Grab’s Trust, Identity and Safety team detects fraud by deploying data science, analytics, and engineering platform to search for anomalous and suspicious transactions, or by identifying high-risk individuals who are likely to commit fraud. The team builds tools for managing data feeds, creates SDK for engineering integration, and builds rules engines and consoles for fraud detection. An example of fraudulent behavior could be that of an individual who pretends to be both the driver and passenger, and makes cashless payments to get promotions. Recently, the team launched GrabDefence as a SaaS service to start helping external clients in Southeast Asia to combat fraud in their business. Billions of fraud and safety detections are performed daily as there are millions of transactions happening every day and thus storing and querying the data of a database in real-time is not feasible. So come listen to us how we use Apache Kafka to detect fraud successfully!

1. Detect Fraud Successfully with
GrabDefence!

2. Southeast Asia’s digital
economy is on track to
reach $300B by 2025
Source: Google & Temasek / Bain, e-Conomy SEA 2019

3. E-commerce will be a
XX industry by 20XX
E-commerce will be a
XX industry by 20XX
of e-commerce
revenue is lost to
fraud.
1.6%
is the highest loss
in the region, in
Indonesia.
3.2%
Fraud is a real problem in
Southeast Asia
Source: Cybersource, Online Fraud Benchmark Report, 2018 Southeast Asia edition

4. TECH GRABBERS BASED IN:
300+ Solving for range of complex risk problems
Fighting
Business
Fraud & Abuse
Securing
customer’s
Identity
Creating a
Safer Platform
Minimizing
Payments
Fraud Losses
by leveraging the advanced capabilities built to serve
Device
FingerPrinting
AI/ML,
Analytics
Ground & Web
Intelligence
Data Insight
(Fraud scores,
Telematics)
Authentication
Technologies
Location
Spoofing
Detection
Facial
Recognition
Verification
Technologie
s (e.g. OCR
for KYC)
...powered by Integrity Group at Grab

5. Monitoring 130M+ devices
Generating 20M+ AI-driven
risk verdicts a day
Mobility
GrabCar, GrabTaxi, GrabBike, GrabShare
Financial Services
GrabPay, GrabRewards, OVO
Delivery
GrabFood, GrabExpress, GrabFresh
E-commerce
GrabMart
Today, GrabDefence is protecting...

6. GrabDefence Solution Overview
Device intelligence to
scan and analyse the
devices accessing the
platform
Mobile
Web
GD Scores
Risk indicator models
powered by Grab’s AI
capability and first-hand
data in SEA
Rules Engine
Modular Rule Engine
to allow easy fraud
rule-building, editing
and deployment
Ops Portal
User portal for the fraud
analyst to conduct case
management, review and
investigation
Guardian

7. Why Kafka is used by GrabDefence
● We need to capture as much information as possible for better ML Prediction
○ Fraud detection usually comes with limited label data, and we need to capture as
many events as possible to better train the models
○ We listen to Device Intel event, User transaction and many other events that are
generated by us or by our clients, and filter these events for useful signals
● Different events may come at different timepoints, but we need to connect them
○ Some events like GPS Pings and User Transactions may come at different
timepoints, we join the streams based on common fields like userID to make the
data in joined stream carries more useful signals
● We needs aggregated events for high performance ML predictions
○ Most of ML Models requires historical events like “how many login happens with this
IP address”, “how many distinct credit card a user has used in last 24H”?
○ We connect Kafka streams with Spark (for offline datalake) and Flink (for online
feature bank) to generate these kind of aggregated features, and sync them
periodically (typical Lambda Architecture)

8. … And Why Confluent Cloud
● Purely self-served stream management and tenant isolation
○ We leverage Confluent Cloud to manage our Kafka for GrabDefence SaaS service
○ Our efforts to manage Kafka dropped to 0 with purely self-service
○ And get client-level data isolation for free

9. A (simplified) architecture view on Kafka

10. Stats
● Events processed by GrabDefence ~ 100 million/daily
● Predictions made ~ 500 million/daily (as each events could have multiple risk dimensions)
● Data processed ~ 3TB/daily
● Geographical Coverage ~ 8 countries (Singapore, Malaysia, Indonesia, Vietnam, Thailand,
Philippines, Cambodia and Myanmar) and over 400 cities and towns.