Data Real time streaming and Event Processing

MoneyLion’s North Star Goal

MoneyLion partnered with Analyze Agency to build a real-time fraud prevention architecture focused on stopping fraudulent activity before funds moved. The objective was clear from an engineering standpoint: shift fraud detection from batch-based, post-loss analysis to low-latency, event-driven decisioning. Production data was hosted in AWS RDS, with critical fraud signals distributed across IP tracking systems, card transaction metadata, customer behavioral analytics, and multiple third-party risk providers.

‍

The technical challenge was not data availability but data velocity and unification. Fraud signals lived in separate systems and were evaluated asynchronously, creating detection gaps. Analyze Agency worked with MoneyLion’s data and engineering teams to design a streaming architecture that captured database changes, enriched events in flight, and applied risk scoring in real time. Every login, ACH request, transaction, and credit event became a streaming event that could be evaluated within milliseconds.

‍

The north star metric was the percentage of fraudulent attempts blocked pre-transaction without increasing false positives. By moving to real-time event processing, MoneyLion reduced charge-offs, limited reimbursement exposure, and lowered operational investigation costs. At the same time, the system preserved a seamless customer experience, enabling the company to protect margins while continuing to scale.

‍

The Problem

MoneyLion saw a steady rise in sophisticated fraud schemes targeting its digital platforms across U.S. Identity theft and synthetic identities were used to open accounts and access credit products with no intention of repayment. Account takeover attempts increased, exposing legitimate customers to unauthorized transfers and creating costly reimbursement obligations. Authorized push payment scams and ACH fraud further added to loss volumes, while money mule networks exploited the speed of digital onboarding to move illicit funds through the platform.

‍

These fraud patterns weren’t just isolated incidents they directly impacted profitability. Charge-offs from fraudulent loans, operational costs tied to investigations and customer remediation, higher risk reserves, and growing compliance pressure all weighed margins. Beyond the financial losses, fraud also affected customer trust and increased friction in onboarding and underwriting. Addressing these challenges became critical not only to protect revenue, but to preserve customer experience and support sustainable growth.

‍

Evolution of Client’s stack with Analyze Agency (solution)

MoneyLion transformed its approach to fraud detection from a reactive investigative model into a system capable of preventing fraudulent activity in real time at the point of transaction.

‍

Previously, MoneyLion relied on a legacy system that conducted batch fraud checks every 4–6 hours, reviewing transactions long after customers had completed their purchases. Fraud analysts often identified suspicious activity 12–24 hours later, after funds had already been transferred. The system also generated more than 200 manual reviews per day because it lacked contextual awareness. For example, legitimate customers traveling overseas frequently triggered false positive hours after transactions occurred, leading to account freezes and customer frustration.

‍

As new fraud patterns emerged, updating detection rules required engineering deployment cycles lasting two to three weeks. By the time new defenses were implemented, significant financial losses had often already occurred. This reactive approach was common across much of the fintech industry detecting fraud only in hindsight rather than preventing it before it happened.

‍

To shift from post-incident analysis to live fraud prevention, the team built a real-time architecture using Kafka and Apache Flink. Now, whenever a customer swipes a card, the system instantly enriches the transaction with data from five sources of transactional history, IP geolocation, external card risk scores, merchant processor signals, and behavioral patterns. These signals are correlated in under 50 milliseconds, enabling risk decisions to be made before the payment terminal even displays the result.

‍

The new architecture is also highly adaptive. Fraud analysts can adjust detection thresholds through configuration changes that take effect within minutes rather than weeks. Flink’s pattern-matching capabilities can automatically identify evolving attack sequences without requiring manual rule updates. Borderline transactions (risk scores between 70 and 85) are routed through a rapid human review process, and analyst feedback continuously improves detection rules moving updates from a quarterly cycle to a daily one.

‍

With this shift, MoneyLion moved from reactive cleanup to proactive defense blocking fraudulent activity before funds leave customer accounts, delivering real-time alerts via SMS, and providing immediate visibility into active attacks. The results were significant for a 78% reduction in financial losses, a 60% decrease in false positives, and exactly once processing guarantees that meet financial compliance requirements. Legitimate customers experience seamless transactions, while fraudulent attempts are stopped at checkout.

