Unsupervised Learning Models for Anomaly Detection in Digital Banking Accounts

This thesis presents the development of an unsupervised learning model designed to detect anomalies in digital banking account transactions. The project was carried out in collaboration with one of the most prestigious Italian banks, which provided more than 100 million real transactions over one year of data, together with monthly account balances, registry information, and transaction-level metadata. These heterogeneous data sources were integrated, cleaned, and transformed into a structured feature set that enables robust anomaly detection. The feature engineering process produced a total of 98 features extracted on a monthly basis for each account. These features range from straightforward metrics, such as the number of credited and debited transactions or the overall transaction volume, to more sophisticated indicators. For example, the saver coefficient measures the tendency of an account over several months to either save or spend, while more complex features, such as exfil or high-rotation, capture patterns related to rapid inflows and outflows of money. All features underwent a dedicated preprocessing pipeline, including standardization, logarithmic transformations and one-hot encoding. These steps ensured that categorical, binary, and numerical variables could be jointly modeled in a coherent space. The core model is an Autoencoder, whose architecture was optimized through parameter tuning and trained with tailored loss functions depending on feature type. The model outputs a reconstruction error at both the account and feature levels. This error was aggregated into an anomaly ranking across accounts, complemented by a feature-level analysis to better interpret the underlying patterns flagged as anomalous. The Autoencoder performance was compared both with the systems already in use at the bank and with standard anomaly detection baseline models, including Isolation Forest, Local Outlier Factor, and One-Class SVM. Results show that the proposed framework not only improves anomaly detection accuracy but also provides richer interpretability for analysts, particularly through feature-level error diagnostics. In practice, the outcome of this work supports banking professionals in identifying unusual account behavior more effectively and promptly, strengthening the institution’s ability to detect fraudulent or suspicious activity.