Inspiration

Credit card fraud touches almost everyone, and it keeps getting through despite modern safeguards. Fraudsters adapt faster than static rules can be rewritten, and analysts are left sorting alerts without context. We wanted a system that protects business assets, explains every decision, and gets sharper by attacking itself.

What it Does

NemoScantron is a fraud detection platform powered by NVIDIA Nemotron. You upload a transaction JSON file and optionally add analyst notes. The app assembles an eight-file ruleset (identity, workflow, velocity, geo, merchant, attack patterns, thresholds, output format) into a prompt for Nemotron. There is no local scorer. Nemotron returns a structured FILE 8 JSON with a decision (approve, flag for review, hold, or decline), a 0–1 risk score, and the rules that triggered. The interface has four parts: Decision view: a fraudometer, the triggered rules, and dollars at risk next to the decision. Edit input: change any field and re-score to see what moves the result. Recommendation tab: next-step actions for the analyst. Trip map: every transaction in the file plotted with normal, suspicious and malicious paths, and location mismatches flagged. An enterprise dashboard aggregates stored scores: a raised-grid chart of rule detections, a donut of risk counts, a line chart of risk over time, and a recent events log.

How We Built It

Ruleset as prompt: we split fraud logic into eight modular files so each concern (velocity, geo, merchant, and so on) can be tuned independently. Only the trainable RULES files are editable by the red team. Nemotron as the decision engine: the assembled prompt goes to Nemotron, which must reply in the FILE 8 schema, so the UI and dashboard consume predictable JSON. Red-team CLI: a developer tool generates labeled cases, including edge events such as card-testing bursts and legitimate outliers. It scores them through Nemotron, compares the results to the labels, and can ask Claude to patch only the trainable RULES files. Then we re-run. Stack: NemoScantron is a Next.js 16 (App Router) TypeScript web app on React 19, styled with Tailwind CSS 4 and shadcn/ui (Base UI / Nova, Lucide icons). Fraud detection is live with a trained ruleset governing how NVIDIA Nemotron (nvidia/nemotron-3-super-120b-a12b) reasons regarding the fraud scoring. The red-team CLI uses Claude Sonnet 4.5. There is no database: history is slim localStorage. Node route handlers (/api/analyze, /api/train-ruleset) run locally; GitHub Pages can static-export the client. Dev server is npm run dev on port 43127.

Challenges We Ran Into

Our first visualizations broke: the fraudometer had the wrong shape and the world map glitched. The bigger challenge was the red-team feedback loop. Nemotron generates each test case with a gold label, and a second Nemotron call scores it with the label hidden. Claude may patch only RULES files 3–7 where the score disagrees with gold; identity, workflow and output format stay frozen. So the trainer had to excerpt only the implicated files, reject any edit that touched frozen prompts, and apply patches without breaking assembly order.

Accomplishments that we’re proud of

AI-powered red team training. A repeatable loop of generate, attack, score, patch, re-test, with changes restricted to the trainable RULES files. Metrics to scale. 79% success rate and 21% “exact gold match” on 60+ credit card transaction history json files Business risk and impact. Every decision shows dollars at risk, and the four-tier outcome maps to real customer friction, from frictionless approval to hard decline. Dashboard. Rule-detection grid, fraudometer, risk donut, risk-over-time line and live events log give operations teams a portfolio view. PCI DSS-aware design. Our data model contains no full card numbers, CVV or PIN values, or track data. It uses tokenized identifiers, truncated card numbers (BIN plus last four) and match/no-match flags for CVV and PIN checks. Recommendations. Each decision comes with prioritized next actions instead of a bare score.

What we learned

LLM workflow training: We improved results by refining the workflow, not the weights. We generated labeled cases, scored them, and patched only the trainable RULES files. PCI DSS: Fraud detection works without sensitive card data. We used tokens, truncated numbers (BIN and last four), and match/no-match flags instead of raw card numbers, CVVs or PINs. Risk factors: No single signal proves fraud. Patterns like small-amount bursts, repeated CVV failures and unknown devices matter most in combination. Prompt engineering: Splitting logic into eight focused ruleset files, with explicit thresholds and a strict output schema, made Nemotron's decisions clearer and easier to debug. Data visualization: Charts and the trip map made card-testing bursts and location mismatches obvious, and showing dollars at risk turned scores into business decisions.

What’s next for NemoScantron

Next, NemoScantron will emphasize on-prem deployment so that card data never leaves the customer’s environment. Hybrid scoring would allow for multiple perspectives, with disagreements flagged for review. Creating analyst/administrator/user permissions would allow for segmented permissions and step-up actions such as card freezes, customer messaging, and analyst review of AI decision making. Further AI model training will improve prediction accuracy