ChequeMark: An Ensemble Machine Learning Framework for After-Hours Business Deposit Fraud Detection
Organizations: Royal Bank of Canada
Abstract
Cheque fraud is a material risk in after-hours business deposit operations because funds may be released within one business day, while cheque clearing takes several days. This timing gap creates a fraud exposure window for financial institutions. Prior mitigation relies on static, deposit-level checks and therefore miss historical client behavior and evolving patterns. To address this gap, we propose a multi-view ensemble ML framework that combines: Extreme Gradient Boosting (XGBoost) for known fraud patterns, Isolation Forest for label-free anomaly detection, and Graph Sample and Aggregate (GraphSAGE) for relational patterns associated with transaction activities. We then combine the three outputs into a single client-level risk score. Under stable conditions, performance is comparable to XGBoost; under a targeted distribution shift, our framework performs best (F1: 83.77%, FPR: 0.69%) versus XGBoost (F1: 82.77%, FPR: 0.72%). These results indicate improved robustness to distribution shift while preserving interpretability through plain-language explanations grounded in behavioural, anomaly, and relational evidence.
Figures & tables
| Model | Precision | Recall | F1 | FPR |
|---|---|---|---|---|
| Proposed Method (Full Ensemble) | 0.8058 | 0.9432 | 0.8586 | 0.0063 |
| Predictive Component ( ) | 0.8058 | 0.9432 | 0.8691 | 0.0060 |
| Anomaly Component ( ) | 0.1359 | 0.1591 | 0.1466 | 0.0267 |
| Relational Component ( ) | 0.1456 | 0.1724 | 0.1579 | 0.0264 |
| Model | Precision | Recall | F1 | FPR |
|---|---|---|---|---|
| Proposed Method (Full Ensemble) | 0.7767 | 0.9091 | 0.8377 | 0.0069 |
| Predictive Component ( ) | 0.7670 | 0.8977 | 0.8272 | 0.0072 |
| Anomaly Component ( ) | 0.2039 | 0.2386 | 0.2199 | 0.0246 |
| Relational Component ( ) | 0.1553 | 0.1818 | 0.1675 | 0.0261 |
| Component | Latency | |
|---|---|---|
| ML Inference API Batch Scoring | ||
| End-to-end latency per batch | 2-3s | |
| - Database I/O | Included | |
| - Feature engineering | Included | |
| - Parallel model inference | Included | |
| Cache Performance |
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
| Parameter | Value | Description |
|---|---|---|
| learning_rate | 0.163 | Step size shrinkage for boosting |
| max_depth | 5 | Maximum tree depth |
| subsample | 0.951 | Fraction of samples per tree |
| colsample_bytree | 0.560 | Fraction of features per tree |
| scale_pos_weight | 38.8 | Class imbalance weight (neg/pos ratio) |
| objective | binary:logistic | Binary classification with logistic output |
| Parameter | Value | Description |
|---|---|---|
| n_estimators | 100 | Number of isolation trees |
| max_samples | 0.795 | Fraction of samples per tree |
| max_features | 0.495 | Fraction of features per tree |
| contamination | 0.03 | Expected fraud proportion (3% threshold) |
| n_jobs | -1 | Parallel processing (all cores) |
| random_state | 42 | Random seed for reproducibility |
| Parameter | Value | Description |
| Architecture | ||
| hidden_dim | 160 | Hidden layer dimension |
| embedding_dim | 48 | Final node embedding dimension |
| num_layers | 2 | Number of GraphSAGE layers |
| aggregator | hybrid | Max + mean + sum concatenation |
| activation | ReLU | Non-linear activation function |
Financial Fraud Detection
Financial fraud detection identifies suspicious transactions, accounts, claims, and behavior to prevent losses and guide investigation.
See all 139 papers