Amazon Fraud Detector is no longer open to new customers as of November 7, 2025. For capabilities similar to Amazon Fraud Detector, explore Amazon SageMaker, AutoGluon, and AWS WAF. # What is Amazon Fraud Detector? Amazon Fraud Detector is a fully managed fraud detection service that automates the detection of potentially fraudulent activities online. These activities include unauthorized transactions and the creation of fake accounts. Amazon Fraud Detector works by using machine learning to analyze your data. It does this in a way that builds off of the seasoned expertise of more than 20 years of fraud detection at Amazon. You can use Amazon Fraud Detector to build customized fraud-detection models, add decision logic to interpret the model’s fraud evaluations, and assign outcomes such as pass or send for review for each possible fraud evaluation. With Amazon Fraud Detector, you don't need machine learning expertise to detect fraudulent activities. To get started, collect and prepare fraud data that you collected at your organization. Amazon Fraud Detector then uses this data to train, test, and deploy a custom fraud detection model on your behalf. As a part of this process, Amazon Fraud Detector uses machine learning models that have learned patterns of fraud from AWS and Amazon’s own fraud expertise to evaluate your fraud data and generate model scores and model performance data. You configure decision logic to interpret the model’s score and assign outcomes for how to deal with each fraud evaluation. # Benefits Amazon Fraud Detector provides the following benefits. These benefits make it possible for you to detect fraud fast without needing to invest the time and resources that are traditionally required to build and maintain a fraud management system. **Automated fraud model creation** Amazon Fraud Detector’s fraud detection models are fully automated machine learning models customized to meet your specific business needs. You can use Amazon Fraud Detector models to identify potential fraud in any online transactions such as new account creations, online payments, and guest checkout. Because fraud models are created through an automated process, you can forgo many of the steps associated with creating and training a model. These steps include data validation and enrichment, feature engineering, algorithm selection, hyperparameter tuning, and model deployment. To create a fraud detection model using Amazon Fraud Detector, you only upload your company’s historical fraud dataset and select the model type. Then, Amazon Fraud Detector automatically finds the most suitable fraud detection algorithm for your use case and creates the model. You do not need to know coding or have machine learning expertise to create fraud detection models. **Fraud models that evolve and learn** Fraud detection models must constantly evolve to keep up with the changing fraud landscape. Amazon Fraud Detector does this automatically by calculating information including account age, time since last activity, and activity count. The result is that your model learns the difference between trusted customers who frequently make transactions and the continued attempts typical of fraudsters. This helps to maintain the performance of your model longer between retraining sessions. **Fraud model performance visualization** After your model is trained using the data that you provide, Amazon Fraud Detector validates your model performance. It also provides visual tools for you to assess the performance. For each model that you train, you can see the model performance score, the score distribution graph, the confusion matrix, the threshold table, and all of the inputs that you provided ranked by their impact on model performance. Using these performance tools, you can learn how your model is performing and what inputs are driving your model performance. If required, you can tweak your model to improve its overall performance. **Fraud prediction** Amazon Fraud Detector generates fraud prediction for your organization’s business activities. Fraud prediction is an evaluation of a business activity for fraud risk. Amazon Fraud Detector generates predictions using the prediction logic with the data that's associated with the activity. You provided this data when you created your fraud detection model. You can get fraud predictions for a single activity in real time or get fraud predictions offline for a set of activities. **Fraud prediction explanation visualization** Amazon Fraud Detector generates prediction explanations as part of the fraud prediction process. Prediction explanations provide insight into how each data element used to train your model has impacted your model’s fraud prediction score. Prediction explanations are provided using the visual tools such as tables and graphs. You can use these tools to identify visually how much influence each data element has on the prediction scores. Then, you can use this information to analyze the fraud patterns across your data set and detect bias, if any. Last you can also use the prediction explanations to identify top risk indicators during a manual fraud investigation process. This helps you narrow down the root causes that lead to false positive predictions. **Rule-based actions** After your fraud detection model is trained you can add rules to take actions on the evaluated data, such as accept the data, send data for review, or collect more data. A rule is a condition that tells Amazon Fraud Detector how to interpret data during fraud prediction. For example, you can create a rule that flags suspicious customer accounts to be reviewed. You can set this rule to be initiated if both the detected model score is greater than your predetermined threshold and if the account payment’s authorization code (AUTH\$1CODE) isn’t valid. # Core concepts and terms The following is a list of core concepts and terms that are used in Amazon Fraud Detector: **Event** An event is