PixSim: a calibrated open-source simulator of instant-payment fraud, recovery and interdiction under analyst capacity constraints

Bashir Zeimarani; Alireza Khatib; Somayeh Mousavinasr; Carlos Maurício Serodio Figueiredo

cs.LGSep 25, 2026

PixSim: a calibrated open-source simulator of instant-payment fraud, recovery and interdiction under analyst capacity constraints

Authors: Bashir Zeimarani, Alireza Khatib, Somayeh Mousavinasr, Carlos Maurício Serodio Figueiredo

Organizations: Instituto CERTI Amazônia, Manaus, Brazil · Universidade Federal do Amazonas, Manaus, Brazil · Universidade do Estado do Amazonas, Manaus, Brazil

Abstract

Brazil's Pix settles about 5.9 billion instant, irreversible transfers a month. A fraudulent transfer can be recovered only while the funds remain in a traceable account, and in 2025 the Central Bank's recovery mechanism (MED) returned 9% of accepted contested value. Interdiction therefore has to happen before settlement, by routing each transaction to pass, human review or block, under a finite analyst team and a regulatory hold window. To our knowledge no public simulator jointly models irreversible settlement, a regulated recovery mechanism, downstream fund dispersal and capacity-constrained review. We present PixSim, an open-source simulator of the Pix rail with these elements, calibrated to Banco Central do Brasil open data, with every parameter sourced, calibrated to one published observable, or registered as an assumption. With the model frozen, full-scale runs reproduce the 2025 recovery rate within 0.006 and its decomposition within 0.02; the February-April 2026 window is reported as a misfit and the May 2026 tracing regime as a projection. On a benchmark with a payer-side scorer, four reference policies and ten scenarios, within the simulated mule model: recovery after settlement is constrained by dispersal speed; staffing by the arrival profile cuts a fixed rule's alert expiry from 52% to 2% at constant hours; halving the team removes a fixed threshold-and-block rule's advantage over a queue-aware rule, on loss and on loss plus false-block harm (+0.106 of victim value, positive on all twenty paired seeds), while a reversal at two thirds of the team was not confirmed on independent seeds; and a synthetic scorer of held-out AUC 0.82 cuts lost value by about a quarter. Code and data: https://doi.org/10.5281/zenodo.22948895

Figures & tables

	MED 1.0	MED 2.0 without tracing	MED 2.0 with tracing
Window	2025	2 Feb–10 May 2026	from 11 May 2026
Legal basis	Res. BCB 1, Regulamento [ 2 ]	Res. BCB 493/2025 [ 21 ] ; optional from 23 Nov 2025, enforcement waiver to 10 May	Res. 493/2025; top-up until case closure from 1 Jul (Res. 559/2026 [ 22 ] )
Complaint opening	Institution channel, 1,800 s at p95	Self-service in the paying app, 300 s at p99	As without tracing
Block execution	After analysis, 24 h at p95	On registration of the infraction notification	As without tracing
Accounts blocked	Root only	Root only	Root and the accounts it forwarded to
Returns	Regulamento deadlines	6 h at p99	6 h at p99, sequential along the traced path

Table 1: The MED regimes distinguished by PixSim. Service levels are the regulatory ones; inter-PSP notification latency is one to three minutes in every regime [ 5 ] .

	Public-data	Irreversible	Regulated	Multi-hop	Analyst	Policy acts	Open
	calibration	settlement	recovery	dispersal	capacity	on the flow	code
PaySim [ 13 ]	– (private logs)	–	–	one hop	–	–	✓
AMLworld [ 14 ]	–	–	–	✓	–	–	data ∗
CardSim [ 15 ]	✓	–	–	–	–	–	✓
FiFAR / OpenL2D [ 7 ]	–	–	–	–	✓	–	✓
FALCON [ 23 ]	–	–	–	–	✓ (fatigue)	–	✓

Table 2: Mechanisms implemented by PixSim and the closest simulators and human-review frameworks, as described in the cited papers. ✓: implemented; –: not implemented. ∗ Generated datasets are public; public availability of the generator’s source code was not verified.

Figure 1: The PixSim pipeline. Transactions are scored and routed to pass, alert or block. Alerts wait in a finite analyst queue under the regulatory hold window and settle on expiry. Settled frauds enter the MED clock, whose outcome depends on the random recovery window set by dispersal speed against reporting delay. Queue state is part of the policy’s context.

