The economist who priced attention
Herbert Simon named it in 1971, writing about organisations buried in their own reports: a wealth of information creates a poverty of attention. The line is often quoted and rarely followed to its conclusion. Simon's point was not that people get distracted. It was that attention behaves like a budgeted input with an opportunity cost — spend it reading this report and you cannot spend it on that one — and that the design problem for any institution drowning in data is allocation, not acquisition. The cognitive groundwork had already been laid: Donald Broadbent's filter theory in 1958, Norman Mackworth's wartime work on radar watchers, Daniel Kahneman's 1973 model of attention as a divisible pool of effort that runs down under load. Simon's contribution was to turn a psychological fact into an economic one. Information does not serve attention. It competes with it.
Fraud detection is Simon's problem run at industrial scale, decades before anyone called it that. A fraud lead does not lack data. Card networks, core banking systems and device fingerprinting vendors have supplied more signal than any team could read since long before machine learning entered the stack. What the fraud lead lacks, structurally and permanently, is a way to point a finite number of trained eyes at the fraction of that signal that matters before the money leaves.
The same failure, run again
The characteristic failure of fraud operations is depressingly uniform across institutions: the pattern is caught in the quarter after it drained the account. Not because nobody built the detector. Because the detector's output arrived as one alert among thousands, competing with the same alerts every other rule generated, reviewed by an analyst whose attention had already been spent on the ninety before it.
This is not a tooling gap. It is the vigilance decrement, observed under a different name. Mackworth put RAF radar observers in front of a clock hand that occasionally skipped, and detection accuracy fell ten to fifteen percentage points inside the first thirty minutes — not because the signal changed, but because the watcher did. A fraud analyst working a case queue for a four-hour shift is the same organism watching the same kind of intermittent, mostly-null signal. The queue does not care that review quality degrades on a clock. It keeps arriving at the same rate regardless of how tired the eleventh hour has made the reviewer.
Anti-money-laundering monitoring is the sharpest illustration in the industry: systems built to watch everything, returning false positive rates reported above ninety-five per cent in several large-bank reviews. The intake problem was solved decades ago. Every transaction, every counterparty, every device fingerprint can be logged and scored continuously. What was never solved is what happens after intake — and in most deployed systems, "after intake" means an alert, and an alert means a claim on a human's attention that the system has no way to justify or refuse.
Three generations, three answers to "who watches"
Read fraud detection's tooling history against the three-generation lineage and the recurrence stops looking like tooling history and starts looking like an argument.
A model trained once on historical fraud cases — a frozen corpus of chargebacks, confirmed fraud labels, resolved disputes — is the Large Language Model position applied to this domain. It is genuinely useful: it encodes years of adjudicated pattern that no individual analyst could hold in memory. But it is pull-based. Someone still has to run the query, still has to decide that this transaction, this merchant, this moment is worth asking about. The model does not watch the stream. It waits to be consulted, and the account has usually finished draining by the time anyone thinks to consult it.
A system that ingests the live transaction stream, the device signals and the immediate network graph for a bounded window — a session, a merchant's traffic for the day, a card's activity over seventy-two hours — is the Large World Model position. This is closer to where most fraud actually gets stopped: velocity checks, device-reuse detection, graph clustering on a recent slice of transactions. It relieves watching inside that window, which is exactly where Mackworth's decrement would otherwise bite hardest on a human reviewer. But the window has to be chosen. Somebody decides that seventy-two hours is the frame, that this network of accounts is the one worth building a graph over. The scarcity has not gone; it has moved up one level, into the choice of where to point the scene.
The arrangement defined by continuous intake across every transaction stream, every device signal, every network edge and every chargeback feed simultaneously, with no window and no stopping point, held as beliefs that update and decay rather than facts fixed at ingest, is the Large Universe Model position. It is not a claim that such a system is deployed anywhere as a finished product. It is a claim about what the intake axis terminates in: a state where a merchant's risk score, a device's trust level and an account's exposure are never re-derived from scratch on demand but are always-already current, carrying a timestamp for when they were last confirmed and a decay function for how much to trust them now.
| generation | what it watches | who chooses the frame | where scarcity reappears |
|---|---|---|---|
| Large Language Model | historical case corpus | analyst, at query time | noticing the case is worth asking about |
| Large World Model | a bounded stream — session, merchant-day, recent graph | analyst or rule author, at design time | choosing which window to build |
| Large Universe Model | every stream, continuously, with provenance | nobody, at intake — adjudication moves downstream | deciding which belief earns a human minute |
The lineage terminates here because the categories of evidence are exhausted, not because ambition runs out. A frozen corpus, a chosen scene, everything still running: there is no fourth kind of intake to invent. What is left after this rung is not more watching. It is scale, trust and the calibration of what gets shown to whom.
The objection with real teeth: this just moves the bill
Watching ten thousand feeds in real time is not free. Compute, storage, and the bandwidth to move device telemetry and network graphs at that rate cost money that a fraud programme has to defend every budget cycle. You have not eliminated a scarce resource. You have relabelled it.
This is correct as far as it goes, and fraud teams feel it directly: continuous graph computation over a growing transaction network is not a rounding error on the infrastructure bill. But the two scarcities are not the same shape, and the difference matters for how each should be managed. Machine watching is purchasable and divisible — double the compute budget and you roughly double the coverage or the update frequency, and an underfunded stream degrades gracefully to coarser sampling rather than vanishing. Human vigilance does none of this. An analyst's attention cannot be bought in half-units, it declines measurably within the first thirty to sixty minutes of a monitoring shift regardless of salary, and it does not survive a handover between reviewers without loss — a case reopened by a second analyst starts most of the way back at zero context. A fraud programme can budget its way out of a compute constraint. It cannot budget its way out of a fatigue constraint. Treating them as interchangeable is how institutions end up buying more infrastructure while their actual bottleneck — analyst minutes at the point of decision — stays exactly as scarce as before.
The objection that actually bites: flood is not relief
Every fraud team that has "solved" observation with more rules has produced more alerts, and the analyst drowns in exactly the volume that continuous watching was supposed to spare them. This is the alarm fatigue pattern from Milford Haven and hospital telemetry, arriving on schedule. Cheaper watching produces more things watched.
This is the strongest objection available and it describes real, currently deployed fraud stacks, not a hypothetical. EEMUA 191 set an explicit target of roughly one alarm per operator per ten minutes in industrial control because the Texaco refinery operators facing 275 alarms in eleven minutes before an explosion were not under-instrumented, they were unreachable. Fraud queues running thousands of daily alerts per analyst, most closed as false positives, are the same failure in a different plant.
The distinction that survives this objection is between intake and interruption. A Large Universe Model, as argued here, is characterised by maintained, provenance-bearing belief — a merchant's current risk state, a device's current trust score, an account's current exposure, each timestamped and decaying — not by an obligation to announce every update to a person. Whether a belief crosses into an analyst's attention is a separate, calibrated decision with a cost attached to it, weighed against the analyst's remaining budget for the shift. Systems that collapse that distinction, that treat every score change as an alert, reproduce the flood and deserve the criticism. That is a failure of interface design sitting on top of the intake layer. It is not evidence that continuous intake is the wrong thing to build. It is evidence that intake without an adjudication layer is only half the argument, and the half fraud vendors have historically shipped first because it is the easier half to build.