Live demo
14 series in. 4 alerts out.
An institution monitoring transaction behaviour by customer segment. 60 days, 14 series, four segments. On day 45 a structuring pattern starts inside one of them. Total alert volume never moves, because that segment is 4% of the queue. Find it.
Every number on this page is computed in your browser right now, by the same CUSUM and Bayesian changepoint code that runs in production. Nothing here is a screenshot.
The comparison that matters
Against the rule most teams actually ship
The standard configuration is a percentage or sigma threshold against a trailing mean, evaluated per metric. Run it over the exact same 14 series and count what lands in the channel.
The false-alarm count is not a judgement call. The incident was injected at a known index, so every naive alert before that index is wrong by construction.
What the engine found
Detection run
| Metric | Trend | Baseline | Now | Change | Confidence | Method |
|---|---|---|---|---|---|---|
Structuring score segment=money-services-business | 18.245 | 48.911 | +168% | 99.9% | CUSUM | |
Cash deposits per account per day segment=money-services-business | 3.456 | 7.150 | +107% | 99.9% | CUSUM | |
Cross-border transaction share segment=money-services-business | 11.9% | 25.7% | +117% | 99.9% | CUSUM | |
Average transaction amount segment=money-services-business | $8.9k | $5.1k | −42.6% | 99.9% | CUSUM |
Show your work
Structuring score · segment=money-services-business
Baseline mean μ = 0.0055 and σ = 0.1582, both computed from the first two thirds of the day-over-day percentage changes. The slack k = 0.0791 is half a sigma, and the decision boundary h = 0.6329 is four. The accumulator runs on percentage changes rather than raw levels so a healthy growing series cannot drift across the boundary on its own.
alert if |Δ| > 20% vs 7-day mean fired 8 times across this one metric, including 3 before anything was actually wrong. The statistical pipeline sent one message, on the day the regime actually changed.
What lands in Slack
One message, with the work already done
- 1.Pull the 2,140 MSB accounts ranked by contribution to the deposit-velocity shift.
- 2.Review the top decile against the existing structuring rule to see why it stayed silent.
- 3.Log the suppressed low-rank alerts with their q-values so the sample is auditable.
The written cause is generated only after the statistics confirm the change. The model never decides whether something is an anomaly — it explains one that has already been established. Getting that order backwards is how these products hallucinate.