Parameter	Target observable (2025)	BCB	Value	Bracket	Verified (SE)	Dist. (SE)
Uniform receiver share (A1.15)	Partial return share	0.0323	0.0357	[0.0356, 0.0359]	0.0315 (0.0034)	0.22
Cautelary block prob. (A3.12)	Cautelary route share	0.1774	0.267	[0.2656, 0.2688]	0.1736 (0.0060)	0.63
Active mule share (A3.22)	Full return share	0.0573	0.0830	[0.0820, 0.0840]	0.0572 (0.0042)	0.03
Mule burn probability (A2.21)	Victim transfers per root mule, monthly	3.19	0.168	[0.164, 0.172]	3.184 (0.032)	0.20
Dormant activity factor (A3.17)	(boundary)	–	0	[0, 0.0016]	–	–
Mean chain depth (A2.12)	none published	–	2.0 (assumed)	–	–	–

Table 3: Calibrated parameters (register id), the 2025 observable each was fitted to under the MED 1.0 rules, the final bisection bracket, and the six-seed held-out verification (mean, standard error, distance to target in standard errors). Brackets are search resolutions, not confidence intervals. Chain depth is assumed, not calibrated (see text).

	MED 1.0 (2025)		MED 2.0 no tracing (Feb–Apr 2026)		MED 2.0 tracing
Quantity	Simulated	BCB	Simulated	BCB	Simulated
Recovery rate (MED route)	$0.096\pm 0.001$	0.090	$0.114\pm 0.012$	0.142	$0.237\pm 0.005$
Returned in full	$0.060\pm 0.006$	0.057	$0.067\pm 0.015$	0.101	$0.097\pm 0.010$
Partial (returned)	$0.036\pm 0.005$	0.032	$0.047\pm 0.004$	0.040	$0.141\pm 0.008$
Not returned, all reasons	$0.595\pm 0.014$	0.613	$0.584\pm 0.016$	0.614	$0.407\pm 0.023$
of which no balance	–	0.523	–	0.519	–

Table 4: Three regimes at full scale (1.08 million accounts, every fraud of a 30-day world with its MED case followed to closure, real fraud rate, three seeds, no interdiction, world regenerated per regime; mean

\pm

sd), against the BCB statistics of the corresponding window. MED 1.0 is the calibrated regime; MED 2.0 without tracing is a stated misfit, never fitted; MED 2.0 with tracing is a projection at assumed depth 2.0 and MaxHops 2, with no published target. The simulator has one outcome for a case with nothing to block, so its “not returned” row is compared with the sum of the BCB’s no-balance, account-closed and other categories; the BCB’s no-balance share alone is shown beneath it. Columns sum to one.

Scenario	What changes	Seeds
S1 baseline	Profile staffing, full scorer, team of 6	20
S2 drift	Fraud mix, tickets and dispersal speed drift over 90 days	5
S4 half capacity	Team of 3	20
S5 flat staffing	Same analyst hours spread evenly over the day	5
S6 no DICT	Scorer without the DICT settlement statistics	10
S7 scorer quality	Full, no DICT, no amount features, logit noise $\sigma\in\{3,6,8,12,24\}$	3 per point

Table 5: Benchmark scenarios. All at full scale (1.08 million accounts, real fraud rate), 30-day parts after a 365-day burn-in of feature history, the first 10 days training the scorer and the remaining 20 forming the evaluation window (drift: 90-day parts, 20-day warm-up, 70-day window); MED 1.0 rules unless stated. Identifiers follow the repository, where S3 is unused.

Loss share
	Pass all	Budget thr.	Thr. + block	Capacity-aware
S1 baseline ( $n=20$ )	$0.785\pm 0.013$	$0.408\pm 0.017$	$\mathbf{0.121\pm 0.025}$	$0.221\pm 0.014$
S2 drift ( $n=5$ )	$0.730\pm 0.009$	$0.378\pm 0.006$	$\mathbf{0.110\pm 0.031}$	$0.195\pm 0.007$
S4 half capacity ( $n=20$ )	$0.785\pm 0.013$	$0.527\pm 0.015$	$0.320\pm 0.055$	$\mathbf{0.314\pm 0.017}$
S5 flat staffing ( $n=5$ )	$0.783\pm 0.009$	$0.434\pm 0.015$	$0.271\pm 0.018$	$\mathbf{0.267\pm 0.027}$
S6 no DICT ( $n=10$ )	$0.783\pm 0.010$	$0.479\pm 0.020$	$\mathbf{0.149\pm 0.021}$	$0.315\pm 0.021$

