I would also add that even if these cases aren't noise, they're the ones that are easiest to detect due to their "strangeness". The followup question is then w

I would also add that even if these cases aren't noise, they're the ones that are easiest to detect due to their "strangeness". The followup question is then whether these cases are representative of all fraud or are just the easy ones to spot. To answer that, you probably need to cross-validate with signals besides just transaction logs, e.g. evidence from a physical raid or insider tips. Otherwise, it seems like you're bound to miss the skillful frauds.