The tiered architecture is the part that stuck with me, cheap rules catching the obvious cases, model only for the ambiguous middle. It's a good template for account-level checks too, not just transaction-time ones.

One rule that fits neatly into that fast tier: impossible travel detection, flagging a login if the distance and time since the account's last login imply a travel speed no human could hit. It's cheap (no model inference, just a distance calculation), and it produces exactly the kind of explainable signal your "explaining decisions, even to yourself" section argues for, the output is literally distance, elapsed time, and implied speed, not a black-box score.

It also catches something transaction-pattern rules structurally can't: an attacker using a completely clean, unflagged IP, since the only thing wrong is the login sequence, not any single login on its own.

Open sourced a small library for it if useful: github.com/Furqan-Ashraf/impossible-travel-guard

Did session or login-level signals factor into the BNPL platform at all, or was fraud detection scoped to the transaction layer entirely?