Intro & scope
Use cases that find the rare, suspicious or faulty among many normal events. Three patterns: ANOM.FINANCIAL (fraud, AML, sanctions, tax, procurement, billing), ANOM.INTEGRITY (fake accounts, reviews, documents, identities, AI-generated content, piracy, cheating) and ANOM.OPERATIONAL (sensors, grids, networks, HVAC, maritime, GNSS, KPIs).
Scope boundaries: - ANOM-001 (real-time card scoring) vs ANOM-022 (APP scams / mule accounts, account-level and network view) vs ANOM-002 (post-transaction AML monitoring and SAR drafting). - ANOM-014 (identity documents and liveness at onboarding) vs ANOM-017 (financial and business documents: statements, payslips, invoices). - ANOM-004 (platform account abuse) vs ANOM-027 (ad / invalid traffic) vs ANOM-036 (in-game cheating). - ANOM-005 (industrial process) vs ANOM-031 (building HVAC) vs ANOM-013 (water/gas leaks) vs ANOM-008 (energy theft and grid) vs ANOM-030 (business KPIs). - ANOM-006 (ledger audit) vs ANOM-009 (expense/procurement) vs ANOM-037 (payroll); ANOM-018/019/020/021 are public-sector (tax, benefits, procurement, customs). - ANOM-024 (operator-side telecom fraud) vs ANOM-025 (on-device consumer scam protection).
AI Act: most use cases are minimal risk; "depends" applies where decisions affect natural persons (employees, benefit claimants, biometric identification, credit-related, critical infrastructure safety components). ANOM-019 is high-risk. ANOM-015 is limited risk (Art. 50 transparency). Human review before adverse decisions is the default everywhere (GDPR Art. 22).
Use cases
| ID | Title | Pattern | Maturity | Path | HW tier | AI Act risk |
|---|---|---|---|---|---|---|
| ANOM-001 | Payment & card transaction fraud detection | ANOM.FINANCIAL | mainstream | A | HW1 | minimal |
| ANOM-002 | Anti-money-laundering transaction monitoring | ANOM.FINANCIAL | mainstream | A | HW2 | depends |
| ANOM-003 | Insurance claims fraud detection | ANOM.FINANCIAL | mainstream | A | HW2 | depends |
| ANOM-004 | Online platform abuse: fake accounts, bots, promo abuse | ANOM.INTEGRITY | mainstream | A | HW1 | minimal |
| ANOM-005 | Industrial process anomaly detection from sensor data | ANOM.OPERATIONAL | mainstream | A | HW1 | depends |
| ANOM-006 | Audit analytics: journal-entry & ledger anomaly detection | ANOM.FINANCIAL | mainstream | A | HW1 | minimal |
| ANOM-007 | Healthcare billing & reimbursement fraud detection | ANOM.FINANCIAL | mainstream | A | HW2 | depends |
| ANOM-008 | Energy theft & grid anomaly detection | ANOM.OPERATIONAL | early-adopter | A | HW1 | depends |
| ANOM-009 | Expense & procurement fraud detection | ANOM.FINANCIAL | mainstream | A | HW2 | depends |
| ANOM-010 | Fake review detection | ANOM.INTEGRITY | mainstream | A | HW2 | minimal |
| ANOM-011 | Supply chain & supplier risk monitoring | ANOM.OPERATIONAL | mainstream | A | HW2 | minimal |
| ANOM-012 | Market abuse & trade surveillance | ANOM.FINANCIAL | mainstream | A | HW3 | minimal |
| ANOM-013 | Leak detection in water & gas networks | ANOM.OPERATIONAL | mainstream | A | HW1 | depends |
| ANOM-014 | Identity document forgery & liveness detection | ANOM.INTEGRITY | mainstream | A | HW2 | depends |
| ANOM-015 | AI-generated content marking, provenance & detection (AI Act Art. 50) | ANOM.INTEGRITY | early-adopter | B | HW1 | limited |
| ANOM-016 | Sanctions, PEP & adverse-media screening with AI alert adjudication | ANOM.FINANCIAL | early-adopter | A | HW2 | minimal |
| ANOM-017 | Document tampering & synthetic-document fraud detection (bank statements, payslips, invoices) | ANOM.INTEGRITY | early-adopter | A | HW2 | depends |
| ANOM-018 | Tax fraud & audit case selection for tax authorities (incl. VAT carousel fraud) | ANOM.FINANCIAL | mainstream | C | HW2 | depends |
| ANOM-019 | Social benefit fraud & error risk detection (AI Act high-risk safeguards) | ANOM.FINANCIAL | early-adopter | C | HW2 | high |
| ANOM-020 | Public procurement collusion & EU-funds fraud risk scoring | ANOM.FINANCIAL | early-adopter | A | HW2 | depends |
