LinuxGod-dev/mpesa-fraud-demo

Fraud detection pipeline for mobile money — Isolation Forest + rule-based detectors across 5 fraud typologies, CEF alerting, 79% recall on synthetic data. # Mobile Money Fraud Detection — Simulation & Detection Engine **A SOC-style detection pipeline for mobile money fraud, built on synthetic data modeled on real fraud typologies reported in the Kenyan market.** ## Why this exists Payment fraud is now the leading category of cybercrime loss in Kenya. The 2025 Serianu Cybersecurity Report puts total cybercrime losses at KES 29.9 billion for the year, with real-time money transfers, weak transaction monitoring, and social engineering named as the primary drivers. Mobile money is the backbone of that risk surface — and the fraud patterns behind it (SIM-swap takeovers, agent float abuse, structuring, mule accounts) are well documented but not always well instrumented. This project asks a narrow question: **what would a first-pass detection layer for these patterns actually look like, and how well would it perform?** No real customer, account, or transaction data is used anywhere in this project — all data is synthetically generated to reflect publicly known fraud patterns. ## What it does 1. **Generates realistic transaction data** (`src/generate_data.py`) — 2,000 synthetic accounts, ~12,000 transactions over 30 days, with five labeled fraud typologies injected on top of normal behavior: - **SIM-swap takeover** — device/IMEI change immediately followed by a high-value transfer - **Velocity structuring** — multiple transfers in a short window, kept just under a reporting threshold - **Geo-impossible travel** — two transactions from the same account, too far apart to be physically possible in the time elapsed - **Agent float anomaly** — an agent processing an abnormal burst of deposits in a short window - **Mule account sweep** — many small inbound transfers followed by one large outbound withdrawal 2. **Detects fraud with two layers** (`src/detect.py`): - An **Isolation Forest** anomaly baseline over amount, time-of-day, and account transaction frequency — for catching statistical outliers you didn't explicitly des …