The technical blueprint for modern fraud detection

With Snowflake ML, customers such as VALID Systems and Neon are able to build robust fraud detection platforms that scale to the modern business demands because we provide the following benefits out of the box: 

• Low-latency predictions: Features served in under 10 ms with the Online Feature Store and models in under 100 ms from Snowflake Model Registry. 

• Integrated monitoring: The capacity to easily monitor, explain and receive alerts on performance and accuracy over time with built-in MLOps. 

• Security and governance: Unified data, features and models on a single platform, eliminating risks from egress of sensitive customer data.

Online ML capabilities, including online feature serving and model serving, are at the core of real-time fraud detection workflows. Today, we are thrilled to share that Snowflake’s Online Feature Store is now generally available, joining model serving for any production use case. Built on Snowflake Postgres, our Online Feature Store serves fresh, latency-sensitive ML signals — risk scores, activity patterns and behavioral features — to models at prediction time. These workloads require thousands of predictions per second, each needing features returned in milliseconds. The Online Feature Store is integrated directly with online model serving to easily generate low-latency fraud predictions.

Once the features are computed, the model is ready to be served in real time. For model serving, Snowflake deploys trained models as fully managed inference services on Snowpark Container Services (SPCS). Any model registered in the Snowflake Model Registry can be deployed with a single API call to a dedicated REST endpoint. The model service integrates directly with the Online Feature Store, and the service automatically fetches the latest features from the online store. This tight coupling between feature retrieval and model execution means a comprehensive fraud scoring decision — from feature lookup to prediction — happens in a single network round trip, minimizing network latency and external data movement.
 

Fraud is a growing problem that continues to drive compliance expenses higher year after year. Achieving regulatory compliance with effective, real-time fraud prevention has quickly become one of the financial services industry’s most critical and expensive challenges. Enterprise-ready fraud detection relies on robust machine learning infrastructure that continuously and dynamically analyzes transaction patterns, flags anomalies and adapts to emerging threats in real time.

Catching bad actors before a transaction clears requires production-grade infrastructure designed to detect fraud in milliseconds. In this blog post, we’ll dive into how Snowflake ML addresses these real-time challenges by unifying streaming features, low-latency model serving and MLOps on a single data and ML platform. In particular, we highlight the advantages of using Snowflake’s Online Feature Store (now generally available) to productionize fraud detection workflows by serving features in less than 10ms and enabling subsecond feature freshness from real time streaming events. 

Why it’s hard: The real challenges

For all financial institutions, there are three core challenges that make the fraud detection problem difficult to address at enterprise scale: latency of results for real-time transactions, the ever-changing landscape of fraud tactics, and the comprehensive security and governance requirements of sensitive customer and financial data. 

Addressing the latency problem

Most institutions struggle to detect fraud in real time because legacy batch pipelines and static rules engines cannot evaluate live transactions against fresh behavioral data within millisecond SLAs. Stopping fraud requires an architecture capable of delivering subsecond feature freshness. This includes using stream feature views to continuously ingest live events (e.g. logins, transactions) into a low-latency serving layer. During inference time, real-time feature views need to dynamically compute request-level metrics (e.g. comparing current transaction spend to a customer’s historical baseline). 

Monitoring model performance over time

Fraud models degrade as adversaries adapt. What detected synthetic identity fraud last quarter may miss the next generation of attacks this quarter. This is model drift — and most institutions discover it too late. Enterprises that are successful at monitoring performance over time have fully managed ML systems that are easy to develop, iterate and promote relevant features and models to production to seamlessly adapt to changes in the business.

Keeping all data secure and governed

For most legacy fraud detection systems, inference calls often send data to an external platform. Egress leads to governance risk level that may be unacceptable for regulated financial institutions. End-to-end data lineage and data governance are must-haves for a production fraud detection system that includes sensitive data.

These business challenges stem directly from traditional ML infrastructure limitations — and solving them requires an end-to-end, real-time ML platform built for enterprise scale.

What successful fraud detection looks like

VALID Systems helps financial institutions prevent fraud in real time across teller, ATM and mobile channels, guaranteeing over $6 billion in immediately available funds each month across more than 425 million unique accounts. 

After its legacy solution had reached its ceiling, VALID Systems rearchitected its fraud detection ML platform on Snowflake so that all features, training data, models and inference exist in one place, maintaining the same API contract with zero egress.

VALID’s models now optimize for the dollar value of the decisions they make, not just whether they got a row right or wrong. This shift in objective compounds performance. A small improvement targeting the highest-risk transactions outweighs a larger improvement spread evenly across all of them. Every tuning run is logged and fully auditable, so compliance teams get the documentation as a byproduct of the process instead of as an afterthought.

As a result of this new platform change, VALID achieved a 7%-10% drop in deposit loss rates and detected 15%-17% more bank fraud losses.
 

Another customer that has modernized fraud detection at scale is Neon, which is one of Brazil’s fastest-growing digital financial institutions serving over 27 million customers with payments and credit products. Every login, card payment, transfer and loan request first passes through Viper, Neon’s in-house fraud engine. Viper needs fresh behavioral features, such as transaction counts over windows from minutes to months, to make a decision in real time.

Neon’s previous feature store vendor Tecton was being discontinued, which gave the team a hard deadline. Neon evaluated several providers and picked Snowflake for four reasons: low latency, fresh streaming and real-time features, the same governance across online and offline features, a Pythonic developer experience, and more control with costs visible in one place.

In three months, the team rebuilt almost 300 features across eight fraud workflows on Snowflake Feature Store. As a result, Neon cut P99 feature latency from 140 ms to 72 ms, making it almost two times faster in Snowflake. Viper’s service availability rose from 99.7% to 99.9% increasing the Viper’s anti-fraud coverage.