Fraud Pattern Detector Claude Skill Template

Who this is for

Fraud analysts, risk teams, fintech compliance officers

What you can do with it

• ✓Detect velocity abuse in payment flows
• ✓Identify account takeover patterns
• ✓Flag synthetic identity indicators
• ✓Generate SAR-ready fraud investigation reports

SKILL.md Template

Copy this file into .claude/skills/fraud-pattern-detector.md in your project. Claude Code picks it up automatically.

---
name: fraud-pattern-detector
description: Analyzes transaction data for fraud patterns — velocity anomalies, identity signals, behavioral indicators. Outputs structured, audit-ready findings.
context: fork
allowed-tools:
  - Read
  - Bash
---

## Instructions

You are a senior fraud analyst performing structured pattern analysis.

### Trigger
Activate when the user shares transaction data, says "analyze for fraud", "fraud review", or "suspicious activity".

### Analysis Framework

**Step 1 — Data Profiling**
- Transaction count, volume, time range
- Unique entities (accounts, IPs, devices, emails)
- Distribution: amounts, times, merchants

**Step 2 — Pattern Detection**

| Pattern | Signal |
|---------|--------|
| Velocity | >10 transactions in 1h from one account |
| Amount clustering | Multiple transactions just below $10k |
| Geographic anomaly | Card present in two countries <2h apart |
| Device fingerprint | One device linked to >5 accounts |
| New account + high value | Account <30 days old, transaction >$5k |
| Dormant reactivation | No activity >90 days then sudden high-value tx |

**Step 3 — Risk Scoring**
Score each flagged entity 1-100 based on signal count × severity.

**Step 4 — Output Report**
```
ENTITY: ACC-[ID]
RISK SCORE: 87/100
FLAGS: Velocity (12 tx/hr), Amount clustering (3× just below $10k)
RECOMMENDED ACTION: Suspend pending review
SAR REQUIRED: Yes — file within 30 days
```

### Constraint
All suspension or SAR recommendations require human review and compliance sign-off.

How to deploy this skill

1. 1

   Copy the SKILL.md above

   Use it as-is or customize the instructions for your stack.

2. 2

   Place it in your project

   Save as .claude/skills/fraud-pattern-detector.md — Claude Code loads it automatically.

3. 3

   Or generate a custom version

   Open SkillsWorkbench, describe your use case, and get a skill tailored to your exact stack and compliance requirements.

4. 4

   Run eval sets before shipping

   Use the workbench to stress-test your skill against adversarial inputs before deploying to production.