A Cost-Sensitive and Adversarially Robust Decision Layer for Credit-Card Fraud Detection: Cost-Minimising Threshold Selection as a Passive Defence, with a Dual-Verification Ensemble Safeguard

Two questions dominate the operational deployment of a production fraud-detection classifier, and both are usually treated as afterthoughts. First: given a probabilistic score, what threshold converts it into a block/allow decision? The conventional τ = 0.5 is statistically arbitrary for severely imbalanced, asymmetric-cost data such as credit-card fraud. Second: can that decision be trusted when a fraudster actively perturbs their transaction to evade the model? We study both questions as a single operational decision layer, evaluated at a low, cost-aware operating threshold rather than at an arbitrary default. The contribution is the integration and operational evaluation of these components; it is neither a new threshold-selection algorithm nor a demonstrated superiority of the ensemble defence. Threshold selection is an empirical Bayes-risk minimisation (minimising expected cost under an explicit cost matrix, cFP = 1, cFN = 50; we do not model a posterior distribution over τ). On the ULB Kaggle credit-card benchmark, the cost-minimising threshold found by sweeping the test fold is τ* ≈ 0.0047 (cost 602, versus 660 for τ = 0.5 and 653 for Elkan’s closed-form rule, whose calibration assumption fails under this class imbalance). Because this threshold is selected on the same fold on which it is scored, we treat it as a best-case, in-sample operating point; it coincides with a properly resolved test-set oracle (601), and the apparent negative regret against a coarse 1001-point-grid oracle (611) is a grid-resolution artifact. A genuinely out-of-sample check, selecting the threshold by forward-chaining temporal cross-validation on the training and validation data, gives a more modest cost reduction (637 versus 660, about 3.5%), and selection from a single small validation fold can be unstable. Evaluated at the in-sample operating threshold, the classifier is passively robust to LowProFool evasion: recall holds at 0.84 for perturbation budgets ε ∈ {0.5, 1, 2, 4} and falls only at ε ≥ 8, whereas an evaluation at τ = 0.5 would overstate the vulnerability. A Dual-Verification Ensemble (DVE), in which the main classifier decides at the operating threshold and a separate adversarial detector routes suspected perturbed inputs to manual review, adds a small, directionally positive but not statistically significant recall improvement (paired McNemar test, n = 50 attacked frauds), measurable only at ε ≥ 8; its clean-traffic escalation rate is 0.10% of the test fold, yet once a plausible per-review cost is priced in, DVE costs more than the undefended policy on ordinary traffic. A Madry-style adversarial-training baseline shows the expected clean-recall cost without a compensating advantage over DVE at this sample size, and the threshold-selection methodology (not yet the full decision layer) is checked on a second, non-PCA benchmark (BAF). The adversarial evaluation perturbs an anonymised PCA feature space and does not establish that such perturbations correspond to feasible modifications of real transactions. We report these results without inflation: the primary evasion resistance comes from the low cost-aware operating point itself, with DVE as a complementary safeguard against larger-budget attacks. Both components are validated with paired bootstrap confidence intervals and McNemar’s exact test on matched binary decisions. Source code, trained models, and reproducibility scripts are available from the corresponding author upon reasonable request.