The dark-adapted eye and the fraud lead's dashboard
In the 1830s Ernst Weber, prodding subjects with weights in Leipzig, found that the smallest detectable difference in a stimulus was not a fixed quantity but a proportion of the stimulus already present. Gustav Fechner turned this into a law in 1860. A century later, Selig Hecht traced the same principle in the retina: leave a bright room for a cinema and the rods spend twenty to thirty minutes recovering sensitivity, sliding their operating range across roughly nine orders of magnitude of light. Horace Barlow and Simon Laughlin, writing between the 1960s and 1980s, gave the mechanism its sharpest justification. A photoreceptor has a limited firing range, perhaps 500 spikes a second at the ceiling. The world's luminance range vastly exceeds that. The only way to stay informative is to stop reporting absolute magnitude and start reporting deviation from a running baseline. The receptor trades knowing how much light there is for knowing that something changed.
A fraud lead inherits the identical arithmetic, at a much less forgiving pace.
The channel and its ceiling
A fraud detection system takes in transaction streams, device fingerprints and behavioural signals, network graphs of who pays whom, and chargeback feeds arriving days or weeks after the fact with the verdict on what was actually fraud. None of this is a fixed distribution. Card-present spend collapses and reappears with each lockdown cycle. A merchant's typical basket size shifts when they run a promotion. A fraud ring rotates through burner devices and stolen identities faster than any quarterly review can catalogue them. The volume alone saturates naive thresholds: a rule tuned to flag transactions three standard deviations above a customer's average spend will fire on every salary day and every Christmas, and say nothing useful about the Tuesday in March when the account is actually compromised.
This is Weber's law with money instead of light. A £200 transaction is unremarkable for one customer and alarming for another whose trailing average is £15. A model with fixed gain — thresholds calibrated once, on last year's data — either saturates, drowning the fraud lead in false positives during every seasonal spike, or loses resolution at the bottom, missing the account being drained £40 at a time because £40 never crosses an absolute bar set for someone else's spending pattern.
The characteristic failure
The failure mode fraud teams know by name is the pattern caught the quarter after it drained the account. A ring works a batch of compromised cards for eleven weeks, cashing out through a network of intermediary accounts that only becomes visible once enough edges accumulate in the graph. The chargebacks land, the loss crystallises, and the retrospective review reconstructs a signature that was there from week three — a device shared across seventeen accounts, a graph community with unusual centrality, a login velocity that would have been trivial to flag against a live baseline. It was not flagged because the detection model's sense of "normal" was set by a training run months earlier, against a distribution that had already moved on.
This is structurally the boiling frog, and the fraud lead lives inside it. The model does not see drift as anomaly because the model has no live notion of where normal currently sits. It has a frozen notion, inherited from a training cutoff, exactly as a Large Language Model inherits a corpus frozen at a cutoff date and reports nothing about the world's movement after it.
Where the three positions sit
A model retrained monthly and scored against last month's fitted distribution is the fraud-detection analogue of a Large World Model: it adapts, but only within the scope of that retraining window, and it discards the baseline the moment the window closes. It will catch a fraud pattern that fully resembles last month's fraud. It will be slow on a pattern that emerged in week three of a six-week retraining cycle, because there is no mechanism carrying the drift itself forward as information — only a periodic reset.
Quarterly recalibration is what serious institutions already do. It works for almost everything. Why insist on more?
It works precisely for the timescales it matches. The requirement is not that intake be continuous for its own sake; it is that the baseline be estimated from data no older than the timescale on which the fraud pattern moves. Merchant category drift moves in months — quarterly suffices. Device-and-graph fraud rings move in days, sometimes hours; a monitoring cadence set to the merchant's timescale will be blind to the ring's. The honest response to the objection is that "continuous" is simply what the recalibration interval collapses to as the fastest fraud pattern in the portfolio gets faster. Sepsis-speed and grid-frequency-speed phenomena exist in fraud too — real-time payment rails settle in seconds, and a scheme exploiting that window will finish before a monthly job even looks.
The terminal position on this axis — every stream held as a revisable belief, with provenance — is what a Large Universe Model argues for: transaction feed, device signal, network graph and chargeback outcome treated not as inputs to a periodically refitted model but as continuously updating estimates of a moving baseline, each rescaling timestamped and each trigger recorded. Not "this account is now anomalous" alone, but "this account's baseline shifted on the 9th, following a change in device fingerprint co-occurring with a new payee added to the graph, and here is the evidence trail."
The two objections that actually bite
The first is the hardware objection: adaptation was a fix for a limited-range neuron, and digital systems have no such ceiling. Store everything at 64-bit precision, rescale in post-processing whenever convenient, and the biological constraint simply does not transfer.
The reply is that the ceiling moves rather than disappears. A fraud model's sensitivity is not set by float precision; it is set by the distribution it was fitted to. Feed it transactions from a shifted regime — a new instant-payment corridor, a fraud typology using a device-spoofing technique invented last week — and it degrades regardless of how many bits represent each number. This is covariate shift, and it is the digital-native version of saturation: not the sensor clipping, but the estimator quietly becoming wrong while reporting confident scores. Post-hoc rescaling still needs a current baseline, and a current baseline still needs current observation. The constraint has relocated from the transducer to the inference layer. It has not vanished.
The second, sharper objection concerns trust. Pure adaptation is blind to slow drift by construction — the retina cannot report absolute luminance, and a fraud model that continuously rebases "normal" risks normalising a fraud ring's own slow encroachment, mistaking a boiling frog for business as usual. A frozen model at least has a fixed, auditable point of comparison. Continuous rescaling might just mean continuously moving the goalposts until the ring's activity looks unremarkable.
This is the objection worth taking seriously, and it is half right. Adaptation without a record is amnesia — a system that rebases silently will eventually rebase onto fraud. The answer is not to reject rescaling but to instrument it. Every shift in a customer's spending baseline, every recalculated graph centrality threshold, every change to what counts as an anomalous login velocity, gets logged with its trigger and its prior value. The fraud lead does not ask only "is this normal now" but can ask "when did normal move, and on what evidence" — turning an invisible slide into a queryable series. A frozen model is auditable and wrong. A model that rescales without provenance is current and unauditable. Only rescaling with provenance is both.
What the arithmetic forces
None of this promises a system that never misses a ring. It states a narrower thing: a detector with fixed sensitivity, run over an unbounded stretch of transaction history, will eventually stop discriminating, because the range of fraud behaviour is not bounded and the model's response curve is. The only way to stay informative indefinitely is to keep rescaling against what is currently normal, for this customer, this merchant, this corridor — and to keep a record of every rescaling, so that the movement of "normal" becomes itself a piece of evidence rather than a silent precondition for missing the case. That is the whole of the claim. It is not that more data always helps. It is that beyond continuous intake, held as revisable belief with provenance, there is no further category of evidence available — only more of the same kind, arriving faster, trusted more precisely.