‍

Architecture

The fraud detection system is built as a real-time streaming architecture that identifies suspicious transactions before funds are transferred. Data flows in from several sources, including AWS RDS (PostgreSQL) for transactions, the IPstack API for geolocation insights, the Sift API for fraud risk scores, the Mixpanel API for user behavior, and Marqeta’s card processor for authorization data. These inputs are streamed into Apache Kafka, which acts as the central pipeline, with separate topics for each type of event.

‍

Apache Flink processes these streams in real time, joining events using transaction and user IDs. It applies checks such as transaction velocity, geographic anomalies, and suspicious behavioral patterns to calculate a fraud risk score for each transaction.

‍

Based on the score, the system determines the next action. High-risk transactions are blocked immediately, while medium-risk ones trigger alerts for review. Decisions are published to a Kafka fraud_decision topic, where downstream services handle transaction blocking and notifications through AWS SNS/SES.

‍

Designed for low latency and high throughput, the architecture enables fraud decisions to be made within milliseconds. By combining multiple signals and processing them in real time, the system significantly reduces fraud while minimizing disruptions for legitimate customers.

Implementation  

MoneyLion needed to identify fraudulent transactions in under 50 milliseconds, right before the customer gets approved at the checkout. To accommodate this requirement, we at Analyze Agency designed and implemented a modern streaming architecture built on Apache Kafka and Apache Flink which enabled the processing of 50K transactions per second with 99.99% uptime. Since the existing infrastructure was already on AWS (RDS databases, Lambda functions, S3 storage), we achieved almost a 40% decrease in implementation time.
‍

Challenges Faced:

• Data Silos Problem: MoneyLion was holding its fraud data across 5 disjoint systems: IPstack for geolocation, Sift for risk scores, Marqeta for card processing, and Mixpanel for user behavior. No single system could view the full picture of fraud.

• Trade-off Between Speed and Accuracy: Payment processors do not give more than 200-500 ms to approve/decline transactions. We needed to make real-time decisions without compromising fraud detection rates.

• Integration Complexity: Response times (50-300 ms), rate limits, and data response formats were completely different for each external API (IPstack, Sift, Mixpanel), making real-time integration challenging.

‍

Our implementation plan was rolled out in phases, with each phase building a strong foundation for the next one.

‍

Phase 1: Weeks 1-6

• Implemented central Kafka "transactions" topic as single source of truth

• Built and deployed three Lambda functions for data enrichment from external APIs

‍

Phase 2: Weeks 7-13

• Deployed Apache Flink to process 5 data streams simultaneously

• Built fraud detection rules: velocity checks, geo-anomaly detection, pattern matching

‍

Phase 3: Actions & Monitoring (Weeks 14-20)

• Implemented three action services: Block (high risk), Alert (medium risk), and Store (analytics)

• Integrated with SNS/SES for instant SMS/email notifications

• Designed dashboards for the fraud team for real-time monitoring

‍

Phase 4: Testing & Go-Live (Weeks 21-25)

• Shadow mode testing (2 weeks): Ran the new system in parallel with the old one, with no effect on customers

• Performance tuning: Optimized Flink processing latency to 10-50 ms

• Gradual rollout with phased traffic release over one week

‍

Evaluation of the Model  

Over 2 million historical transactions with known outcomes (legitimate vs. fraudulent) were used in a 3-month pilot trial to rigorously evaluate the fraud detection system. We calculated precision (what percentage of blocked transactions was fraud) at 89 percent and recall (what percentage of actual fraud was caught) at 95 percent, beating the legacy batch system hands down. The rule-based engine weights multiple signals by their correlation with historical fraud, so it considers velocity patterns, geo-anomalies, amount thresholds and external risk scores from Sift. Then we carried out A/B testing against 10 percent of the live traffic, pitting this new system against the previous one and discovered a 60 percent reduction in false positives (consumers who were good customers being blocked incorrectly), all without significant impact on fraud catch rates. After production deployment, all decisions are monitored daily through automated dashboard visualizations by the fraud analytics team to detect edge cases where rules need adjustment. Every single blocked transaction gets audited in 24 hours, and learnings feed back into the adjustment of rules. We also monitor any near-miss cases (levels 70-85) where the transactions would have been permitted, but they had some suspicious patterns; this indicates proactive rule update. The system is re-assessed on a quarterly basis against changing fraud trends, also adjusting the thresholds of the rules dynamically according to seasonal conditions (for example holiday shopping spikes, tax refund cycle). This helped us achieve:

