Authenticated but deceived sender

Figure 01 / 12

The evaluated population

The cohort contains 28,000 authorized transfer attempts, of which 196 have the defined synthetic outcome: Synthetic scam-loss outcome. The outcome is known by construction here. In production, label uncertainty and selection must be recorded separately.

Figure data and text version

Outcome	Count
Synthetic scam-loss outcome	196
Other labeled outcomes	27,804

The real customer can use the real device and still send money because an attacker supplied a false story. Login success does not settle the payment’s intent.

Evaluate recipient context, behavioral changes, and the timing of a useful intervention.

All amounts, rates, capacity limits, and outcomes in this case are synthetic. The three conditions are separate assumptions for comparison. A better result in the response condition is not measured proof that the proposed control causes that improvement. The figures expose the calculation and its limits; a real deployment needs its own evidence.

Read the result

The rule flags 503 of 28,000 authorized transfer attempts. Of those flags, 169 meet the synthetic target, giving 33.6% precision. It misses 27 target events. Under the stated cost assumptions, residual loss and operating friction total $79,576. The important result is the connection between the population, action, capacity, and outcome—not one isolated score.

Figure 02 / 12

Four outcomes of the rule

The rule flags 169 synthetic positives and 334 negatives. It misses 27 positives. A flagged item is a decision to intervene; it is not proof of fraud, a legal prohibition, or any other real-world conclusion.

Figure data and text version

Known outcome	Flagged	Not flagged
Synthetic scam-loss outcome	169	27
Other outcome	334	27,470

Figure 03 / 12

Three rates with different denominators

Precision is 33.6%, recall is 86.22%, and the false-positive rate is 1.2%. Changing the denominator changes the meaning. This record keeps each numerator attached to the population from which it came.

Figure data and text version

Metric	Numerator	Denominator	Result
Precision	169	503	33.6%
Recall	169	196	86.22%
False-positive rate	334	27,804	1.2%

Figure 04 / 12

Precision changes with prevalence

This sensitivity plot holds recall at 86% and false-positive rate at 1.2%, then changes prevalence. It is an algebraic comparison, not a forecast. Even unchanged detection quality can produce a very different review queue when the base rate changes. Horizontal positions are the labeled observations or scenarios; equal spacing does not imply equal numerical increments.

Figure data and text version

Assumed prevalence	Precision %
0.1%	6.69
0.5%	26.48
1%	41.99
2%	59.39
5%	79.04
10%	88.84

Figure 05 / 12

The threshold trade-off

Six illustrative score bands use a stated pair of detection rates. Lower sensitivity can reduce false alarms but miss more target events. These points do not come from a trained model and do not establish the best operating threshold. Horizontal positions are the labeled observations or scenarios; equal spacing does not imply equal numerical increments.

Figure data and text version

Score band	True positives	False positives
Band 1	192	4,171
Band 2	184	2,224
Band 3	169	973
Band 4	141	334
Band 5	98	111
Band 6	49	28

Figure 06 / 12

A transparent loss-and-friction calculation

At $2600 severity per missed synthetic positive, residual loss is $70,200. Review costs $6,036; lost contribution on false alarms is $3,340. The calculation assumes intervention prevents all flagged-positive loss and each false alarm loses the stated contribution. Relax those assumptions before applying it to a real policy.

Figure data and text version

Cost component	USD
Missed-positive loss	70,200
Review cost	6,036
False-alarm contribution	3,340

Figure 07 / 12

Observed outcomes mature over time

The final synthetic positive count is 196. Earlier observations reveal only a stated fraction. Comparing a day-1 cohort with a day-30 cohort would confuse label age with control quality. This curve models observation delay only; it does not change the final outcome. Horizontal positions are the labeled observations or scenarios; equal spacing does not imply equal numerical increments.

Figure data and text version

Days after event	Observed positives
1	35
3	69
7	118
14	161
30	196

Figure 08 / 12

Review demand and available capacity

The flag count is 503. The comparison capacity is an illustrative 1,120 reviews per cohort window. A mathematical rule can be coherent while its resulting workload exceeds the operating team’s capacity. Capacity is not permission to ignore an applicable mandatory control.

Figure data and text version

Queue measure	Items
Flagged for review	503
Available capacity	1,120
Excess demand	0

Figure 09 / 12

A feature is an observation with provenance

This evidence contract supports separate unauthorized access from deception. A value needs its event time, arrival time, scope, and source. Keeping unavailable evidence distinct from a measured zero prevents an outage from becoming a falsely reassuring feature.

Figure data and text version

Field	Example	Meaning
entity_ref	Authenticated but deceived sender	Subject of this case
event_time	2026-09-18T09:00:00Z	When the event occurred
received_time	2026-09-18T09:00:02Z	When the system learned it
signal_status	repaired	Evidence quality, not an outcome
label_definition	Synthetic scam-loss outcome	The target used in these calculations

Figure 10 / 12

Missing evidence changes the observed population

The cells show an explicitly constructed completeness profile for three signal groups. The stress condition removes more history and device evidence. Missingness does not prove the target outcome; it changes what the decision process knows.

Figure data and text version

Signal group	Available	Missing
Identity evidence	27,860	140
Activity history	27,580	420
Context signal	27,160	840

Figure 11 / 12

Evidence, score, and action remain separate

The policy can use separate unauthorized access from deception only within its approved scope. The action record must retain which evidence was available, which model or rule ran, and which action was actually applied. The final action can differ from the score recommendation when a separate constraint applies.

Figure data and text version

Stage	Record
Observe	Authenticated but deceived sender: evidence as of the decision time
Evaluate	Rule flags 503 of 28,000 authorized transfer attempts
Apply	Record action, reason, owner, and expiry
Reconcile	Join the action to later outcomes without overwriting history

Figure 12 / 12

What the result cannot establish

Observed classifications do not reveal every counterfactual. The synthetic labels make arithmetic possible, but production decline data is selected by prior policy. Keep measured outcomes, assumed prevention, and unknown alternatives separate when reporting impact.

Figure data and text version

Claim	Evidence in this case	Limit
Detected target	169 known synthetic positives flagged	Production labels may be delayed or wrong
Prevented loss	Assumed 439,400 USD	Requires an intervention-effect assumption
Customer impact	334 synthetic negatives flagged	Not every flag causes abandonment
Unobserved alternative	Outcome without the action	Needs a valid evaluation design

Connect the result to the system

Evaluate recipient context, behavioral changes, and the timing of a useful intervention.

Check the population, evidence, permitted action, and actual effect together. A balanced calculation can still use the wrong population; a successful response can still leave an unknown financial outcome. The case’s numerical result applies only to its stated assumptions.