There is a failure mode in financial machine learning that is so common, and so well-disguised, that we’ve come to treat encountering it as a signal in its own right — a signal that we’ve made a mistake. We call it the scale trap. It is the tendency of absolute and cumulative quantities to encode company size while looking, to the untrained eye, like they encode wrongdoing.

We want to describe it carefully, because we’ve now walked into it from three completely different directions, and each time it wore a different disguise.

The shape of the trap #

Start with the underlying fact: large, mature companies have larger everything. More employees, more subsidiaries, more board interlocks, more insider transactions, more cumulative filings, more of every countable thing. This is not surprising. It is almost definitional. Size is, among other things, the accumulation of quantity over time.

Now suppose you want to build a fraud signal and you reach for an absolute quantity — total insider selling, say, or the cumulative number of related-party transactions, or some centrality measure in a relationship graph. You run it across the market, you sort, and the top of your list fills up with large companies. If your training labels happen to correlate with size — and enforcement-derived labels almost always do, because the companies that end up in enforcement actions tend to be large enough and long-lived enough to accumulate both the misconduct and the scrutiny — your model will happily learn that “big” predicts “bad.”

It will report excellent performance. And it will be measuring nothing but scale.

Three disguises #

The first time we met this, it was in a graph built around shared auditors. The intuition was reasonable: companies connected through audit relationships might share risk. But the structure of the graph turned out to be driven by audit-firm size, and the signal it produced was a near-random reflection of that structure rather than anything about fraud. Pruning and reweighting didn’t rescue it. The signal simply wasn’t there; what looked like structure was scale.

The second time, it was a graph of insider relationships — directors and officers connected through the companies whose boards they sit on. Here the edges were built from real filings and were genuinely independent of any label. And still the trap closed. Companies in our enforcement-derived label set had systematically higher connection counts, and when we normalized for it, the reason was plain: those companies were simply older and larger. Older companies have filed for longer and accumulated more relationships. Larger companies have boards whose members sit on more other boards. The elevated centrality was survivorship and size, not fraud. A model trained on it would learn “well-connected, established company” and dress it up as “likely fraud.” We tested several variants — different time windows, different relationship filters, stratifying by size — and the contamination narrowed but never disappeared.

The third time, it was the simplest possible signal: flag companies where insiders are selling heavily. Run it with absolute dollar thresholds and you get a flood of alerts, and the alerts are exactly what you’d predict — large companies whose executives are selling large amounts because the companies are large. Real selling, entirely ordinary, no signal at all.

How to escape it #

The escape, in every case, is the same move, and it’s the same move that organizes our whole detection philosophy: stop measuring absolute quantity and start measuring deviation from a thing’s own baseline.

For the insider-selling signal, that meant abandoning dollar thresholds entirely. Instead of asking “is this a lot of selling?” we ask “is this company’s insider selling abnormal relative to its own history?” A company that typically sees modest, routine insider activity and then suddenly shows a cluster of executives selling at many times its own historical rate — that is a relative anomaly. It is anchored to the company’s own past, not to an absolute dollar figure, and so it is automatically free of the size bias. The change cut the alert volume by roughly an order of magnitude and, far more importantly, changed what was being flagged: not the biggest sellers, but the genuinely unusual ones. As a bonus, it naturally excludes situations like post-IPO lockup expiries, where there is no prior history to deviate from.

The same principle resolved the graph problems, though the resolution there was harsher: when the only thing a relationship structure reliably encodes is size, the honest conclusion is that the structure is not a fraud signal, and the right thing to do is to stop using it for that purpose. We treat that decision as its own discipline.

The general rule we’ve drawn from all of this: any absolute or cumulative quantity, used directly as a signal, is measuring size until proven otherwise. The burden of proof is on the signal. The correct form is almost always relative — abnormal with respect to the entity’s own baseline — and that form, not coincidentally, is exactly the same instinct as looking for internal contradictions rather than external outliers. Both refuse to let the size of the comparison set do the talking.