A Practitioner's Framework for Automated Fraud Detection in Cloud Credit Systems: A Case Study

Cloud providers increasingly distribute financial resources through structured credit programs to accelerate customer adoption and reward strategic partnerships. As the scale of these programs has grown, so has their exposure to abuse. One pattern we encountered in practice is credit stacking, where users accumulate credits across multiple accounts, sometimes reselling them, in ways that were never intended by the issuing programs. Detecting this type of fraud is harder than it might appear, because large enterprise customers legitimately operate multiple accounts across subsidiaries and geographies, making naive detection approaches prone to false positives that disrupt real business activity. This paper describes a detection framework we built and deployed in production at a large cloud platform. Starting from manual SQL-based analysis, the system evolved over roughly eight months into an automated pipeline that resolves account relationships through commercial entity identifiers, applies overlapping detection signals, and routes flagged cases to either automated enforcement or human review depending on the dollar value at stake. Over approximately twelve months following full deployment, the number of accounts with confirmed stacking activity fell by over 80% and dollar exposure dropped by more than 75%. We share the design decisions, the false-positive problem that reshaped the architecture, and the organizational lessons that took longer to learn than the technical ones.