• Latency: End to end sub 500ms (card swipe → decision)

• Throughput: 50,000+ transactions/second capacity

• False Positives: Down 60% (blocking of valid customers)

• Fraud Detection: 95%+ accuracy on known fraud patterns

• Availability: Automatic failover with 99.99% uptime

‍

Future Priorities

The current real-time fraud detection system is expected to significantly reduce loss rates, charge-offs, and reimbursement exposure. However, fraud patterns continue to evolve, and static defenses degrade over time. Recognizing this, MoneyLion’s leadership aligned on a broader strategy: treat fraud prevention not as a fixed solution, but as a continuously improving data product.

‍

One strategic priority is to externalize parts of the fraud detection framework to other banks and lenders that are not direct competitors. By exposing risk scoring capabilities, event-driven decisioning, or shared fraud intelligence signals through secure APIs, MoneyLion can both create a new revenue stream and strengthen collective defense. A broader fraud signal network increases pattern visibility, improves detection accuracy, and reduces blind spots that single institutions face when operating in isolation.

‍

In parallel, MoneyLion plans to further enrich its internal models with third-party data sources, including expanded identity intelligence, consortium fraud data, device reputation networks, and behavioral risk signals. Integrating these datasets into the existing streaming architecture will allow real-time enrichment at the event level, improving precision without introducing latency. The long-term objective is to continuously increase pre-transaction fraud prevention rates while maintaining low friction for legitimate users and preserving scalable growth.

‍

Why Choose Us?

Analyze Agency operates at the intersection of data engineering, real-time systems, and fraud analytics. We do not deliver slide decks or theoretical architectures. We design and implement production-grade streaming systems that operate under real-world constraints such as latency, scale, compliance, and evolving fraud patterns.

‍

In the MoneyLion engagement, we worked directly with production AWS RDS environments, transaction data, IP intelligence, behavioral signals, and third-party risk feeds. Our focus was on unifying fragmented signals into a low-latency event-driven pipeline capable of pre-transaction risk evaluation. The outcome was measurable: reduced fraud losses, lower operational overhead, and improved customer trust without increasing friction.

‍

We understand that fraud prevention is not a one-time deployment. It is an evolving system that requires scalable architecture, continuous signal enrichment, and measurable performance metrics. That is the standard we build to.

‍

Our Success Framework

Our approach begins with defining a clear, measurable north star metric that aligns engineering execution with business impact. For MoneyLion, that meant focusing on the percentage of fraudulent activity blocked before a transaction is completed, without increasing false positives or customer friction. Every architectural and data decision ties back to improving that outcome, ensuring the system is built to drive profitability, not just technical sophistication.

‍

We then focus on unifying production signals into a real-time streaming foundation. Instead of relying on fragmented batch jobs and delayed analysis, we design event-driven pipelines that capture database changes, transaction activity, behavioral signals, and third-party intelligence as they occur. By processing and enriching these signals in motion, the system can evaluate risk within milliseconds, before funds move or credit is extended.

‍

Finally, we design for continuous evolution. Fraud tactics change, new data sources emerge, and regulatory requirements shift. The architecture must be modular, extensible, and observable so new signals, models, and decision rules can be integrated without disrupting production systems. This ensures the fraud prevention framework remains adaptive, measurable, and aligned with long-term growth.

‍

Get In Touch

If you are facing rising fraud losses, fragmented data pipelines, or batch-based detection systems that react too late, we can help.

‍

Analyze Agency specializes in building real-time, event-driven architectures that operate directly on production systems. Whether you are modernizing fraud prevention, streaming database changes, or enriching decision systems with third-party intelligence, we focus on measurable outcomes tied to business performance.

‍

Contact us at Discovery@analyze.agency or visit Analyze.Agency to start the conversation. We look forward to partnering with you.

‍

Let’s build systems that prevent losses before they occur.