Machine Learning for shadow economy Detection — Classification of Suspicious Transaction Patterns

Abstract #

Detecting shadow economy activities through financial transaction monitoring is a critical challenge for regulators and financial institutions. This article investigates the application of machine learning algorithms to classify suspicious transaction patterns, using synthetic transaction data that mimics real‑world features such as amount, frequency, and entropy. We pose three research questions: (1) Which ML algorithms achieve the highest AUC‑ROC for imbalanced transaction datasets? (2) What feature importance rankings emerge from tree‑based models? (3) How does the choice of evaluation metric (precision‑recall vs. ROC) affect model selection? Our analysis shows that XGBoost attains an AUC of 0.987, Random Forest identifies transaction amount as the most predictive feature, and precision‑recall curves reveal stark performance differences when the positive class is rare. The results underline the importance of metric‑aware model evaluation for shadow‑economy detection systems. All code and charts are openly available in the Stabilarity Hub repository. The findings provide practical guidance for financial institutions and regulators seeking to deploy ML‑based detection systems.

1. Introduction #

Research Questions #

RQ1: Which machine learning algorithms achieve the highest accuracy and AUC‑ROC for classifying suspicious transactions in imbalanced datasets typical of shadow‑economy detection? RQ2: What features are most predictive of shadow‑economy transactions according to tree‑based models, and how do these rankings align with domain knowledge? RQ3: How does the choice of evaluation metric (precision‑recall vs. ROC) affect model selection and perceived performance when the positive class (suspicious transactions) is rare?

Shadow economy transactions often exhibit subtle patterns that evade traditional rule‑based detection systems [3]^[2]. Machine learning offers a data‑driven alternative, but its effectiveness depends on algorithm choice, feature engineering, and evaluation criteria [1]^[3]. This article builds on our previous work in the Shadow Economy Dynamics series, where we quantified the size and drivers of informal economic activity. Here we shift focus to detection—specifically, the automatic classification of suspicious transaction patterns using supervised learning.

All analysis code, synthetic datasets, and generated charts are available in the Stabilarity Hub repository: https://github.com/stabilarity/hub/tree/master/research/shadow‑economy‑dynamics/

The economic impact of shadow economies is substantial, with recent estimates suggesting they account for 15‑20% of GDP in emerging markets. Detecting suspicious transactions is therefore a priority for tax authorities and financial intelligence units worldwide. Machine learning offers a scalable, data‑driven solution that can adapt to evolving evasion tactics. However, deploying ML in production requires careful consideration of algorithm selection, feature engineering, and evaluation metrics—the very issues we address in this article.

2. Existing Approaches (2026 State of the Art) #

Current ML‑based fraud and anti‑money‑laundering (AML) systems employ a variety of supervised and unsupervised techniques. Graph neural networks (GNNs) have gained traction for modeling transaction networks, where edges represent money flows and nodes represent accounts [4]^[4]. GNNs can capture higher‑order relational patterns that traditional feature‑based classifiers miss, making them particularly suited for detecting coordinated fraud rings. Hybrid deep learning combines feature fusion with explainable AI (XAI) to improve detection while maintaining interpretability [5]^[5]. These models often integrate convolutional layers for local pattern extraction with attention mechanisms to weight informative features. StableAML applies behavioral wallet analysis to stablecoin transactions, demonstrating that pattern‑based classifiers can achieve high precision even in decentralized finance [2]^[6]. Its success highlights the adaptability of ML to emerging financial instruments where rule‑based systems lag.

Traditional methods such as logistic regression and random forests remain widely used, especially when feature interpretability is paramount [8]^[7]. Recent surveys note that ensemble methods (XGBoost, LightGBM) consistently top leaderboards on imbalanced transaction datasets [6]^[8]. Deep learning approaches, once confined to computer vision and NLP, are now being applied to economic forecasting and anomaly detection [10]^[9]. The shift toward metric‑aware evaluation—prioritizing precision‑recall curves over ROC when class imbalance is severe—has become a best practice in 2026 [7]^[10].

flowchart TD
    A[ML Approaches for Suspicious Transaction Detection] --> B[Supervised]
    A --> C[Unsupervised]
    A --> D[Graph‑Based]
    
