YOUR BRIEF
What to work through
Work through real-time fraud detection as a spoken system design interview. Start by clarifying the scope, sketch a working design and explain the trade-offs behind your choices.
- Score every payment and return approve, block or review before authorization
- Combine fixed rules (block lists, velocity limits) with a model score
- Let analysts add or change rules without a deploy
- Send flagged payments to a manual review queue
- Learn from chargebacks and fraud reports that arrive weeks later
BEFORE YOU START
Constraints to discuss
- A decision in under 100 ms, as Stripe Radar does
- Fraud is rare: about 1 payment in 1,000 at Stripe
- Few good payments blocked: Radar wrongly blocks about 0.1% of legitimate payments
- A payment still gets a decision when the fraud check is slow or down
Need a starting point?
Watch for these common gaps as you prepare:
- Training on features recomputed later instead of the values logged at decision time
- Scanning payment history at scoring time instead of reading precomputed counts
- No plan for a slow or failed score, so the payment path waits or blocks everyone
- Treating labels as instant, when chargebacks arrive weeks later
- Judging the model by accuracy when fraud is 1 payment in 1,000
- Rules shipped as code, so each change waits for a deploy
Why this question is in the collection
These sources connect the problem to company interview reports or preparation guides. They do not guarantee what a company will ask you.
- PayPal: PracHub lists a PayPal onsite from September 2025, for a machine learning engineer: an end-to-end real-time fraud system that answers during authorization.
- Stripe: PracHub lists a Stripe technical screen from April 2026, for a machine learning engineer: score payments around authorization and approve, block, challenge or send them to review.
- Affirm: Ophy’s Affirm guide, built from candidate reports, lists a real-time fraud detection system among the reported design themes.
- Palantir: SupaCV’s Palantir playbook lists a real-time fraud alerting system with sub-second latency among its reported questions.