your organization’s business activity that's evaluated for fraud risk. Amazon Fraud Detector generates fraud predictions for events. **Label** A label classifies a single event as fraudulent or legitimate. Labels are used to train machine learning models in Amazon Fraud Detector. **Entity** An entity represents who is performing the event. You provide entity ID as part of your company’s fraud data to indicate the specific entity who performed the event. **Event type** An event type defines the structure for an event sent to Amazon Fraud Detector. This includes the data sent as part of the event, the entity performing the event (such as a customer), and the labels that classify the event. Example event types include online payment transactions, account registrations, and authentication. **Entity type** An entity type classifies the entity. Example classifications include customer, merchant, or account. **Event dataset** The event dataset is your company’s historical data of a specific business activity or an event. For example, your company’s event might be online account registration. Data from a single event (registration) might include the associated IP address, email address, billing address, and event timestamp. You provide event dataset to Amazon Fraud Detector to create and train fraud detection models. **Model** A model is an output of machine learning algorithms. These algorithms are implemented in code and run on event data you provide. **Model type** The model type defines the algorithms, enrichments, and feature transformations that are used during model training. It also defines the data requirements to train the model. These definitions function to optimize your model for a specific type of fraud. You specify the model type to use when you create your model. **Model training** Model training is the process of using a provided event dataset to create a model that can predict fraudulent events. All steps in the model training process are fully automated. These steps include data validation, data transformation, feature engineering, algorithm selection, and model optimization. **Model score** Model score is the evaluation result of your company’s historical fraud data. During the model training process, Amazon Fraud Detector evaluates the dataset for fraudulent activities and generates a score between 0 and 1000. For this score, 0 represents low fraud risk whereas 1000 represents the highest fraud risk. The score itself is directly related to false positive rate (FPR). **Model version** A model version is an output from training a model. **Model deployment** Model deployment is a process for activating a model version and making it available for generating fraud predictions. **Amazon SageMaker AI model endpoint** In addition to building models using Amazon Fraud Detector, you can optionally use SageMaker AI-hosted model endpoints in Amazon Fraud Detector evaluations. For more information about building a model in SageMaker AI, see [Train a Model with Amazon SageMaker AI](https://docs.aws.amazon.com/en_pv/sagemaker/latest/dg/train-model). **Detector** A detector contains the detection logic such as the model and rules for a particular event that you want to evaluate for fraud. You create a detector using a model version. **Detector version** A detector can have multiple versions, with each version having a status of `Draft`, `Active`, or `Inactive`. Only one detector version can be in `Active` status at a time. **Variable** A variable represents a data element associated with an event that you want to use in a fraud prediction. Variables can either be sent with an event as part of a fraud prediction or derived, such as the output of an Amazon Fraud Detector model or Amazon SageMaker AI. **Rule** A rule is a condition that tells Amazon Fraud Detector how to interpret variable values during a fraud prediction. A rule consists of one or more variables, a logic expression, and one or more outcomes. The variables used in the rule must be part of the event dataset that the detector evaluates. Moreover each detector must have at least one rule associated with it. **Outcome** This is the result, or output, from a fraud prediction. Each rule that is used in a fraud prediction must specify one or more outcomes. **Fraud prediction** Fraud prediction is an evaluation of fraud for either a single event or a set of events. Amazon Fraud Detector generates fraud predictions for a single online event in real time by synchronously providing a model score and an outcome based on the rules. Amazon Fraud Detector generates fraud predictions for a set of events offline. You can use the predictions to perform an offline proof-of-concept, or to retrospectively evaluate fraud risk on an hourly, daily, or weekly basis. **Fraud prediction explanation** Fraud prediction explanations provide insight into how each variable impacted your model’s fraud prediction score. It provides information about how each variable influences the risk scores in terms of magnitude (ranging from 0 to 5 with 5 being highest) and direction (driving the score higher or lower). # How Amazon Fraud Detector works Amazon Fraud Detector builds a machine learning model that is customized to detect potential fraudulent online activities in your business. To get started, you provide your business use case. Depending on your business use case, Amazon Fraud Detector recommends a model type it will use to create a fraud detection model for you. In addition, it also provides insights into the data elements you need to provide as part of your business’s historical data. Amazon Fraud Detector uses the historical dataset to automatically create and train a customized model for you. The automated model training process involves choosing a machine learning algorithm that detects fraud for your specific business use case, validating the data you provided, and performing data manipulations to improve model performance. After training