Find the abuse, prove it, and keep the legitimate customers whole.
12 cases across AWS Payments & Fraud Prevention, Zalando Risk & Abuse, and independent product work — investigations, detection systems, shipped products, and the measurement that made them defensible. Every figure traces to the case it sits on; sensitive numbers are kept relative.
- 01
Making fraud rings visible in a whole population
A seedless graph that loads an entire account population and lets coordinated rings fall out as clusters — without dragging legitimate customers in with them.
Read the caseWhole-population relations graph100% of a known ring in one clusterflagged ring legitimate brokerHover a node to isolate its component; toggle to strip the legitimate population and leave only the rings. Representative shape — the live graph runs on confidential data. Edges are hard shared signals weighted by excess-purity-over-base-rate × IDF; brokers are high-betweenness accounts bridging two rings.
- 02
Anatomy of a seven-figure takeover: the gate that failed
A settled, source-tagged 37-event timeline proving a seven-figure loss was a containment and adjudication failure — not a detection failure.
Read the caseThe settled chain, from release to launch - T0 Containment lifted by reviewer
- +1 sec Risk score snaps to perfect No waiting period
- 12 min Four-region quota request approved Only gate: “is the risk score clean?”
- +28 min Launching begins
- 03
Renitor: your coding task outlasts any one AI agent
A published VS Code extension: when one AI coding agent stops — quota, crash, bad answer — another continues with the task intact, and a deterministic safety layer reviews risky commands before they run.
Read the caseCoding agents a task can move across 11Claude Code, Codex, Cursor, and more — via structured, repo-aware handoffs. - 04
The first unified fraud view on a brand-new AWS region
A launched, org-wide fraud-and-revenue dashboard for the European Sovereign Cloud — reconciled to the cent, and honest about the dollars that weren't.
Read the caseTime from flag to shutdown -86%Before unified viewopaqueMeasured~1 day avgFlagged accounts shut down in about a day on average, with only a tiny number of reversals — now measurable, not anecdotal. - 05
Agents that argue their way to a defensible answer
A multi-agent investigation practice — competing personas, adversarial debate, and an LLM judge — that turns ad-hoc fraud questions into auditable runs, and once caught an agent fabricating a reconciliation.
Read the caseLeadership-ready reports DozensNear-daily cadence over a month-plus. - 06
Catching rings without breaking the customers next to them
Bulk shutdowns are the bluntest instrument in fraud prevention. I built the carve-out gates and false-positive anchors that let them stay sharp — catching rings while sparing the legitimate accounts caught in the blast radius.
Read the caseA bulk ring action, with carve-out gates Hard-identifier-only matching + a pre-action legitimate-impact carve-out keep real customers out of the wave. - 07
An enforcement job trusted to run itself — daily, in production
A daily fraud-relations auto-shutdown job on AWS's sovereign partition — eight ordered gates, carve-outs routed to review, a kill switch, and a shadow twin measuring precision continuously.
Read the caseCadence DailyLive in production on the European Sovereign Cloud partition, with a hard kill switch. - 08
Putting a euro figure on the fraud the system didn't catch
Remaining Fraud Damage — a method that benchmarks each customer segment against trusted customers to size the logistics refund leakage existing controls let through, in euros, per market, every week.
Read the caseRefund / damage rate by customer value segment refund/damage rate (illustrative)Each segment's excess over the trusted A/VIP benchmark, applied to its GMV, is the leakage estimate. Shape is illustrative — live values come from the model. Remaining Fraud Damage = Return Damage + Delivery Damage, as a share of GMV.
- 09
The forecast that inverted the planning assumption
A 40,000-run Monte-Carlo forecast of a new region's human-review queue — finding that volume tracks operational decisions, not fraud inflow: one ring drove 71% of all tasks ever queued.
Read the caseShare of all tasks ever queued from one ring 71%of every task in the queue's history everything elseQueue volume tracks operational decisions — not fraud inflow. - 10
Preflights: the check before the import that can't be undone
Pre-import QA for Shopify catalogs: a deterministic engine that flags the irreversible mistakes — deleted variants, silently overwritten products — before a supplier file touches a live store.
Read the caseStore access required 0Read-only on uploaded files — it never connects to the store. - 11
Measuring whether a control worked — without fooling yourself
Secure Delivery and refund-denial logic only 'work' if you measure them honestly. A naive before/after read flatters them; a holdout tells the truth.
Read the caseEstimated effect of the control -45%Naive treated-vs-untreatedoverstatedHoldout / counterfactualtrue effectSelection bias inflates the naive read; the holdout strips out what would have happened anyway. (Illustrative shape.) - 12
Cutting a fraud pipeline from a coffee break to a glance
A refund-analysis Spark job that took the better part of an hour, brought down to minutes by reading less, filtering earlier, and stopping the brute-force reads from the data lake.
Read the casePipeline runtime -85%Brute-force reads~34 minTuned layoutminutesColumn pruning + early partition filters + broadcast joins + selective caching.
No cases in this view.