$14.7M in Fraud Caught. False Positives Down from 28% to 4.2%.

The behavioral clustering was the foundation that made the anomaly detection accurate. A $400 dinner in New York City for a VP of Sales is normal. The same $400 dinner in Topeka for a junior analyst is not. Rule-based systems cannot capture this nuance because the rules operate on absolute thresholds, not relative behavior. The clustering model (K-means with silhouette optimization, ultimately landing on 23 clusters) segmented employees by: job level, travel frequency, geographic assignment, department budget norms, and historical spending cadence.

The TensorFlow autoencoder was trained per cluster. An autoencoder learns to compress and reconstruct "normal" data. When it encounters an expense that does not fit the cluster's pattern, the reconstruction error is high, and the system flags it. This approach catches fraud patterns that are invisible to rules: an employee who always expenses exactly $49.99 (just under the $50 receipt requirement), an employee whose expenses spike every quarter-end (gaming the budget cycle), or duplicate charges submitted 3 weeks apart against different cost centers.

The Kafka pipeline was critical for shifting from batch to real-time. Under the old system, expenses were batched overnight and analyzed the next morning. Under the new system, an expense submission triggers a Kafka event that flows through: OCR extraction (Textract pulls merchant, amount, date, and line items from the receipt image), enrichment (cross-reference against the employee's profile, recent submissions, and known vendor data), anomaly scoring (TensorFlow model scores the expense against the employee's behavioral cluster), and routing (scores above threshold go to the analyst queue, scores below get auto-approved).

The human-in-the-loop retraining was what prevented the model from going stale. Every analyst decision (confirm fraud, dismiss as legitimate, escalate for investigation) was captured and fed back into the weekly retraining pipeline. When analysts consistently dismissed a particular pattern the model flagged, the model learned to stop flagging it. When analysts confirmed a new fraud pattern, the model learned to catch similar patterns. Over 12 months, this feedback loop reduced false positives from an initial 8.1% (already much better than 28%) to the current 4.2%.

AWS Textract OCR added a verification layer that rules cannot replicate. The system extracts the actual receipt data (merchant name, total, date, line items) and cross-references it against the employee's submitted expense report. Mismatches (submitted amount does not match receipt total, date does not match, merchant category does not match the expense category) are flagged independently of the anomaly model. This caught a fraud ring where employees were submitting doctored receipt images. The OCR extracted the original data from compression artifacts in the image that the human eye could not detect.