Monzo's Real-Time Fraud Detection Architecture with BigQuery and Microservices

"Fraud detection at Monzo is challenged by its highly unbalanced nature, with about 1 in 10,000 transactions being fraudulent. Customers can lose life-changing amounts to fraud, and fraudsters operate at scale, adapting quickly, making static or slow-to-update controls ineffective. As highlighted in Monzo's blog, UK Finance estimated that losses due to fraud in the UK reached £1.17 billion in 2024 alone. To address this, Monzo's redesigned platform focuses on four priorities: scaling control complexity, rapid deployment of new controls, performance observability,"

"each transaction passes through a structured four-step process to ensure accurate fraud detection while maintaining real-time performance. First, the system identifies which controls are applicable, taking into account transaction context, user behavior, and risk scores. Next, it loads the necessary features from a dedicated microservice, which provides contextual data such as recent transaction patterns, account history, and historical fraud indicators. Third, the Engine microservice executes the controls, written as pure functions in Starlark, allowing safe testing and back-testing on historical data"

Monzo redesigned its fraud prevention platform to handle increasingly sophisticated scams and a larger volume of payments while maintaining minimal latency on the payment hot path. Fraud occurrence is highly unbalanced, roughly 1 in 10,000 transactions, and fraudsters operate at scale, adapting quickly. The redesigned platform prioritizes scaling control complexity, rapid deployment of new controls, performance observability, and ultra-low latency. Each transaction follows a four-step real-time process: identify applicable controls using transaction context and risk scores; load features from a dedicated microservice providing recent transaction patterns and account history; execute controls in an Engine microservice using Starlark pure functions that support safe testing and back-testing on historical data. Controls can be rapidly deployed to catch suspicious activity.

Read at InfoQ