Payment processor North replaced a third-party fraud detection product with its own real-time machine learning system. In a Data Science Connect fireside chat sponsored by Tecton, MLOps leader Ben Orkin explained the build-vs-buy decision, the data signals that matter and how a feature store cut model iteration from months to weeks.
Key takeaways
- Transactions alone are thin. North adds real-time profiles and third-party data such as geolocation to give models context.
- Speed is the constraint. Card-present transactions leave less than a second, so systems sit close to the payment rails.
- Build from best-of-breed parts. North decoupled feature engineering and serving rather than buy a monolithic fraud platform.
- Feature reuse speeds iteration. A feature store with automatic backfills cut model iteration from months to weeks, Orkin said.
- Balance fraud and approvals. Blocking everything stops fraud but turns away good customers.
Payment processor North, formerly North American Bancard, moved away from a third-party fraud detection product and built its own machine learning system for scoring card transactions in real time. In a Data Science Connect fireside chat webinar sponsored by Tecton, Ben Orkin, Vice President of Engineering, MLOps at North, explained why the company made that call and what it learned. Julia Brouillette, Senior Technical Evangelist at Tecton, led the conversation.
Orkin said he joined North with a mandate to give North's data scientists tools to use data well and iterate on models quickly. A feature store, he said, was central to that.
Why is real-time fraud detection so hard for payment processors?
The data in a card transaction is "a pretty slim data set," Orkin said: card data and the merchant. A processor can't tell from the transaction alone what that card did two hours ago. So North builds real-time profiles and adds third-party data such as geolocation and context about the merchant and its industry.
All of that must happen fast. In card-present transactions, "you've got less than a second to do everything you need to do," he said. North keeps its processes close to the authorization and settlement rails and has broken up the monoliths common in payments so components don't have to call back to a database.
Privacy also shapes the design. Orkin said the goal is to build profiles and context without touching cardholder data more than a transaction requires.
Should you build or buy a fraud detection system?
Orkin said most data science and ML products fall into a few buckets. All-in-one platforms may be tailored to fraud but weak at anti-money laundering. General ML platforms may not scale. Building in-house is the third option.
North took a middle path. It combined best-of-breed products so data scientists could build and iterate on models without building a feature store from scratch. "By the time you get it installed it's already practically outdated," he said of packaged data science products.
Decoupling feature engineering and feature serving from the rest of the system also gives North room to grow. Orkin said the company plans to offer some of these services to customers, letting merchants work with North on fraud and AML without being tied to "a monolithic solution."
What should a feature store do for data scientists?
Orkin said he treats data scientists as the customer. They should work in Python, SQL or PySpark rather than learn a custom language, and their work should follow software engineering practices: version control in Git, integration with CI/CD and traceability for whoever maintains the code years later.
Feature reuse was the biggest gain, he said. Teams can see which features worked in earlier models instead of reinventing them. Tecton fit because it spoke the language North's data scientists use, he said, and offered automatic backfills that many competing feature stores lacked. Backfills let the team calculate what a feature's value would have been six months or a year ago, which improved training.
Since adopting the feature store, Orkin said, North cut model iteration time "from months to weeks," and it is aiming for days with more automation in its CI/CD and MLOps pipelines.
North versions features through its CI/CD pipeline and tracks which model uses which feature, because "a slight change in feature definition could have significant impact" on a model, he said.
What data signals help detect payment card fraud?
Fraud systems combine batch and streaming features. Orkin said batch features are easier, but streaming is needed to know if a card used in San Francisco five minutes ago is now being swiped in New York.
Device intelligence is the most valuable third-party signal, he said, especially for card-not-present payments. Email verification also helps, such as whether an address was created six hours or six years ago. His advice on choosing vendors: have them score a data file and judge the results, the timeliness and the per-transaction price.
North builds separate models for authorizations and captures, because tips and delayed fulfillment can create a 20% gap between the initial transaction and the final settlement. Judging a new model comes down to two levers, he said: how much fraud gets through and how many good transactions are approved. "It's really easy to crank the system up and just say block everything," he said, but that works for no one.
Do LLMs help with fraud detection?
Orkin said he hasn't seen a good fit for large language models or retrieval-augmented generation in traditional card fraud, which remains a classic ML problem. He sees more promise in free-text payments such as wires, where LLMs could pull out names for OFAC screening.
Faster payments will raise the stakes. Where some payments once had overnight for scoring, real-time rails require an answer immediately. He called graph databases promising for spotting fraud rings but said some add computational complexity without value.
His broader lesson: most ML problems are variations on traditional software problems, and data scientists and software engineers "work best when they work together."
Learn from enterprise ML leaders at Data Science Connect webinars
Data Science Connect's 2027 schedule includes 24 free live webinars across four series: the AI × Enterprise Panel Series, AI Demo Days, Agentic AI Showcases and the Plug & Play Series. Registration details are coming soon.
Frequently asked questions
Why did North build its own fraud detection system?
Orkin said packaged products are often outdated by the time they are installed, and decoupling feature engineering and serving gave North flexibility to scale and to offer services to merchants.
What data signals are most useful for card fraud detection?
Orkin called device intelligence the most valuable third-party signal, alongside email verification, geolocation and real-time profiles of recent card activity.
Are LLMs useful for credit card fraud detection?
Orkin said he hasn't seen a good fit in traditional card fraud, but sees promise in free-text payments such as wires, for tasks like extracting names for OFAC screening.
How does a feature store help fraud models?
It lets data scientists reuse features, work in Python and SQL, and backfill historical feature values for training, which Orkin said cut iteration time from months to weeks.
Watch: Fireside Chat: How to Build a High-Performance Fraud Detection System on YouTube
Event: Webinars · More coverage: Webinars insights