Table 6: Six-configuration summary on victim transfers, full scale, mean

\pm

sd over

n

seeds. Loss share is the fraction of victim value lost (the caught fraction and the other outcomes are in Table 9 ); expiry is the share of alerts that settled unresolved; loss plus harm adds the false-block harm (R$ 50 plus 2% of the amount per refused legitimate transfer) to lost victim value, both in reais, divided by victim value, and is the objective of Section 10 . Capacity-aware is the probability-space policy; the rank-space variant is in Appendix A .

Scenario	$n$	Paired difference	95% interval
S1 baseline	20	$-0.100$	$[-0.110,-0.091]$
S2 drift	5	$-0.086$	$-0.136$ to $-0.047^{\dagger}$
S6 no DICT	10	$-0.166$	$[-0.184,-0.149]$
S9 MED 2.0 no tracing	10	$-0.091$	$[-0.102,-0.080]$
S4 half capacity	20	$+0.006$	$[-0.019,+0.030]$
S5 flat staffing	5	$+0.004$	$-0.048$ to $+0.021^{\dagger}$

Table 7: Paired loss-share differences between threshold plus block and the capacity-aware policy (negative favours the fixed rule), with 95% percentile bootstrap intervals (10,000 resamples of paired seeds) for

n\geq 10

; † for the five-seed scenarios, the range of the five per-seed differences (same sign on all five seeds in S2, signs differ in S5). The last row is the difference-in-differences of S4 against S1 on their twenty shared seeds.

Loss share
Team	Budget	Thr.+block	Cap.-aware	Paired diff. (95% CI)	Expiry (T+B / CA)
6 (S1, seeds 1–10)	$0.406\pm 0.018$	$0.131\pm 0.016$	$0.220\pm 0.012$	$-0.089$ $[-0.095,-0.083]$	0.020 / 0.008
5	$0.420\pm 0.023$	$0.181\pm 0.027$	$0.224\pm 0.018$	$-0.044$ $[-0.056,-0.029]$	0.190 / 0.014
4	$0.440\pm 0.016$	$0.290\pm 0.035$	$0.244\pm 0.018$	$+0.046$ $[+0.031,+0.062]$	0.587 / 0.031
3 (S4, seeds 1–10)	$0.529\pm 0.017$	$0.341\pm 0.034$	$0.319\pm 0.021$	$+0.021$ $[-0.000,+0.043]$	0.772 / 0.117
Loss plus harm (share of victim value)

Table 8: Capacity sweep (S10 with S1 and S4) on the ten shared seeds 20260910–20260919, exploratory, with the four- and five-analyst results on ten independent confirmation seeds: loss share and loss plus harm by policy and team size, mean

\pm

sd, and the paired difference threshold plus block minus capacity-aware with its pointwise 95% percentile bootstrap interval (10,000 resamples of paired seeds). Pass all loses

0.783\pm 0.010

at every level, with no harm.

Scenario	Policy	Caught	Hop held	MED	Cautelary	Lost
S1 ( $n=20$ )	pass all	0	0	$0.065\pm 0.010$	$0.150\pm 0.009$	$0.785\pm 0.013$
	budget threshold	$0.324\pm 0.019$	$0.128\pm 0.013$	$0.038\pm 0.005$	$0.103\pm 0.011$	$0.408\pm 0.017$
	threshold + block	$0.565\pm 0.045$	$0.230\pm 0.030$	$0.019\pm 0.005$	$0.066\pm 0.013$	$0.121\pm 0.025$
	capacity-aware	$0.516\pm 0.030$	$0.163\pm 0.018$	$0.025\pm 0.005$	$0.075\pm 0.009$	$0.221\pm 0.014$
S4 ( $n=20$ )	pass all	0	0	$0.065\pm 0.010$	$0.150\pm 0.009$	$0.785\pm 0.013$
	budget threshold	$0.222\pm 0.016$	$0.084\pm 0.010$	$0.054\pm 0.008$	$0.114\pm 0.013$	$0.527\pm 0.015$

Table 9: Value waterfall on victim transfers, full scale, mean

\pm

sd over

n

seeds; each row sums to one; S2 and S9, whose loss shares are in Table 6 , are in the repository. Columns: caught before settlement; held at a hop (the transfer settled but the policy held or blocked its onward mule forward, leaving the value for the MED block); recovered via MED; recovered via cautelary block; lost.

