Distinguishing Statistical Outliers, Behavioral Anomalies, and Fraud in Mobile Financial Transactions: An Unsupervised and Inferential Analysis Using PaySim

Abstract Fraudulent fund diversion in mobile payment networks inflicts substantial financial harm, yet current detection frameworks suffer from a conceptual conflation: statistical outlierness, unsupervised behavioral anomaly, and ground-truth fraud are treated as equivalent when, in practice, they constitute three operationally distinct categories of abnormality. This conflation leads practitioners to over-rely on a single detector whose coverage of labeled fraud is never empirically quantified. The present study addresses this gap by constructing a three-layer analytical framework and measuring, for the first time on the PaySim mobile money dataset, the pairwise and three-way overlap among layers using Jaccard similarity coefficients. The PaySim synthetic transaction dataset (6,362,620 transactions; 8,213 confirmed fraud cases) was filtered to CASH OUT and TRANSFER types, yielding 2,770,409 records at a fraud rate of 0.2965%. Six accounting-residual features were engineered from sender and receiver balance differentials. Inferential statistics—Mann–Whitney U tests with Bonferroni correction (α′ = 0.0083) and logistic regression with balanced class weights—addressed RQ1. Three pre-specified unsupervised detectors (Isolation Forest, Local Outlier Factor, One-Class SVM) were evaluated against fraud labels using precision, recall, F1, ROC-AUC, and Jaccard similarity (RQ2). Account-level behavioral profiles were constructed for 1,776 multi-transaction accounts and partitioned using K-Means (k = 7) and DBSCAN; cluster validity was assessed via silhouette score, Davies–Bouldin index, and Kruskal–Wallis tests on fraud prevalence (RQ3). Principal Component Analysis was applied post-hoc as an interpretive tool, not a preprocessing step. Accounting-residual features yielded the largest discriminatory effect sizes (rank-biserial |r| = 0.893 for balance_error_orig; |r| = 0.855 for oldbalanceOrg), substantially exceeding raw transaction amount (|r| = 0.367). The logistic regression achieved ROC-AUC = 0.9791. Among the unsupervised detectors, One-Class SVM attained the highest F1 = 0.157 and AUC = 0.850; Isolation Forest achieved the highest precision (0.392) at low recall (0.040). Crucially, all Jaccard similarity scores between any unsupervised method and the fraud label fell below 0.09, and only 9 fraud cases (0.11%) were simultaneously flagged by all three detectors. K-Means identified a high-risk behavioral cluster (n = 74; fraud rate = 10.81%; ≈ 30× the 0.36% baseline; Kruskal–Wallis H = 85.4, p = 2.79 × 10−16). DBSCAN achieved superior geometric cluster quality (silhouette = 0.700 vs. 0.457). All effect sizes, classifier performance metrics, and cluster fraud rates reported in this study are properties of the PaySim simulation mechanism and should not be interpreted as estimates of real-world mobile money fraud dynamics. External validity requires replication on non-synthetic transaction data. Statistical outliers, behavioral anomalies, and fraud labels are empirically distinct phenomena with negligible mutual overlap. No single unsupervised detector constitutes an adequate fraud detection system in isolation; the three-layer framework is necessary to characterise the full landscape of abnormality. Practically, fraud detection architectures should combine engineered accounting-residual features for transaction-level scoring with account-level behavioral profiling for risk stratification. All distributional claims are explicitly bounded to the PaySim simulation environment; the balance-zeroing pattern driving the dominant effect sizes is a programmatic property of the simulator, not an empirical finding about real fund-diversion behaviour. Validation on real mobile money data is therefore not merely recommended but required before any operational deployment of the proposed framework.