Learning what normal looks like
Fraud detection models work by learning the pattern of a customer's normal financial behavior, typical purchase amounts, merchants, locations, and times of day, and then flagging transactions that break sharply from that pattern. Some systems compare a transaction against the individual account's history, while others compare it against patterns learned across millions of accounts, catching fraud techniques that no single customer's history would reveal on its own. Because fraud tactics evolve constantly, these models are usually retrained often and combined with rule-based checks rather than relying on machine learning alone.
Speed matters as much as accuracy here. A fraud model protecting a card network or payment processor typically has to score a transaction in a fraction of a second, before the purchase is approved or declined, which constrains the kinds of models that can realistically be deployed in production.