Operating point of threshold plus block: alert precision on victim transfers / victim-value recall at the alert budget
Point	AUC ${}_{\text{held-out}}$	Budget	Thr.+block	Cap. (prob.)	Cap. (rank)
no amount features	$0.994\pm 0.003$	$0.058\pm 0.008$ / $0.66\pm 0.04$
no DICT statistics	$0.992\pm 0.001$	$0.028\pm 0.001$ / $0.43\pm 0.02$
full scorer	$0.941\pm 0.020$	$0.063\pm 0.005$ / $0.88\pm 0.06$
noise $\sigma=3$	$0.934\pm 0.023$	$0.050\pm 0.003$ / $0.69\pm 0.05$
noise $\sigma=6$	$0.902\pm 0.027$	$0.025\pm 0.002$ / $0.41\pm 0.10$

Table 10: Scenario S7, scorer-quality sweep, full scale, three seeds per point, ordered by held-out AUC on victim transfers in the evaluation window (mean

\pm

sd). The first block gives the operating point that the policies actually act on: precision among alerted victim transfers and the share of victim value alerted or blocked before settlement, under threshold plus block (Section 7.4 ). Pass all loses

0.782\pm 0.006

at every point, with no harm. Loss is mean

\pm

sd; the loss-plus-harm, expiry and false-block blocks are means. Loss plus harm is the objective of Section 10 ; it exceeds one where false-block harm exceeds the victim value at stake. Both capacity-aware definitions are shown because the sweep is where they differ.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Scenario	$n$	Probability-space	Rank-space	Paired difference
S1 baseline	20	$0.221\pm 0.014$	$0.233\pm 0.017$	$+0.012$ $[+0.005,+0.019]$
S2 drift	5	$0.195\pm 0.007$	$0.211\pm 0.011$	$+0.016$ , $-0.000$ to $+0.025^{\dagger}$
S4 half capacity	20	$0.314\pm 0.017$	$0.399\pm 0.019$	$+0.085$ $[+0.074,+0.096]$
S5 flat staffing	5	$0.267\pm 0.027$	$0.319\pm 0.034$	$+0.052$ , $+0.002$ to $+0.083^{\dagger}$
S6 no DICT	10	$0.315\pm 0.021$	$0.331\pm 0.021$	$+0.016$ $[+0.003,+0.029]$
S9 MED 2.0 no tracing	10	$0.204\pm 0.013$	$0.218\pm 0.015$	$+0.014$ $[+0.009,+0.019]$

Appendix

Table 11: Loss share of the rank-space capacity-aware policy against the probability-space one, mean

\pm

sd, with the paired difference (rank minus probability) and its 95% percentile bootstrap interval (10,000 resamples of paired seeds); † for the five-seed scenarios, the range of the per-seed differences (positive on four of five seeds in S2, on all five in S5).

Tables	Scenario (configuration)	Hash	Seeds	Parts
6 , 7 , 9 , 11 ; S7, S11, S10 reference	S1 baseline ( fullscale )	e4a21c75	20260910–20260929	20
6 , 7 , 11	S2 drift ( fullscale_drift )	8c80a08d	20260910–20260914	5
6 , 7 , 8 , 9 , 11	S4 half capacity ( fullscale_halfcap )	cb8130c9	20260910–20260929	20
6 , 7 , 9 , 11	S5 flat staffing ( fullscale_flat )	8533dca9	20260910–20260914	5
6 , 7 , 9 , 10 , 11	S6 no DICT ( fullscale_nodict )	b487ff4a	20260910–20260919	10
6 , 7 , 11	S9 MED 2.0 no tracing ( fullscale_s9_med2_notrace )	31e67de2	20260910–20260919	10

Appendix

Table 12: Full-scale runs behind every table: configuration, its hash, seeds and completed parts (all complete). Every part runs the five reference policies unless stated. A part shared by several tables is counted once: 155 distinct parts, plus twelve MED-clock validation cells without interdiction.

Financial Services

Financial services applies AI to banking, lending, payments, insurance, investment, and financial risk management.

