Monzo's reactive fraud prevention platform is engineered to counter sophisticated, fast-moving financial threats. The system processes millions of daily transactions with low latency, using a modular architecture that allows for rapid updates to fraud controls. The core workflow involves four steps: control selection, feature loading, control execution, and action application. This ensures that only relevant fraud checks are run for a given transaction context.

The architecture is built around a central microservice called the Engine, written in Go, which orchestrates the process. Fraud controls, including machine learning models, are authored in Starlark, a Python dialect, as pure functions. This design choice simplifies backtesting and monitoring. A dedicated Feature Loader service computes data points for the models in real-time, near real-time, or in batches, using a Directed Acyclic Graph (DAG) to manage dependencies and ensure speed. Features include transaction details, user behavior aggregates, and text analysis from payment notes.

If a control flags a transaction as potentially fraudulent, an Action Applier service takes over. It applies interventions, such as blocking a payment or sending a warning to the user. The system includes safeguards like rate limiting to prevent bugs from causing widespread customer impact and logs all data to BigQuery for continuous monitoring and model improvement.