import{j as e}from"./ui-vendor-Dyu0xMC9.js";import{r as t,L as a}from"./react-vendor-BiKEbLqf.js";import{B as s,H as n}from"./button-F0c2zgfO.js";import{H as r,F as i,D as o,M as l}from"./Footer-BCdrvFQr.js";import{B as d}from"./badge-rRfUgTqY.js";import{C as c,d as m}from"./card-D8XUAx1y.js";import{B as h}from"./BreadcrumbNav-DNbFIb3a.js";import{C as x}from"./CaseStudyGate-DxLnTkbn.js";import{A as u}from"./arrow-right-BJutILxB.js";import{D as p}from"./download-DlY6qDWe.js";import"./chart-vendor-V3pFlbOw.js";import"./index-D2mkZfe8.js";import"./client-Ccea0ZZ8.js";import"./chevron-right-9d459eh4.js";import"./breadcrumb-BZGpceck.js";import"./refresh-cw-Lpgl1agh.js";const g=()=>{const[g,f]=t.useState(!1),j=`Check out this case study from Allerin: ${window.location.href}`,b=`mailto:?subject=${encodeURIComponent("Case Study: FinOps Fraud Detection — $14.7M Caught")}&body=${encodeURIComponent(j)}`,v=e.jsxs(e.Fragment,{children:[e.jsx("section",{className:"py-6 bg-surface/30",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsx(h,{items:[{name:"Home",url:"/"},{name:"Customers",url:"/customers"},{name:"FinOps Fraud Detection"}]})})}),e.jsx("section",{className:"py-16 bg-gradient-to-b from-surface/30 to-background",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("span",{className:"text-sm font-medium text-muted-foreground tracking-wide uppercase mb-4 block",children:"Case Study | Financial Services | AI Anomaly Detection"}),e.jsx("h1",{className:"text-4xl md:text-6xl font-bold mb-4",children:e.jsx("span",{className:"bg-gradient-to-r from-data-orange to-data-teal bg-clip-text text-transparent",children:"$14.7M in Fraud Caught. False Positives Down from 28% to 4.2%."})}),e.jsx("p",{className:"text-xl text-muted-foreground mb-8",children:"FinOps Fraud Detection: AI-Powered Financial Anomaly Detection"}),e.jsxs("div",{className:"flex flex-wrap gap-4",children:[e.jsxs(s,{size:"lg",onClick:()=>f(!0),className:"bg-gradient-to-r from-data-orange to-data-teal hover:from-data-teal hover:to-data-blue",children:["Talk to an Architect",e.jsx(u,{className:"ml-2 h-5 w-5"})]}),e.jsxs(s,{size:"lg",variant:"outline",onClick:()=>{window.print()},children:[e.jsx(p,{className:"mr-2 h-5 w-5"}),"Download 1-pager"]}),e.jsx(s,{size:"lg",variant:"outline",asChild:!0,children:e.jsxs("a",{href:b,children:[e.jsx(l,{className:"mr-2 h-5 w-5"}),"Email this case"]})})]})]})})}),e.jsx("section",{className:"py-12",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-4 text-foreground",children:"Context"}),e.jsx("p",{className:"text-lg text-muted-foreground leading-relaxed",children:'A Fortune 200 financial services company processing $2 billion in annual travel and expense spend across 47,000 employees was drowning in false positives. Their rule-based fraud detection system flagged 28% of all expense reports for manual review, but only 3% of flagged reports contained actual policy violations. The audit team of 45 analysts spent 60,000 hours per year reviewing legitimate expenses. Meanwhile, sophisticated fraud patterns (split transactions to stay under thresholds, after-hours personal charges on corporate cards, duplicate submissions across entities) sailed through the rules undetected. The company needed ML-based anomaly detection that could learn what "normal" looks like for each employee role, department, and geography, then flag genuine outliers without burying the audit team in noise.'