Payment fraud prevention requires sub-100ms latency ML inference on every transaction. System architecture: transaction event -> Kafka -> real-time feature engineering (Flink) -> feature store -> model inference (<10ms) -> risk decision -> allow/deny/3DS challenge. Feature engineering: 1) Velocity features: count of transactions in last 1min, 5min, 1hr, 24hr per card/user/merchant. 2) Statistical features: transaction amount vs user historical average, merchant category historical rates. 3) Network features: device fingerprint seen at fraud before, IP geolocation risk score. 4) Behavioral biometrics: typing patterns, mouse movements for high-risk transactions. Model ensemble: 1) Gradient boosting (XGBoost/LightGBM): fast inference (1ms), handles tabular features well, interpretable with SHAP values. 2) Graph Neural Network: models relationships between cards, merchants, devices, accounts. Detects organized fraud rings invisible to per-transaction models. 3) LSTM sequence model: transaction history sequence to detect account takeover patterns. Ensemble with stacking or weighted average. Explainability for compliance: SHAP values for top fraud factors per transaction. Required for card network compliance and dispute resolution. Threshold optimization: minimize expected cost = fraud_loss * FNR + dispute_cost * FPR + friction_cost * FPR. Tune threshold per risk tier using cost matrix.