This content originally appeared on DEV Community and was authored by Victor Manuel Pinzon
On October 18 2025, I had the pleasure of giving a presentation at AWS Community Day about Transactional Fraud Detection using AWS SageMaker and Bedrock. The purpose of this post is to expand on the technical context of that presentation.
Why Fraud Detection Needs to Evolve
Transactional fraud detection is a key security priority for every bank and financial institution, helping to protect both customers’ trust and reputation as an organization. Banks process millions of transactions every day, each of which could be either legitimate or malicious.
Traditional machine learning models can classify transactions effectively, some better than others, but they fall short in explainability:
- Why was this transaction flagged?
- What features contributed most to the classification?
- How can we justify these decisiones to business, security or compliance teams?
That lack of interpretability creates friction among teams within the organization. This POC (Proof Of Concept) looks to bridge that gap by combining predictive Machine Learning and Generative AI.
Machine Learning meets GenAI: A Hybrid Architecture
During the AWS Community Day Guatemala 2025, I presented a live demo integrating:
- Amazon Sagemaker for Machine Learning model training and inference.
- Amazon Bedrock (Claude 3) for natural language and explanations.
- Gradio for a quick and interactive web interface.
The goal was to build an end-to-end pipeline where AWS SageMaker detects fraud transactions and explains why.
High-Level Architecture
Dataset
I used a dataset that was originally published on Kaggle. It contains 284,807 real transactions made by European cardholders over two day period on 2023, of which 492 were fraudulent (0.17%)
Due to confidentiality restrictions, all numerical features were transformed using the PCA method (Principal Component Analysis), which ensures privacy but preserves the statistical data, which means it has the same weight and meaning for the model.
For demonstration purposes, I created a balanced subset of the dataset and stored it in Amazon S3, which was sampled and preprocessed directly in AWS SageMaker. The main objective was to maintain this POC under the free tier but also maintaining the representative patterns of both legitimate and fraudulent behavior.
Pipeline overview:
- The dataset is downloaded from Kaggle and stored in Amazon S3.
- I created a balanced subset of the credit card transactions from Kaggle.
- A SageMaker XGBoost model is trained to classify fraud vs non-fraud trasactions.
- The model is stored in Amazon S3.
- For demonstration purposes, the model is loaded in a separate notebook which tests the model by ingesting it using a small sample. In a real life implementation, this would be a re-usable Lambda function.
- The function invokes Amazon Bedrock with a structure prompt describing key features of the transaction.
- Bedrock generates a human readable explanation.
- I created a Gradio interface that dispalys the prediction and the explanation interactively.
XGBoost Model
The Extreme Gradient Boosting (XGBoost) is a classical Machine Learning Model, which is a tree-based algorithm optimized for accuracy and performance. It works sequentially building decision trees, where each new tree corrects the residual errors of the previous ones. XGBoost is mostly used in fraud detection systems, recommendation systems, and dynamic pricing.
Model Training in SageMaker
The dataset contains 285,000 real life anonymized transaction with only 0.17% are fraud cases. This is not suitable for a fraud detection system because it creates a bias in the model. We need to feed the model with approved transaction as the same than fraudulent transaction.
So I first created a balanced subset:
def make_miniset(df, pd, ratio=1, seed=42):
fraud = df[df["Class"]==1]
normal = df[df["Class"]==0].sample(n=len(fraud)*ratio, random_state=seed)
mini = pd.concat([fraud, normal]).sample(frac=1, random_state=seed)
return mini
Then I trained an XGBoost classifier in Sagemaker
#Entrena el modelo XGBoost
model = XGBClassifier(
n_estimators=50, max_depth=4, learning_rate=0.1,
subsample=0.8, colsample_bytree=0.8, random_state=seed
)
model.fit(Xtr, ytr)
#Genera las prediciones acorde al modelo
yhat = model.predict(Xte)
The model reached 98.6% accuracy on the balanced dataset.
Model Training in SageMaker
Each transaction was enriched with contextual signals before invoking the LLM:
"""
Devuelve una lista de señales legibles para un registro.
