In this article by Andrea Cirillo, author of the book RStudio for R Statistical Computing Cookbook, has explained how to detect fraud on ecommerce orders.
Benford’s law is a popular empirical law that states that the first digits of a population of data will follow a specific logarithmic distribution.
This law was observed by Frank Benford around 1938 and since then has gained increasing popularity as a way to detect anomalous alteration of population of data.
Basically, testing a population against Benford’s law means verifying that the given population respects this law. If deviations are discovered, the law performs further analysis for items related to those deviations.
In this recipe, we will test a population of ecommerce orders against the law, focusing on items deviating from the expected distribution.
(For more resources related to this topic, see here.)
Getting ready
This recipe will use functions from the welldocumented benford.analysis package by Carlos Cinelli.
We therefore need to install and load this package:
install.packages("benford.analysis")
library(benford.analysis)
In our example, we will use a data frame that stores ecommerce orders, provided within the book as an .Rdata file.
In order to make it available within your environment, we need to load this file by running the following command (assuming the file is within your current working directory):
load("ecommerce_orders_list.Rdata")
How to do it…
 Perform Benford test on the order amounts:
benford_test < benford(ecommerce_orders_list$order_amount,1)
 Plot test analysis:
plot(benford_test)
This will result in the following plot:
 Highlights supectes digits:
suspectsTable(benford_test)
This will produce a table showing for each digit absolute differences between expected and observed frequencies. The first digits will therefore be more anomalous ones:
> suspectsTable(benford_test)
digits absolute.diff
1: 5 4860.8974
2: 9 3764.0664
3: 1 2876.4653
4: 2 2870.4985
5: 3 2856.0362
6: 4 2706.3959
7: 7 1567.3235
8: 6 1300.7127
9: 8 200.4623

Define a function to extrapolate the first digit from each amount:
left = function (string,char){ substr(string,1,char)}
 Extrapolate the first digit from each amount:
ecommerce_orders_list$first_digit < left(ecommerce_orders_list$order_amount,1)
 Filter amounts starting with the suspected digit:
suspects_orders < subset(ecommerce_orders_list,first_digit == 5)
How it works
Step 1 performs the Benford test on the order amounts. In this step, we applied the benford() function to the amounts. Applying this function means evaluating the distribution of the first digits of amounts against the expected Benford distribution.
The function will result in the production of the following objects:
Object 
Description 
Info 
This object covers the following general information:

Data 
This is a data frame with the following subobjects:

s.o.data 
This is a data frame with the following subobjects:

Bfd 
This is a data frame with the following subobjects:

Mantissa 
This is a data frame with the following subobjects:

MAD 
This object depicts the mean absolute deviation. 
distortion.factor 
This object talks about the distortion factor. 
Stats 
This object lists of htest class statistics as follows:

Step 2 plots test results. Running plot on the object resulting from the benford() function will result in a plot showing the following (from upperleft corner to bottomright corner):
 First digit distribution
 Results of secondorder test
 Summation distribution for each digit
 Results of chisquared test
 Summation differences
If you look carefully at these plots, you will understand which digits show up a distribution significantly different from the one expected from the Benford law. Nevertheless, in order to have a sounder base for our consideration, we need to look at the suspects table, showing absolute differences between expected and observed frequencies. This is what we will do in the next step.
Step 3 highlights suspects digits. Using suspectsTable() we can easily discover which digits presents the greater deviation from the expected distribution.
Looking at the socalled suspects table, we can see that number 5 shows up as the first digit within our table. In the next step, we will focus our attention on the orders with amounts having this digit as the first digit.
Step 4 defines a function to extrapolate the first digit from each amount. This function leverages the substr() function from the stringr() package and extracts the first digit from the number passed to it as an argument.
Step 5 adds a new column to the investigated dataset where the first digit is extrapolated.
Step 6 filters amounts starting with the suspected digit.
After applying the left function to our sequence of amounts, we can now filter the dataset, retaining only rows whose amounts have 5 as the first digit. We will now be able to perform analytical, testing procedures on those items.
Summary
In this article, you learned how to apply the R language to an ecommerce fraud detection system.
Resources for Article:
Further resources on this subject:
 Recommending Movies at Scale (Python) [article]
 Visualization of Big Data [article]
 Big Data Analysis (R and Hadoop) [article]