Compliance monitoring · Production

DoorDash builds anomaly detection platform to surface fraud trends in under three days

The problem

DoorDash's fraud team was reactive, only discovering new fraud trends after they had grown unchecked for weeks and begun impacting top-line metrics; the average time-to-detect exceeded 100 days.

Workflow diagram · grounded in source
1
Airflow daily job trigger
trigger
“The anomaly detection platform shown in Figure 1 runs as a daily job coordinated by Airflow to look for fraud trends that are growing on a day-to-week timescale.”
2
Data warehouse ETL prep
integration
“The Airflow directed acyclic graph prepares the dataset for each anomaly detection job containing the day's data snapshot in wide-table format.”
3
Segment metric aggregation
integration
“We compute the metric aggregates using DuckDB, which is an in-memory Python database optimized for fast online analytical processing operations. We chose DuckDB because it is much faster — less than 10 minutes”
4
Z-score anomaly detection
ai_action
“We chose a simple moving-window z-score algorithm, which performed well in testing to detect all of our historical fraudulent trends. The first 21 days of each time series form the baseline, and the 28th day is the test day.”
5
Hierarchical cluster grouping
ai_action
“we group partially overlapping anomalous segments using a custom hierarchical clustering algorithm”
6
Ops agent investigation
human_review
“The agents review example deliveries or assignments within the representative anomalous segment, looking for common trends or patterns that may represent a new fraud trend.”
7
Fraud response routing
routing
“Trends that are deemed to be fraudulent are root-caused in partnership with engineering and product teams, so that the root cause can be addressed. Meanwhile, a separate containment team runs queries to identify and stop fraudsters match…”
Reported outcome

The platform now surfaces more than 60% of all new fraud trends, reduced average time-to-detect from more than 100 days to less than three days, and saves tens of millions of dollars per year.

Reported metrics
Share of new fraud trends found via platformMore than 60%
Average time-to-detect new fraud trends (current)less than three days
Average time-to-detect new fraud trends (prior)more than 100 days
Annual cost savings from fraud preventiontens of millions of dollars per year
Show all 6 reported metrics
share of new fraud trends found via platformMore than 60%
average time-to-detect new fraud trends (current)less than three days
average time-to-detect new fraud trends (prior)more than 100 days
annual cost savings from fraud preventiontens of millions of dollars per year
daily anomalous clusters surfaced for review20 to 60 anomalous clusters per day
recall on historical test fraud trends100%
Reported stack
AirflowDuckDBSparkPython
Source
https://careersatdoordash.com/blog/doordash-anomaly-detection-platform-to-catch-fraud-trends/
Read source ↗

Frequently asked questions

What did this team achieve with this AI workflow?

The platform now surfaces more than 60% of all new fraud trends, reduced average time-to-detect from more than 100 days to less than three days, and saves tens of millions of dollars per year.

What tools did this team use?

Airflow, DuckDB, Spark, Python.

What results were reported?

Share of new fraud trends found via platform: More than 60%; Average time-to-detect new fraud trends (current): less than three days; Average time-to-detect new fraud trends (prior): more than 100 days; Annual cost savings from fraud prevention: tens of millions of dollars per year (source-reported, not independently verified).

How is this compliance monitoring AI workflow structured?

Airflow daily job trigger → Data warehouse ETL prep → Segment metric aggregation → Z-score anomaly detection → Hierarchical cluster grouping → Ops agent investigation → Fraud response routing.

Related compliance monitoring cases