})]})})}),e.jsx("section",{className:"py-12 bg-surface/30",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-foreground",children:"Approach"}),e.jsxs("ul",{className:"space-y-4 text-lg text-muted-foreground",children:[e.jsxs("li",{className:"flex items-start",children:[e.jsx("span",{className:"text-data-teal mr-3 mt-1",children:"•"}),e.jsx("span",{children:"Scikit-Learn behavioral clustering that segments 47,000 employees into 23 spending profiles based on role, travel frequency, geography, and historical patterns"})]}),e.jsxs("li",{className:"flex items-start",children:[e.jsx("span",{className:"text-data-teal mr-3 mt-1",children:"•"}),e.jsx("span",{children:"TensorFlow autoencoder anomaly detection trained per spending profile, scoring each expense line item against its expected behavioral cluster"})]}),e.jsxs("li",{className:"flex items-start",children:[e.jsx("span",{className:"text-data-teal mr-3 mt-1",children:"•"}),e.jsx("span",{children:"Kafka-based real-time pipeline processing expense submissions as they arrive (not batch overnight), with AWS Textract OCR extracting receipt data for cross-validation"})]}),e.jsxs("li",{className:"flex items-start",children:[e.jsx("span",{className:"text-data-teal mr-3 mt-1",children:"•"}),e.jsx("span",{children:"Human-in-the-loop feedback system where analyst decisions (confirm fraud / dismiss) retrain the model weekly, continuously sharpening accuracy"})]})]})]})})})]}),y=e.jsxs(e.Fragment,{children:[e.jsx("section",{className:"py-12",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsxs("div",{className:"flex items-baseline justify-between mb-6",children:[e.jsx("h2",{className:"text-2xl font-bold text-foreground",children:"Results"}),e.jsx(a,{to:"/how-we-measure#formulas",className:"text-data-teal hover:text-data-orange transition-colors text-sm font-medium inline-flex items-center",children:"Methodology →"})]}),e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6",children:[e.jsx(c,{className:"clean-card",children:e.jsxs(m,{className:"p-6",children:[e.jsx("div",{className:"text-sm text-muted-foreground mb-2",children:"Fraud Detected (annual)"}),e.jsx("div",{className:"text-3xl font-bold text-foreground mb-1",children:"$2.1M → $14.7M"}),e.jsx("div",{className:"text-lg text-data-teal font-semibold",children:"+600% (ML-detected)"})]})}),e.jsx(c,{className:"clean-card",children:e.jsxs(m,{className:"p-6",children:[e.jsx("div",{className:"text-sm text-muted-foreground mb-2",children:"False Positive Rate"}),e.jsx("div",{className:"text-3xl font-bold text-foreground mb-1",children:"28% → 4.2%"}),e.jsx("div",{className:"text-lg text-data-teal font-semibold",children:"-85%"})]})}),e.jsx(c,{className:"clean-card",children:e.jsxs(m,{className:"p-6",children:[e.jsx("div",{className:"text-sm text-muted-foreground mb-2",children:"Manual Review Volume"}),e.jsx("div",{className:"text-3xl font-bold text-foreground mb-1",children:"60K hrs/yr → 8.4K hrs/yr"}),e.jsx("div",{className:"text-lg text-data-teal font-semibold",children:"-86%"})]})}),e.jsx(c,{className:"clean-card",children:e.jsxs(m,{className:"p-6",children:[e.jsx("div",{className:"text-sm text-muted-foreground mb-2",children:"Detection Latency"}),e.jsx("div",{className:"text-3xl font-bold text-foreground mb-1",children:"Next-day → Under 90 seconds"}),e.jsx("div",{className:"text-lg text-data-teal font-semibold",children:"Real-time"})]})}),e.jsx(c,{className:"clean-card",children:e.jsxs(m,{className:"p-6",children:[e.jsx("div",{className:"text-sm text-muted-foreground mb-2",children:"Fraud Pattern Types"}),e.jsx("div",{className:"text-3xl font-bold text-foreground mb-1",children:"6 → 34"}),e.jsx("div",{className:"text-lg text-data-teal font-semibold",children:"Learned + rule-based"})]})}),e.jsx(c,{className:"clean-card",children:e.jsxs(m,{className:"p-6",children:[e.jsx("div",{className:"text-sm text-muted-foreground mb-2",children:"Analyst Productivity"}),e.jsx("div",{className:"text-3xl font-bold text-foreground mb-1",children:"14 reports/day → 14 genuine suspects"}),e.jsx("div",{className:"text-lg text-data-teal font-semibold",children:"Higher signal"})]})})]}),e.jsx("div",{className:"mt-8 grid grid-cols-1 sm:grid-cols-2 gap-4",children:["12 million receipt line items