomaly x=2, y=1.45 Anomaly x=17, y=2.79 Anomaly x=17, y=2.58 Anomaly x=3, y=1.24 Anomaly x=11, y=2.77 Anomaly x=1, y=1.46 Anomaly x=9, y=0.57 Anomaly x=16, y=1.38 Anomaly x=19, y=0.85 Anomaly x=19, y=2.75 Anomaly x=0, y=2.16 Anomaly x=12, y=1.32 Anomaly x=17, y=2.68 Anomaly x=8, y=1.8 Anomaly x=18, y=1.86 Anomaly x=12, y=2.6 Anomaly x=21, y=3.63 Anomaly x=18, y=1.76 Anomaly x=0, y=1.92 Anomaly x=0, y=1.44 Anomaly x=11, y=1.71 Anomaly x=8, y=1.42 Anomaly x=12, y=2.49 Anomaly x=17, y=2.78 Anomaly x=14, y=1.93 Anomaly x=0, y=1.59 Anomaly x=16, y=0.94 Anomaly x=15, y=1.57 Anomaly x=9, y=2.81 Anomaly x=19, y=0.96 Anomaly x=11, y=2.73 Anomaly x=10, y=2.99 Anomaly x=14, y=2.43 Anomaly x=21, y=3.22 Anomaly x=2, y=1.18 Anomaly x=13, y=2.02 Anomaly x=11, y=1.43 Anomaly x=19, y=1.73 Anomaly x=1, y=1.77 Anomaly x=10, y=2.36 Anomaly x=20, y=1.89 Anomaly x=18, y=2.26 Anomaly x=9, y=1.28 Anomaly x=18, y=2.68 Anomaly x=19, y=1.51 Anomaly x=18, y=2.66 Anomaly x=21, y=1.62 Anomaly x=12, y=1.36 Anomaly x=0, y=1.23 Anomaly x=19, y=1.25 Anomaly x=17, y=1.52 Anomaly x=20, y=1.2 Anomaly x=17, y=1.43 Anomaly x=10, y=2.15 Anomaly x=9, y=1.74 Anomaly x=8, y=2.62 Hour of day amount (log10 €) Normal Anomaly Key takeaways Anomalies cluster at night and at large amounts — Isolation Forest reaches 50.4% F1. Some anomalies are “small but unusual in time”: amount alone is not enough — Isolation Forest makes 401 detections.