Practice: Design Payment Fraud Detection
Real-time fraud detection with ML inference, feature store, and event streaming.
Build this system yourself on the canvas below. Add components, connect them, and run traffic simulations to see where your design holds up and where it breaks.
Functional requirements
- Score every payment transaction for fraud risk in real time before authorisation.
- Ingest raw transaction events from a Kafka stream at up to 50,000 events per second.
- Serve pre-computed user and merchant feature vectors from a low-latency feature store.
- Invoke an ML model endpoint to return a fraud probability score (0–1) per transaction.
- Apply configurable rule-based guardrails on top of the ML score for immediate blocking.
- Emit accept / review / block decisions to downstream payment processors.
- Store decision history for each transaction for audit, replay, and model retraining.
- Provide a case-management interface for fraud analysts to review flagged transactions.
- Support A/B model shadow-testing without affecting live decision throughput.
- Allow real-time rule updates by ops team without restarting the scoring pipeline.
Non-functional requirements
- Latency: fraud scoring decision must be returned within 50 ms at p99 to avoid blocking checkout.
- Throughput: sustain 50,000 transactions per second with headroom for 3× traffic spikes.
- Availability: 99.999% uptime; a system outage must default to a safe fallback (approve with flag).
- Accuracy: false positive rate below 0.5% to avoid blocking legitimate customers.
- Scalability: horizontally scalable scoring workers; feature store must handle 200,000 reads per second.
- Durability: every transaction event and decision persisted durably; no data loss on node failure.
- Consistency: feature values served must be no more than 60 seconds stale.
- Security: PCI-DSS compliant storage and transit encryption; strict role-based access to raw card data.
- Observability: real-time dashboards for decision distribution, model drift, and pipeline lag.
- Compliance: full audit trail retained for 7 years; GDPR-compliant data minimisation for stored features.