| ANOM-021 | Customs risk targeting & trade-fraud detection (undervaluation, misdeclaration, origin fraud) | ANOM.FINANCIAL | early-adopter | C | HW2 | depends |
| ANOM-022 | Authorised push payment (APP) scam & money-mule account detection | ANOM.FINANCIAL | mainstream | A | HW2 | minimal |
| ANOM-023 | Crypto-asset transaction monitoring & blockchain forensics | ANOM.FINANCIAL | mainstream | A | HW2 | minimal |
| ANOM-024 | Telecom fraud management (SIM-box, IRSF, Wangiri, SIM-swap, A2P SMS fraud) | ANOM.FINANCIAL | mainstream | A | HW2 | minimal |
| ANOM-025 | Consumer scam call & message protection (on-device scam detection) | ANOM.INTEGRITY | early-adopter | A | HW1 | minimal |
| ANOM-026 | Sports betting integrity & match-fixing detection | ANOM.FINANCIAL | mainstream | A | HW1 | depends |
| ANOM-027 | Ad fraud & invalid-traffic (click fraud) detection | ANOM.INTEGRITY | mainstream | A | HW1 | minimal |
| ANOM-028 | Counterfeit & brand-infringement detection on online marketplaces | ANOM.INTEGRITY | mainstream | A | HW2 | minimal |
| ANOM-029 | Research integrity screening: image manipulation, paper-mill & duplicate-submission detection | ANOM.INTEGRITY | early-adopter | A | HW2 | depends |
| ANOM-030 | Business KPI & revenue anomaly detection with root-cause analysis | ANOM.OPERATIONAL | mainstream | A | HW1 | minimal |
| ANOM-031 | Building HVAC fault detection & diagnostics (FDD) | ANOM.OPERATIONAL | mainstream | A | HW1 | minimal |
| ANOM-032 | Maritime domain awareness: dark-vessel, AIS-spoofing & shadow-fleet detection | ANOM.OPERATIONAL | early-adopter | A | HW3 | depends |
| ANOM-033 | Retail returns fraud & POS exception analytics | ANOM.FINANCIAL | mainstream | A | HW1 | minimal |
| ANOM-035 | Copyright & piracy detection via content fingerprinting | ANOM.INTEGRITY | mainstream | A | HW2 | minimal |
| ANOM-036 | Online game anti-cheat & cheating behaviour detection | ANOM.INTEGRITY | mainstream | A | HW2 | minimal |
| ANOM-037 | Payroll validation & anomaly detection before payroll runs | ANOM.FINANCIAL | early-adopter | A | HW1 | depends |
| ANOM-038 | GNSS jamming & spoofing detection and RF interference classification | ANOM.OPERATIONAL | early-adopter | A | HW1 | depends |
Shared stack
Common core (all tiers): an event/feature pipeline (Kafka or Redpanda for streams, Postgres or ClickHouse for batch), a feature store (Feast or plain tables), gradient-boosted trees (LightGBM/XGBoost) plus unsupervised detectors (isolation forest, autoencoders), a case-management/review queue with audit log and appeal path, model monitoring (drift, alert precision), and an LLM layer used only for triage summaries and explanations, never as the sole decision-maker.
HW1 (CPU / small server, no GPU). Postgres + LightGBM/River for streaming scoring, NetworkX or Memgraph for small graphs, Prophet/statsmodels or Isolation Forest for time series, a 3-8B quantized LLM (Ollama/llama.cpp) for case summaries. Serves ANOM-001, 004, 005, 006, 008, 013, 025, 026, 027, 030, 031, 033, 037, 038. Edge variants run ONNX Runtime on gateways.
HW2 (single GPU 24-48 GB). HW1 plus a graph database (Neo4j / Memgraph) with GNN training (PyG/DGL), OCR/doc-parsing (docTR, Docling) and a 7-32B open VLM/LLM via vLLM, embeddings + vector DB (pgvector, Qdrant) for similarity, sentence-embedding text classifiers, Airflow/Dagster orchestration. Serves ANOM-002, 003, 007, 009, 010, 011, 014, 016, 017, 018, 019, 020, 021, 022, 023, 024, 028, 029, 035, 036.
HW3 (multi-GPU / cluster). HW2 plus Whisper-class ASR with diarization on voice and chat archives, large-scale satellite/AIS processing (Spark/Dask, object detection on imagery), 70B-class reasoning model. Serves ANOM-012, 032.
Cross-family reuse: the document pipeline (OCR + VLM) is shared with the DOC family (ANOM-009, 017 with DOC-001/017); the graph store and entity-resolution layer is shared by ANOM-002, 016, 018, 020, 021, 022, 023; the time-series/streaming layer is shared with PRED (ANOM-005, 008, 013, 031, 038); embeddings/vector DB with KNOW and LANG (ANOM-010, 028, 029, 035); ASR with SPEECH (ANOM-012, 025). Use one review-queue and audit-log service for all ANOM cases.