the model, Amazon Fraud Detector generates model scores and other model performance metrics. You can use the score and the performance metrics to evaluate model performance. If needed, you can add or remove data elements from the dataset you provided for training and retrain the model to improve the model score. After the model is created, trained, and activated, you need to configure decision logic, also known as rules, that tells the model how to interpret the data generated by your business, and assign outcomes for how to deal with interpretation of each activity. The outcomes can represent actions such as, approve or review the activity, or it can represent risk levels of the activity such as high risk, medium risk, and low risk. A detector is a container that holds your model and the associated rules. You will need to create, test, and deploy the detector to your production environment. The detector deployed in your production environment provides the fraud detection capability to your business applications. To perform fraud evaluation, the model compares all incoming data from your business activity with your business's historical data and uses its’ sophisticated machine learning algorithms with the rules you created to analyze the results and assign outcomes. With Amazon Fraud Detector, you can either evaluate data from a single business activity in real-time or evaluate data from multiple business activities offline. Let us say you have a business that has online funds transfer as one of its activities. You want to use Amazon Fraud Detector to detect fraudulent requests for funds transfer, in real time. To get started, you will need to first provide Amazon Fraud Detector with data from past fund transfer requests. Amazon Fraud Detector uses this data to create and train a model that is customized to detect fraudulent requests for fund transfers. And then, you create a detector by adding the model and by configuring rules for your model to interpret the data. An example of a rule for online funds transfer activity can be, if the request for funds transfer is coming from *xyz@example.com* email address, send the request for review. In your business’s production environment, when a request for fund transfer comes in, the model analyzes the data that came with the request and uses the rule to assign the outcome. You can then take an action on the request depending on the assigned outcome. Amazon Fraud Detector uses components such as, training dataset, model, detector, rules, and outcomes to provide your business with a fraud evaluation logic. For information about the workflow you'll use for detecting fraud using Amazon Fraud Detector, see [Detecting fraud with Amazon Fraud Detector](frauddetector-workflow.md) # Detecting fraud with Amazon Fraud Detector This section describes a typical workflow for detecting fraud with Amazon Fraud Detector. It also summarizes how you can accomplish those tasks. The following diagram provides a high-level view of the workflow for detecting fraud with Amazon Fraud Detector. ![\[Image of Amazon Fraud Detector fraud detection workflow\]](http://docs.aws.amazon.com/frauddetector/latest/ug/images/FraudDetectionWorkflowFinal.png) Fraud detection is a continuous process. After you deploy your model, make sure to evaluate its performance scores and metrics based on the prediction explanations. By doing so, you can identify top risk indicators, narrow down root causes that lead to false positives, and analyze fraud patterns across your dataset and detect bias, if any exist. To increase the accuracy of the predictions, you can tweak your dataset to include new or revised data. Then, you can retrain your model with the updated dataset. As more data becomes available, you continue retraining your model to increase accuracy. # Accessing Amazon Fraud Detector Amazon Fraud Detector is available in multiple AWS Regions and can be accessed using AWS interfaces. ## Availability Amazon Fraud Detector is available in the US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Asia Pacific (Singapore),and Asia Pacific (Sydney) AWS Regions. ## Interfaces You can create, train, deploy, test, run, and manage fraud detection models and detectors using any of the following interfaces: **AWS Management Console** - Amazon Fraud Detector provides a web-based user interface, the Amazon Fraud Detector console. If you signed up for an AWS account, you can access the Amazon Fraud Detector console. For more information, see [Set up Amazon Fraud Detector](https://docs.aws.amazon.com/frauddetector/latest/ug/set-up.html). **AWS Command Line Interface (AWS CLI)** - Provides an interface that you can use to interact with a broad set of AWS services, including Amazon Fraud Detector, using commands in your command-line shell. AWS CLI commands for Amazon Fraud Detector implement functionality that's equivalent to that provided by the Amazon Fraud Detector console. **AWS SDK ** - Provides language-specific APIs and manage many of the connection details, such as signature calculation, request retry handling, and error handling. For more information, go to [Tools to build AWS](http://aws.amazon.com/tools/) page, scroll down to the **SDK** section, and choose plus (\$1) sign to expand the section. **AWS CloudFormation** - Provides templates that you can use to define your Amazon Fraud Detector resources and properties. For more information, see [Amazon Fraud Detector resource type reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_FraudDetector.html) in the AWS CloudFormation User Guide. # Pricing With Amazon Fraud Detector, you pay only for what you use. There are no minimum fees or upfront commitments. You're charged based on the compute hours that are used to train and host your models, the amount of storage you use, and the quantity of fraud predictions that you make. For more information, see [Amazon Fraud Detector pricing](https://aws.amazon.com/fraud-detector/pricing/).