Anomaly Detection in Banking using Z-Score and MAD

Introduction to Anomaly Detection in Banking

In the banking and financial services sector, anomaly detection is a critical component of risk management, fraud prevention, and Anti-Money Laundering (AML) efforts. With millions of transactions processed daily, identifying outliers—events that deviate significantly from the norm—is essential for safeguarding assets and ensuring regulatory compliance.

Statistical methods like Z-Score and Median Absolute Deviation (MAD) are foundational techniques for univariate anomaly detection. They are computationally efficient and highly effective for identifying suspicious activities, such as unusually large transfers or out-of-character spending patterns.

In this article, we will explore both methods, understand their mathematical formulas, provide banking-specific examples, and discuss how to apply them effectively in the banking domain.

1. Z-Score for Anomaly Detection

The Z-Score (or Standard Score) is a statistical measurement that describes a value's relationship to the mean of a group of values. It is measured in terms of standard deviations from the mean.

The underlying assumption is that the data follows a normal (Gaussian) distribution. If a data point is too many standard deviations away from the mean, it is considered an anomaly.

Formula

The Z-Score for a data point x is calculated as:

Z = (x - μ) / σ

Where:

• x: The observed value (e.g., transaction amount)
• μ: The mean (average) of the dataset
• σ: The standard deviation of the dataset

A common threshold for anomaly detection is |Z| > 3. This means any data point that is more than 3 standard deviations away from the mean is flagged as an anomaly.

Visualizing the Anomaly Threshold

In a normal distribution curve, data points that fall in the extreme "tails" of the bell curve (beyond 3 standard deviations) are classified as anomalies:

          Normal Data Region (99.7%)
                _.-"   "-._                
             ,-'     |     `-.             Anomaly 
           ,'        |        `.          Threshold
         ,'          |          `.            |
        /            |            \           v
      _/             |             \_       .... 
_____/_______________|_______________\_____/____\_
    -3σ   -2σ   -1σ  μ   +1σ   +2σ   +3σ         Outlier

Example in Banking

Imagine a customer, Alice, who typically spends small amounts on daily expenses. We want to monitor her credit card transactions to detect potential fraud.

Alice's recent transaction amounts (in USD): [20, 25, 30, 40, 50, 45, 35, 2000]

1. Calculate the Mean (μ): $(20 + 25 + 30 + 40 + 50 + 45 + 35 + 2000) / 8 = 280.6$
2. Calculate the Standard Deviation (σ): Using the standard deviation formula, $\sigma \approx 651.4$
3. Calculate Z-Scores:
   • For the $40 transaction: $Z = (40 - 280.6) / 651.4 = -0.37$ (Normal)
   • For the $2000 transaction: $Z = (2000 - 280.6) / 651.4 = 2.64$

While $2000 is clearly an anomaly to the human eye, the Z-Score is only 2.64, which is below the standard threshold of 3.

Why did this happen? The extreme outlier ($2000) drastically inflated both the mean and the standard deviation. This phenomenon, known as the "masking effect," is a significant limitation of the Z-Score method. Z-Score is highly sensitive to outliers.

2. Median Absolute Deviation (MAD)

Because the Z-Score relies on the mean and standard deviation—both of which are easily skewed by extreme values—it can struggle when the dataset contains significant outliers.

Median Absolute Deviation (MAD) offers a robust alternative. Instead of the mean, MAD uses the median, which is highly resistant to outliers. Instead of standard deviation, it uses the absolute deviation from the median.

Formula

The calculation involves three steps:

1. Calculate the Median of the dataset (X_med).
2. Calculate the absolute deviation of each point from the median: |x_i - X_med|.
3. Find the median of these absolute deviations to get the MAD: MAD = Median(|x_i - X_med|)

To use MAD as an anomaly score (similar to a robust Z-Score), we calculate the Modified Z-Score:

M_i = 0.6745 * (x_i - X_med) / MAD

Note: The constant 0.6745 is used to make the Modified Z-Score comparable to the standard Z-Score under a normal distribution.

A common threshold for flagging an anomaly using the Modified Z-Score is |M_i| > 3.5.

Example in Banking

Let's use Alice's transactions again: [20, 25, 30, 35, 40, 45, 50, 2000] (Sorted for convenience)

1. Calculate the Median (X_med): The median of the 8 values is the average of the 4th and 5th values: $(35 + 40) / 2 = 37.5$
2. Calculate Absolute Deviations from the Median: $|20 - 37.5| = 17.5$ $|25 - 37.5| = 12.5$ $|30 - 37.5| = 7.5$ $|35 - 37.5| = 2.5$ $|40 - 37.5| = 2.5$ $|45 - 37.5| = 7.5$ $|50 - 37.5| = 12.5$ $|2000 - 37.5| = 1962.5$ Deviations array: [2.5, 2.5, 7.5, 7.5, 12.5, 12.5, 17.5, 1962.5] (sorted)
3. Calculate MAD: The median of the deviations is $(7.5 + 12.5) / 2 = 10$
4. Calculate Modified Z-Score for the $2000 transaction: M = 0.6745 * (2000 - 37.5) / 10 = 132.37

The Modified Z-Score is 132.37, which is massively higher than the 3.5 threshold. The MAD method successfully isolated the extreme anomaly without being skewed by it!

Use Cases in the Banking Domain

How are these statistical methods applied practically within financial institutions?

1. Credit Card Fraud Detection

Banks build behavioral profiles for every cardholder. If a customer typically spends between $10 and $100 per transaction, a sudden $3,000 purchase will generate a high MAD score. This triggers an automated block on the transaction until the customer verifies the purchase via SMS or a phone call.

2. Anti-Money Laundering (AML)

In AML compliance, banks monitor accounts for the "Integration" or "Layering" phases of money laundering. Z-Score and MAD can monitor the velocity and volume of transactions. If an account that usually receives one $2,000 deposit a month suddenly receives five $9,900 deposits in a week, statistical anomaly detection will flag the account for an investigator to review and potentially file a Suspicious Activity Report (SAR).

3. Account Takeover (ATO) Prevention

Beyond transaction amounts, these methods can be applied to behavioral metrics. For example, if a user typically logs into their banking app 2 times a day, and suddenly the system registers 50 login attempts within an hour, the Z-score for the login frequency will spike, prompting the system to lock the account or request multi-factor authentication (MFA).

4. High-Frequency Trading (HFT) Monitoring

Investment banks monitor trading algorithms. If an algorithm's trade volume or order cancellation rate deviates significantly from its historical mean (detected via rolling Z-Scores), it could indicate a malfunction or market manipulation (like "spoofing"), prompting a circuit breaker to halt trading.

Z-Score vs. MAD: Which one to choose?

Conclusion

Both Z-Score and MAD are powerful, computationally inexpensive tools for real-time anomaly detection in banking. While the Z-Score is an excellent starting point for normally distributed data, it falls short when extreme outliers skew the mean and standard deviation.

For real-world financial data—which is notoriously messy, skewed, and filled with extreme values—Median Absolute Deviation (MAD) is generally the superior choice. By integrating robust statistical techniques like MAD into their transaction monitoring systems, banks can significantly reduce false negatives, catch fraudulent activities faster, and protect both their assets and their customers.