See all 106 papers

Oct 24, 2026

FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy

Financial fraud caused over $15.9 billion in losses in the United States in 2025, according to the Federal Trade Commission~\citep{ftc2026databook}. Understanding such large-scale harm requires jointly modeling informational and financial dynamics. Yet existing simulators typically capture only one side of this interaction, leaving a gap in modeling how fraud unfolds in the real world. To bridge this gap, we introduce FraudSociety, the first LLM-agent-based simulator that jointly models these coupled dynamics. It integrates a dynamic social environment for information exposure and communication, persistent financial ledgers that preserve payment and loss histories, and a Need-Intent-Action architecture for civilian decision making. Fraudsters further adapt their communication and financial actions to individual interaction histories and ledger states, forming a closed feedback loop between the two dynamics. We validate FraudSociety across macro-level outcomes, micro-level behavior, and intervention effects. At the macro level, the simulated fraud outcomes closely match real-world patterns across multiple key statistics. At the micro level, it reproduces strong loss concentration, with the top 10% of victimization records accounting for 81.1% of total losses, consistent with Canadian Anti-Fraud Centre statistics~\citep{cafc2025annual}. Counter-fraud experiments further reveal variation across intervention strategies, with the best-performing personalized intervention reducing the repeat-payment rate from 49.4% to 10.9%. These results establish FraudSociety as both a high-fidelity simulator and a scalable testbed for evaluating anti-fraud strategies under diverse intervention conditions, thereby advancing research on financial fraud and its prevention.

Keyang Chen, Mingxuan Jiang, Zeping Li +10

Fudan University, Shanghai, China · University of Illinois Urbana-Champaign, Urbana, IL, USA

Financial Fraud Detection Agent-Based Modeling Large Language Model-Based Social Simulation Human Behavior Simulation

Ask PDF

Apr 16, 2026

Meituan Merchant Business Diagnosis via Policy-Guided Dual-Process User Simulation

Simulating group-level user behavior enables scalable counterfactual evaluation of merchant strategies without costly online experiments. However, building a trustworthy simulator faces two structural challenges. First, information incompleteness causes reasoning-based simulators to over-rationalize when unobserved factors such as offline context and implicit habits are missing. Second, mechanism duality requires capturing both interpretable preferences and implicit statistical regularities, which no single paradigm achieves alone. We propose Policy-Guided Hybrid Simulation (PGHS), a dual-process framework that mines transferable decision policies from behavioral trajectories and uses them as a shared alignment layer. This layer anchors an LLM-based reasoning branch that prevents over-rationalization and an ML-based fitting branch that absorbs implicit regularities. Group-level predictions from both branches are fused for complementary correction. We deploy PGHS on Meituan with 101 merchants and over 26,000 trajectories. PGHS achieves a group simulation error of 8.80%, improving over the best reasoning-based and fitting-based baselines by 45.8% and 40.9% respectively.

Ziyang Chen, Renbing Chen, Daowei Li +4

LongCat Interaction Team, Meituan Inc. Beijing, China · Independent Researcher Changsha, China

Human Behavior Simulation User Simulation

Ask PDF

Apr 13, 2026

Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering

AI agents that pay for resources via the x402 protocol embed payment metadata - resource URLs, descriptions, and reason strings - in every HTTP payment request. This metadata is transmitted to the payment server and to the centralised facilitator API before any on-chain settlement occurs; neither party is typically bound by a data processing agreement. We present presidio-hardened-x402, the first open-source middleware that intercepts x402 payment requests before transmission to detect and redact personally identifiable information (PII), enforce declarative spending policies, and block duplicate replay attempts. To evaluate the PII filter, we construct a labeled synthetic corpus of 2,000 x402 metadata triples spanning seven use-case categories, and run a 42-configuration precision/recall sweep across two detection modes (regex, NLP) and five confidence thresholds. The recommended configuration (mode=nlp, min_score=0.4, all entity types) achieves micro-F1 = 0.894 with precision 0.972, at a p99 latency of 5.73ms - well within the 50ms overhead budget. The middleware, corpus, and all experiment code are publicly available at https://github.com/presidio-v/presidio-hardened-x402.

Vladimir Stantchev

SRH University Heidelberg, Germany · PRESIDIO Group, Sofia, Bulgaria

AI Agent Security Safety Filtering PII Detection

Ask PDF

Abstract

Financial Services

Explore similar work

FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy

Meituan Merchant Business Diagnosis via Policy-Guided Dual-Process User Simulation

Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering