Amazon's last-mile delivery fleet operates on an hourly pay model. A subset of drivers exploit this structure by remaining "on shift" while systematically avoiding or fabricating deliveries. Prior to LoFAT, fraud detection relied on manual audits of delivery logs, tip-line reports, and periodic GPS spot-checks — a reactive process that caught less than 15% of fraudulent activity and required a dedicated 37-person investigation team.

LoFAT replaced this manual process with an automated pipeline that ingests GPS telemetry in real time, applies ML anomaly detection models (Isolation Forest + Gradient Boosted Classifier), and surfaces flagged drivers to a streamlined investigation workflow — reducing the investigation team from 37 to 0 dedicated headcount while increasing detection coverage from <15% to 100% of the active fleet.

GPS pings arrive at 5-second intervals from driver devices into Amazon Kinesis Data Streams. A Lambda consumer processes each event batch, enriches it with shift context from DynamoDB, and extracts a feature vector over a 15-minute sliding window. The feature vector is scored by a SageMaker endpoint running an Isolation Forest model — anomalies above threshold 0.7 trigger a secondary Gradient Boosted Classifier that classifies the fraud pattern.

Kinesis Data Analytics runs real-time SQL aggregation for cluster fraud detection — identifying 3+ drivers within 50m for 30+ minutes. When fraud is confirmed, the Lambda function writes an alert to DynamoDB and publishes to SNS for push notifications to the React dashboard.

GPS trace archives are stored in S3 for historical analysis and model retraining. The React dashboard connects via API Gateway to query driver state, fetch GPS traces for map visualization, and invoke LLM-powered analysis through Anthropic Claude.

Primary: Isolation Forest (Unsupervised)

Trained on 30 days of historical GPS data from clean drivers only. Operates on 15-minute sliding windows with features including GPS variance, max speed delta, zone proximity, delivery rate, and cluster density. Anomalies scoring above 0.7 trigger secondary classification. Retrained weekly on a rolling 30-day window.

Secondary: Gradient Boosted Classifier

Trained on 1,200 labeled fraud cases across 3 months. Classifies anomalies into 5 fraud patterns with a confidence score per pattern. Auto-flag threshold: 0.8 confidence. Achieved 92.3% precision and 88.7% recall with a false positive rate under 8%.