"""
def derive_signals_from_row(row: pd.Series, stats: pd.DataFrame, v_cols: List[str]) -> List[str]:
signals: List[str] = []
# Monto
if "Amount" in row:
amount = float(row["Amount"])
signals.append(f"Monto {classify_amount(amount)} (~{amount:.2f}).")
# Hora
if "Time" in row:
hour, bucket = time_bucket(float(row["Time"]))
signals.append(f"Horario: {bucket} (~{hour:02d}:00).")
# Z Score
outs = []
for c in v_cols:
try:
z = abs(zscore(stats, c, float(row[c])))
if z > Z_THRESHOLD:
outs.append((c, round(z, 2)))
except Exception:
continue
outs.sort(key=lambda x: x[1], reverse=True)
if outs:
outs_txt = ", ".join([f"{c}(|z|~{z})" for c, z in outs[:3]])
signals.append(f"Componentes atípicos: {outs_txt}.")
return signals
Then, Bedrock (Claude 3) is called:
'''
Función encarga de generar el prompt a AWS Bedrock
'''
def explain_tx(br_client, model_id, tx_dict, prob, pred):
if pred == 1:
intent = "Explica brevemente (2-3) líneas por qué esta transacción podría ser fraudulenta."
else:
intent = "Explica brevemente (2-3) kíneas por qué esta transacción parece normal."
prompt = (
"Eres un analista de fraude bancario. "
f"{intent} "
f"Probabilidad de fraude: {prob:.2f}. "
f"Predicción del modelo: {'Fraude' if pred == 1 else 'Normal'}."
f"Datos: {tx_dict}"
)
body = {
"anthropic_version":"bedrock-2023-05-31",
"max_tokens": 320,
"messages":[{"role":"user","content":[{"type":"text","text":prompt}]}]
}
resp = br_client.invoke_model(
modelId=model_id, contentType="application/json",
accept="application/json", body=json.dumps(body)
)
out = json.loads(resp["body"].read())
return out["content"][0]["text"]
Output example
Con una probabilidad de fraude de 0.91 y una predicción del modelo de "Fraude", esta transacción presenta los siguientes signos de posible fraude:
- El monto de la transacción es alto, aproximadamente $451.27, lo cual puede ser un indicador de actividad sospechosa.
- La transacción se realizó en horario de madrugada, alrededor de las 00:00, lo cual es inusual para la mayoría de las actividades bancarias legítimas.
Estos factores, junto con la alta probabilidad de fraude y la predicción del modelo, sugieren que esta transacción debe ser revisada más a fondo para descartar o confirmar la presencia de actividades fraudulentas.
Output example (translation)
With a fraud probability of 0.91 and a model prediction of "Fraud", this transaction shows the following signs of potential fraudulent activity:
- The transaction amount is high — approximately $451.27, which may indicate suspicious behavior.
- The transaction occurred during early morning hours, around 00:00, which is unusual for most legitimate banking activities.
These factors, combined with the high fraud probability and the model’s prediction, suggest that this transaction should be further reviewed to confirm or rule out fraudulent activity.
Demo Interface
Results
- Accuracy: 98.6%
- Inference time: < 100ms
- Explanation time> 0.5 - 1 s via Bedrock
- Cost: Under free tier
Github Repositoy
Final Thoughts
Delivering this demo at AWS Community Day Guatemala 2025 was more than a presentation, it was a statement that explainability is the new challenge on AI.
As AI Systems become central to decision making, transparency isn't optional. It's the foundation for trust, compliance and adoption for any enterprise that wants to adopt AI.
This content originally appeared on DEV Community and was authored by Victor Manuel Pinzon
Victor Manuel Pinzon | Sciencx (2025-10-23T23:20:52+00:00) Building Explainable Fraud Detection With Amazon Sagemaker and Bedrock. Retrieved from https://www.scien.cx/2025/10/23/building-explainable-fraud-detection-with-amazon-sagemaker-and-bedrock/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.