Case StudyWeb · FinTech · AI

TrustGuard — Real-Time Fraud Risk Portal

Blocking fraud is easy. Blocking it without blocking your best customers is hard. TrustGuard scores every payment with XGBoost, explains it in plain English, and routes it to allow, review or block.

Live demo Source Blog post

TrustGuard — Real-Time Fraud Risk Portal

02Artifacts02

03Problems & Resolutions

Friction

Silent model miscalibration

The model was trained under a different XGBoost version than the one serving it, so ordinary payments scored as high-risk.

Resolution

Retrained under the serving version

I retrained the model under the same XGBoost version that serves it, which restored sane scores for normal traffic.

Friction

Scores clipping at 100

Adding rule points straight onto the ML score pushed moderate and certain-fraud transactions to the same ceiling, so the score lost meaning.

Resolution

Diminishing-returns scoring

Rules now use only the remaining headroom to 1.0, so scores stay meaningful even with several rule hits.

Friction

A noisy graph rule

A graph-reachability rule looked promising but fired on 85.6% of synthetic traffic at only 2.2% precision.

Resolution

Measured, then documented

I benchmarked the noisy rule and recorded its weakness instead of shipping it on faith.

04Outcomes

3
Services: 9
Scoring rules: 7
Live ML features: 33% → 16%
False positives (synthetic benchmark)

NextBulk Pdf Grabber Extension

All projects

The Problem

Blocking fraud is easy. Blocking fraud without blocking your best customers is the hard part.

Risk analysts at banks and payment companies deal with this trade-off every day. Let fraud through, and money is lost. Block real customers, and trust is lost. When someone asks "why was this payment flagged?", the honest answer is often "the model said so."

The Solution

TrustGuard is a real-time fraud-risk platform for the Sri Lankan payments market. Every decision comes with its reasoning attached.

Access: the analyst login is restricted. Contact me for a walkthrough.

The flow: Transaction in → ML score → local rules → plain-English reasons → Allow / Review / Block

How scoring works

ML layer: an XGBoost model scores each transaction using 7 live features: amount, amount-to-average ratio, merchant average, merchant chargeback rate, hour of day, new-device flag and 5-minute velocity.

Explanation: SHAP turns the model's reasoning into a plain-English factor list, so analysts never see raw log-odds.

Rules layer: 9 Sri Lanka-specific rules add context the model can't see, such as new merchants, mobile-wallet bursts, off-hours card use and shared devices or IPs.

Combination: rules can only spend the score's remaining headroom (ruleSum × (1 − mlScore)), so scores stay informative instead of clipping at 100.

Decision: configurable thresholds route the transaction to Allow, Review or Block.

Service	Tech	Role
`ml-service`	Python, FastAPI, XGBoost, SHAP	Scores a transaction and explains the score
`backend`	Java 17, Spring Boot	REST API, JWT auth, rules engine, persistence, notifications
`frontend`	React 19, TypeScript, Vite, Tailwind v4	Dashboard for risk analysts

Service

Tech

Role

ml-service

Python, FastAPI, XGBoost, SHAP

Scores a transaction and explains the score

backend

Java 17, Spring Boot

REST API, JWT auth, rules engine, persistence, notifications

frontend

React 19, TypeScript, Vite, Tailwind v4

Dashboard for risk analysts

What I built

Live Risk Feed, Flagged Queue with case statuses and investigation notes, and Transaction Detail with a full score breakdown

Shared Identity Network: a rendered graph showing devices and IPs reused across merchants

Payer Checkout demo that warns before a risky payment commits

Analytics with precision, recall and F1 from analyst-confirmed outcomes, plus model-drift monitoring

In-app and email fraud alerts, a command palette and a light/dark theme

JUnit and Vitest tests, Docker Compose, and GitHub Actions CI/CD to AWS EC2

TrustGuard — Real-Time Fraud Risk Portal