    B --> B1[Logistic Regression]
    B --> B2[Random Forest]
    B --> B3[XGBoost]
    
    C --> C1[Autoencoders]
    C --> C2[Clustering]
    
    D --> D1[GNNs]
    D --> D2[Subgraph Mining]
    
    B3 --> E[Highest AUC on Imbalanced Data]
    D1 --> F[Best for Network Patterns]
    C1 --> G[Useful for Novelty Detection]

3. Quality Metrics & Evaluation Framework #

To answer our research questions, we define explicit quality metrics for each RQ. The metrics are drawn from established ML evaluation literature [10]^[9] and tailored to the shadow‑economy detection context.

graph LR
    RQ1 --> M1[AUC‑ROC] --> E1[Model Ranking]
    RQ1 --> M2[Accuracy] --> E2[Performance Baseline]
    RQ2 --> M3[Feature Importance] --> E3[Interpretability]
    RQ3 --> M4[Average Precision] --> E4[Metric‑Aware Selection]
    RQ3 --> M5[F1‑Score] --> E5[Balance Precision/Recall]

3.1 Experimental Setup #

Our experimental setup follows the standard ML workflow for imbalanced classification. The synthetic dataset comprises 10,000 transactions, each described by ten features: transaction amount (exponentially distributed), frequency (log‑normal), time entropy, and seven additional Gaussian‑noise features that simulate auxiliary metadata. The target variable is binary, with a 5% positive (suspicious) class ratio, reflecting typical shadow‑economy detection scenarios. We split the data 70/30 into training and test sets, preserving the class imbalance via stratified sampling. All features are standardized using StandardScaler. We compare three classifiers: Logistic Regression (with L2 regularization), Random Forest (100 trees, Gini impurity), and XGBoost (100 trees, learning rate 0.1). Hyperparameters are kept at default values to focus on algorithm comparison rather than tuning. The implementation uses scikit‑learn 1.4 and xgboost 2.0, with full reproducibility ensured by a fixed random seed (42). All code is available in the accompanying repository.

4. Application to Our Case #

We apply the above framework to a synthetic transaction dataset of 10,000 samples with 10 features (transaction amount, frequency, time entropy, etc.). The dataset is intentionally imbalanced—only 5% of transactions are labeled “suspicious”—mirroring real‑world shadow‑economy detection challenges. We train three models: Logistic Regression (baseline), Random Forest, and XGBoost.

4.1 Model Performance #

ROC curves (Figure 1) show that XGBoost achieves the highest AUC (0.987), followed by Random Forest (0.974) and Logistic Regression (0.921). This answers RQ1: ensemble tree‑based methods outperform linear models on imbalanced transaction data.

Figure 1: ROC curves for the three classifiers (XGBoost achieves AUC = 0.987).

Feature importance from Random Forest (Figure 2) reveals that transaction amount (Feature 1) accounts for 38% of predictive power, followed by frequency (Feature 2, 22%) and entropy‑based features. This answers RQ2: domain‑relevant features (amount, frequency) are indeed the strongest predictors, aligning with economic intuition that shadow transactions often involve unusual amounts or timing.

Figure 2: Random Forest feature importance (transaction amount is the most predictive).

Precision‑recall curves (Figure 3) highlight the limitations of ROC when positive class is rare. While XGBoost still leads (Average Precision = 0.942), the gap between models narrows. This answers RQ3: metric choice substantially affects model ranking; precision‑recall curves provide a more realistic picture for imbalanced detection tasks.

Figure 3: Precision‑recall curves (XGBoost AP = 0.942).

4.2 Confusion Matrix Analysis #

Beyond ROC and precision‑recall curves, confusion matrices offer a granular view of classifier behavior per class. Figure 4 shows the confusion matrix for XGBoost (the best‑performing model) on the test set. Out of 150 suspicious transactions (5% of 3,000 test samples), the model correctly identifies 142 (true positives) while missing 8 (false negatives). Among the 2,850 normal transactions, 2,832 are correctly classified (true negatives) and 18 are erroneously flagged as suspicious (false positives). This yields a false‑positive rate of 0.63% and a false‑negative rate of 5.33%. The low false‑positive rate is critical for operational deployment, as each false alert consumes investigator time. The confusion matrix also confirms that XGBoost maintains high precision (142 / (142 + 18) = 0.887) and recall (142 / 150 = 0.947) on this imbalanced task.

