Fabric RTI 101: Real-Time Fraud Detection Example

Credit card fraud continues to be a major challenge for financial institutions. It can happen within seconds—often before traditional systems even notice. Once a fraudulent transaction is processed, recovering the funds is difficult or impossible.

Problem to solve

Most legacy fraud detection systems rely on batch processing, where transactions are analyzed in hourly or daily cycles. That delay makes them ineffective for real-time protection.

The business need here is clear: detect and respond to fraud as it happens. This means evaluating transaction streams in real time, identifying anomalies within seconds, and automatically taking action—such as flagging or blocking suspicious activity.

Fabric Real-Time Intelligence enables this by using streaming data pipelines, real-time event processing, and analytics that can score and act on transactions almost instantly.

Solution Architecture

This solution architecture shows how Fabric components work together to detect and respond to fraud in real time.

It begins with ingestion, where an Eventstream receives live transaction data from systems such as Kafka or Azure Event Hubs. This stream ensures that every transaction event enters the Fabric environment as soon as it occurs.

Next is processing, handled by a KQL database. Here, we apply filters and anomaly detection logic — for example, flagging transactions that exceed typical spending patterns or occur in unusual locations.

To make these insights meaningful, we add context by joining with reference data, such as customer or merchant profiles. This allows the system to distinguish between legitimate and suspicious behavior more effectively.

For visualization, the processed and enriched data is displayed in a Power BI dashboard. Analysts can monitor flagged transactions, explore patterns, and adjust detection rules if needed.

Finally, action is handled through Activator, which monitors the output from the KQL database or Power BI dataset. When a rule condition is met, it automatically triggers an alert or initiates a workflow — such as notifying a fraud analyst, sending a message to an API, or blocking a transaction in downstream systems.

Implementation Notes

From an implementation standpoint, the focus is on combining statistical methods with rule-based logic to detect fraud efficiently.

KQL provides a built-in function called series_decompose_anomalies, which can identify data points that deviate from normal behavior — for example, sudden spikes in transaction value or frequency. This makes it useful for continuous anomaly detection over streaming data.

In addition to statistical methods, rule-based checks are important. These might include transactions occurring in an unusual geographic location, spending outside a typical category, or individual payments that exceed defined limits. Using both techniques together improves detection coverage.

To ensure the system can handle high transaction volumes, partitioning the incoming stream — for example, by hashing the card number — distributes processing evenly across compute resources. This maintains low latency and allows for parallel evaluation of transactions.

Thresholds and detection parameters must be tuned carefully. If they’re set too tight, legitimate activity may be flagged as suspicious. If too loose, actual fraud could be missed. Iterative testing and analysis of historical data help find the right balance.

Finally, when a potential fraud event is identified, the system can take action automatically. This might include sending a Teams notification to the fraud operations team or making an API call to temporarily block or flag the transaction pending review.

Learn more about Fabric RTI

If you really want to learn about RTI right now, we have an online on-demand course that you can enrol in, right now. You’ll find it at Mastering Microsoft Fabric Real-Time Intelligence

2026-08-29