analyzed annually","$2 billion in T&E spend monitored","47,000 employees across 23 behavioral spending profiles","60,000 human audit hours eliminated in year one","28 previously undetectable fraud patterns identified by the ML model","Model retrains weekly on analyst feedback (continuous learning loop)","ROI payback: 2.8 months"].map(t=>e.jsxs("div",{className:"flex items-start gap-2",children:[e.jsx("span",{className:"text-data-teal mt-1 shrink-0",children:"✓"}),e.jsx("span",{className:"text-sm text-muted-foreground",children:t})]},t))})]})})}),e.jsx("section",{className:"py-12 bg-surface/30",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-foreground",children:"Stack & Integrations"}),e.jsx("div",{className:"flex flex-wrap gap-3",children:["TensorFlow (autoencoder)","Scikit-Learn (clustering)","Apache Kafka","AWS Textract (OCR)","Ruby on Rails","PostgreSQL","Redis","SAP Concur","Workday"].map(t=>e.jsx(d,{variant:"secondary",className:"text-base px-4 py-2",children:t},t))})]})})}),e.jsx("section",{className:"py-12",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-foreground",children:"Approach Deep-Dive"}),e.jsxs("div",{className:"space-y-6 text-lg text-muted-foreground leading-relaxed",children:[e.jsx("p",{children:"The behavioral clustering was the foundation that made the anomaly detection accurate. A $400 dinner in New York City for a VP of Sales is normal. The same $400 dinner in Topeka for a junior analyst is not. Rule-based systems cannot capture this nuance because the rules operate on absolute thresholds, not relative behavior. The clustering model (K-means with silhouette optimization, ultimately landing on 23 clusters) segmented employees by: job level, travel frequency, geographic assignment, department budget norms, and historical spending cadence."}),e.jsx("p",{children:'The TensorFlow autoencoder was trained per cluster. An autoencoder learns to compress and reconstruct "normal" data. When it encounters an expense that does not fit the cluster\'s pattern, the reconstruction error is high, and the system flags it. This approach catches fraud patterns that are invisible to rules: an employee who always expenses exactly $49.99 (just under the $50 receipt requirement), an employee whose expenses spike every quarter-end (gaming the budget cycle), or duplicate charges submitted 3 weeks apart against different cost centers.'}),e.jsx("p",{children:"The Kafka pipeline was critical for shifting from batch to real-time. Under the old system, expenses were batched overnight and analyzed the next morning. Under the new system, an expense submission triggers a Kafka event that flows through: OCR extraction (Textract pulls merchant, amount, date, and line items from the receipt image), enrichment (cross-reference against the employee's profile, recent submissions, and known vendor data), anomaly scoring (TensorFlow model scores the expense against the employee's behavioral cluster), and routing (scores above threshold go to the analyst queue, scores below get auto-approved)."}),e.jsx("p",{children:"The human-in-the-loop retraining was what prevented the model from going stale. Every analyst decision (confirm fraud, dismiss as legitimate, escalate for investigation) was captured and fed back into the weekly retraining pipeline. When analysts consistently dismissed a particular pattern the model flagged, the model learned to stop flagging it. When analysts confirmed a new fraud pattern, the model learned to catch similar patterns. Over 12 months, this feedback loop reduced false positives from an initial 8.1% (already much better than 28%) to the current 4.2%."