Offline risk management pipeline

Abstract

A risk management server may apply a trained risk model to a plurality of user accounts maintained by a service provider to identify a plurality of suspicious user accounts. The risk management server may suspend each of the identified suspicious user accounts from using one or more features provided by the service provider. The risk management server may cure one or more of the suspended user accounts responsive to a successful response to a challenge presented to a user associated with each of the suspended accounts. The risk management server may confirm that each of the uncured suspended user accounts is fraudulent after a period of time without being cured. The risk management server may create training data including the cured user accounts labeled as not fraudulent and the confirmed user accounts labeled as fraudulent. The risk management server may re-train the risk model using the training data.