Dataset

Name and source

S-FFSD, the Simulated Financial Fraud Semi-supervised Dataset.

It ships inside the AI4Risk/antifraud research repository.

Download it with:

python -m spark.data.fetch

Why I chose it

• It has payment transactions with fraud labels.
• It has customer, merchant, location, and payment channel IDs, so a graph can be built from real connections in the data.
• Transactions are in time order, so I can train on early data and test on later data.
• It downloads without an account or a login, so anyone can run this project.
• It actually contains a fraud ring. I checked before building anything.

Fields

What the fraud label means

Counts:

Among labeled rows, 17.7% are fraud.

The unknown rows are not thrown away. They are real traffic, so they still count towards velocity and still appear in the graph. They are only left out of model fitting and out of every reported number.

Size

Splits

Split by time, never shuffled.

Why the test data is kept separate

If you pick your settings by looking at the test data, the test score stops meaning anything. It becomes a description of tuning, not a prediction of how the system will behave on new data.

So:

• Models are fitted on train.
• Weights, calibration, and thresholds are chosen on validation.
• Test is read once, in one file, after everything is frozen.

Why split by time and not randomly

The fraud rate in this file more than triples from start to end:

A random split would spread the fraud ring across train and test. The model would then see part of the ring during training and score the rest easily. That looks great and means nothing.

Splitting by time keeps the ring where it actually happened. It makes the test harder and honest.

The ring in this data

Merchant T1822:

Almost every transaction comes from a different account. That is the shape of a ring using throwaway accounts, not a shop with repeat customers.

The same channel TP110 also carries merchant T1015 at 82.6% fraud.

What is missing

The dataset does not have:

The system does not invent these. Run python -m spark.data.inspect and it prints a table marking each one.

Device and IP are two of the strongest ring signals in real fraud work. Without them, this project uses merchant, payment channel, and location instead.

Limitations

• It is simulated. The generator is not published, so the exact scores describe this file, not real payments. The method and the way it is tested are what carry over.
• Time is a sequence position, not a clock. So "velocity" means transactions elapsed, not seconds elapsed.
• Most rows are unlabeled. 61.9% never get a confirmed outcome, which limits how much can be measured.
• Amounts are extreme. Median is 16.61, maximum is 800,000, and 6,812 rows are exactly zero.
• No device or IP, as above.

Other datasets I looked at