}),e.jsx("p",{children:"AWS Textract OCR added a verification layer that rules cannot replicate. The system extracts the actual receipt data (merchant name, total, date, line items) and cross-references it against the employee's submitted expense report. Mismatches (submitted amount does not match receipt total, date does not match, merchant category does not match the expense category) are flagged independently of the anomaly model. This caught a fraud ring where employees were submitting doctored receipt images. The OCR extracted the original data from compression artifacts in the image that the human eye could not detect."})]})]})})}),e.jsx("section",{className:"py-12 bg-surface/30",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-foreground",children:"Timeline"}),e.jsx("div",{className:"space-y-4",children:[{period:"Month 1",desc:"Data extraction from SAP Concur + Workday, behavioral profiling"},{period:"Months 2-3",desc:"Clustering model development, profile validation with audit team"},{period:"Months 4-5",desc:"TensorFlow autoencoder development and training per cluster"},{period:"Month 6",desc:"Kafka pipeline build, Textract OCR integration"},{period:"Month 7",desc:"Shadow mode (ML scoring alongside existing rules, no automated actions)"},{period:"Month 8",desc:"Production cutover, analyst dashboard, feedback loop activation"},{period:"Months 9-12",desc:"Continuous retraining, false positive reduction, new pattern detection"}].map(t=>e.jsxs("div",{className:"flex items-start gap-4",children:[e.jsx("span",{className:"text-data-teal font-bold text-sm w-28 shrink-0",children:t.period}),e.jsx("span",{className:"text-muted-foreground",children:t.desc})]},t.period))})]})})}),e.jsx("section",{className:"py-12",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-foreground",children:"Lessons Learned"}),e.jsx("div",{className:"space-y-6",children:["Behavioral clustering before anomaly detection is the difference between a useful model and a noise generator. You cannot detect anomalies if you do not know what normal looks like for each person.","Human-in-the-loop retraining is not a nice-to-have. It is the mechanism that takes a model from 'good enough at launch' to 'indispensable within 6 months.' The analysts are training the model every time they make a decision.","OCR verification catches a category of fraud that behavioral models miss entirely: fabricated receipts. The two approaches are complementary, not redundant."].map((t,a)=>e.jsx("div",{className:"border-l-2 border-data-teal pl-6",children:e.jsxs("p",{className:"text-muted-foreground leading-relaxed italic",children:['"',t,'"']})},a))})]})})}),e.jsx("section",{className:"py-12 bg-surface/30",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-4xl mx-auto",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-foreground",children:"Related Case Studies"}),e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-3 gap-6",children:[e.jsx(a,{to:"/customers/healthcare-rails-resurrection",className:"group",children:e.jsx(c,{className:"clean-card hover:shadow-medium transition-all",children:e.jsxs(m,{className:"p-6",children:[e.jsx("h3",{className:"font-bold text-lg mb-2 group-hover:text-data-teal transition-colors",children:"Healthcare Platform Resurrection"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"Rails 3 → 7, zero downtime"})]})})}),e.jsx(a,{to:"/customers/predictive-freight-router",className:"group",children:e.jsx(c,{className:"clean-card hover:shadow-medium transition-all",children:e.jsxs(m,{className:"p-6",children:[e.jsx("h3",{className:"font-bold text-lg mb-2 group-hover:text-data-teal transition-colors",children:"Predictive Freight Router"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"$18M in fuel savings"})]})})}),e.jsx(a,{to:"/customers/cold-chain-guardian",className:"group",children:e.jsx(c,{className:"clean-card hover:shadow-medium transition-all",children:e.jsxs(m,{className:"p-6",children:[e.jsx("h3",{className:"font-bold text-lg mb-2 group-hover:text-data-teal transition-colors",children:"Cold Chain Guardian"}),e.jsx("p",{className:"text-sm text-muted-foreground",children:"$42M cargo saved"})]})})})]})]})})}),e.jsx("section",{className:"py-16 bg-gradient-to-r from-data-orange/5 via-data-teal/5 to-data-blue/5",children:e.jsx("div",{className:"container mx-auto px-6",children:e.jsxs("div",{className:"max-w-3xl mx-auto text-center",children:[e.jsx("h2",{className:"text-3xl md:text-4xl font-bold mb-4 text-foreground",children:"Losing Money to Expense Fraud or Drowning in False Positives?"