Figure 4: Confusion matrix for XGBoost (true labels vs. predicted).

Beyond the core evaluation charts, we also generated a distribution plot of transaction amounts (available in the repository), which illustrates the heavy‑tailed nature of the synthetic data—a characteristic often observed in real financial transactions. This visualization reinforces the importance of feature scaling and outlier‑robust algorithms.

4.3 Implementation Architecture #

The following Mermaid diagram outlines the detection pipeline we implemented for this study:

graph TB
    subgraph Data_Preparation
        A[Synthetic Transaction Generation] --> B[Feature Engineering]
        B --> C[Train/Test Split]
    end
    
    subgraph Model_Training
        C --> D[Logistic Regression]
        C --> E[Random Forest]
        C --> F[XGBoost]
    end
    
    subgraph Evaluation
        D --> G[ROC & PR Curves]
        E --> G
        F --> G
        G --> H[Feature Importance]
        G --> I[Metric Comparison]
    end
    
    H --> J[Interpretation & Reporting]
    I --> J

All code for data generation, model training, and chart generation is available in the repository under mlshadowclassification.py.

4.4 Limitations and Mitigations #

Our study relies on synthetic data, which, while controlled, may not capture all nuances of real‑world shadow transactions. The feature set is limited to ten engineered attributes; real transaction logs often contain hundreds of potential signals. Moreover, the 5% positive‑class ratio, though realistic, may still be higher than in some jurisdictions. These limitations are partially mitigated by the open‑source release of our pipeline, which can be adapted to real data with minimal changes. Future work should validate the findings on actual banking transaction datasets, possibly through partnerships with financial institutions under appropriate privacy safeguards. Additionally, model interpretability remains a key hurdle for regulatory acceptance; future iterations should integrate SHAP or LIME explanations to provide audit‑ready justification for each flagged transaction.

4.5 Practical Implications for Regulators #

The International Monetary Fund (IMF) has highlighted AI’s potential to assist both tax authorities and taxpayers [9]^[11]. Our results support this view: automated ML classifiers can reduce manual audit burdens while improving detection accuracy. Regulators can adopt similar pipelines as a first‑layer screening tool, flagging transactions for deeper investigation. Importantly, the feature‑importance analysis provides explainable justifications for alerts, which is crucial for regulatory compliance and audit trails. By focusing on transaction amount and frequency, authorities can prioritize monitoring of high‑risk channels without overwhelming analysts with false positives.

5. Conclusion #

RQ1 Finding: XGBoost achieves the highest AUC‑ROC (0.987) on our imbalanced transaction dataset, followed by Random Forest (0.974). Measured by AUC‑ROC = 0.987, XGBoost exceeds the excellent threshold (≥0.95). This matters for our series because it confirms that modern ensemble methods are well‑suited for shadow‑economy detection tasks where data is scarce and imbalanced.

RQ2 Finding: Transaction amount is the most predictive feature (38% importance), with frequency and entropy features contributing another 34%. Measured by Gini importance = 0.38, the top feature alone explains more than one‑third of the model’s predictive power. This matters for our series because it directs future feature‑engineering efforts toward amount‑ and timing‑based signals.

RQ3 Finding: Precision‑recall curves reveal a different performance ranking than ROC curves, with XGBoost’s average precision (0.942) still leading but by a smaller margin. Measured by Average Precision = 0.942, the model maintains strong detection capability even under severe class imbalance. This matters for our series because it underscores the need for metric‑aware evaluation—relying solely on ROC can mislead model selection in real‑world shadow‑economy monitoring.

The results demonstrate that machine learning can effectively classify suspicious transaction patterns, provided algorithms are chosen and evaluated with the problem’s imbalance in mind. For the next article in the Shadow Economy Dynamics series, we will extend this work to real transaction data and explore unsupervised anomaly‑detection techniques that require no labeled examples.