}),e.jsx("p",{className:"text-lg text-muted-foreground mb-8",children:"Rule-based fraud detection creates two problems: it misses sophisticated fraud and it buries your audit team in false alarms. ML-based anomaly detection solves both simultaneously. The model learns what normal looks like and flags what does not fit, without the 28% false positive rate that makes your analysts ignore alerts."}),e.jsxs("div",{className:"flex flex-col sm:flex-row items-center justify-center gap-4",children:[e.jsxs(s,{size:"lg",onClick:()=>f(!0),className:"bg-gradient-to-r from-data-orange to-data-teal hover:from-data-teal hover:to-data-blue",children:["Talk to an Architect",e.jsx(u,{className:"ml-2 h-5 w-5"})]}),e.jsxs(a,{to:"/services/agentic-ai",className:"text-data-teal hover:text-data-orange transition-colors font-medium inline-flex items-center",children:["View AI Agent Development Services",e.jsx(u,{className:"ml-2 h-4 w-4"})]})]})]})})})]});return e.jsxs(e.Fragment,{children:[e.jsxs(n,{children:[e.jsx("title",{children:"FinOps Fraud Detection: $14.7M Caught, False Positives Down 85% | Allerin Case Study"}),e.jsx("meta",{name:"description",content:"TensorFlow anomaly detection caught $14.7M in expense fraud across 12M receipts. False positive rate dropped from 28% to 4.2%. 60K audit hours eliminated. Allerin."}),e.jsx("link",{rel:"canonical",href:"https://www.allerin.com/customers/finops-fraud-detection"}),e.jsx("meta",{property:"og:type",content:"article"}),e.jsx("meta",{property:"og:title",content:"FinOps Fraud Detection: $14.7M Caught | Allerin"}),e.jsx("meta",{property:"og:description",content:"TensorFlow anomaly detection caught $14.7M in expense fraud. False positives down from 28% to 4.2%."}),e.jsx("meta",{property:"og:url",content:"https://www.allerin.com/customers/finops-fraud-detection"}),e.jsx("meta",{property:"og:image",content:"https://www.allerin.com/og/default.webp"}),e.jsx("meta",{name:"twitter:card",content:"summary_large_image"}),e.jsx("meta",{name:"twitter:title",content:"FinOps Fraud Detection: $14.7M Caught | Allerin"}),e.jsx("meta",{name:"twitter:description",content:"TensorFlow anomaly detection caught $14.7M in expense fraud. False positives down from 28% to 4.2%."}),e.jsx("meta",{name:"twitter:image",content:"https://www.allerin.com/og/default.webp"}),e.jsx("script",{type:"application/ld+json",children:JSON.stringify({"@context":"https://schema.org","@type":"Article",headline:"FinOps Fraud Detection: $14.7M Caught, False Positives Down 85%",description:"TensorFlow anomaly detection caught $14.7M in expense fraud across 12M receipts. False positive rate dropped from 28% to 4.2%. 60K audit hours eliminated.",datePublished:"2026-03-17",author:{"@type":"Organization",name:"Allerin","@id":"https://www.allerin.com/#organization"},publisher:{"@type":"Organization",name:"Allerin","@id":"https://www.allerin.com/#organization"}})})]}),e.jsxs("div",{className:"min-h-screen bg-background",children:[e.jsx(r,{}),e.jsx("main",{children:e.jsx(x,{slug:"finops-fraud-detection",ungatedContent:v,onRequestArchitect:()=>f(!0),children:y})}),e.jsx(i,{})]}),e.jsx(o,{open:g,onOpenChange:f,defaultIntent:"architect",context:{sourcePage:"/customers/finops-fraud-detection",sourceButton:"case-study-cta",serviceContext:"agentic-ai"}})]})};export{g as default};