---
title: "Unsupervised Learning"
url: "https://mahouse.world/glossary/unsupervised-learning"
type: "glossary term"
topic: "Training"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# Unsupervised Learning

Unsupervised learning is machine learning on data that carries no labels: the model finds structure on its own — clusters of similar customers, transactions unlike the rest, a compressed representation that captures what varies — rather than a mapping to answers someone provided. Clustering, anomaly detection, dimensionality reduction and the self-supervised pre-training of foundation models are its forms; it needs no labelling, and it produces structure that has to be interpreted rather than answers that can be scored.

**Also known as:** Unsupervised machine learning, Clustering, Anomaly detection, Dimensionality reduction

## Key facts

- **Used at:** customer and merchant segmentation, anomaly detection in transactions and systems (unusual patterns with no confirmed label), fraud-ring discovery (clusters of linked accounts), data exploration, feature learning, embeddings, and the pre-training of language and vision models, which is self-supervised — labels derived from the data itself
- **Binding:** none specific; segmentation used for decisions about customers falls under the same fairness and data-protection rules as any profiling
- **Typical methods:** k-means and hierarchical clustering; density-based clustering (DBSCAN); isolation forests and autoencoders for anomalies; principal component analysis and UMAP for dimensionality reduction; graph methods for linked-entity discovery; and next-token or masked prediction for self-supervised pre-training
- **Typical outputs:** groups, scores of unusualness, or representations — none of which says "fraud" or "good customer" until a person or a downstream supervised model interprets them
- **Typical uses in fraud:** catching what has never been labelled — a new typology appears as a cluster of anomalies before any case is confirmed; the anomalies become the labels for the next supervised model
- **Parties:** data scientists, the analysts who interpret clusters and anomalies, and the risk teams that decide what to do with structure that has no name

## How unsupervised learning works in practice

A payments company has 40 million transactions a month and confirmed fraud labels for a fraction of them, all of known types. An anomaly detector — an isolation forest, or an autoencoder that learns to reconstruct normal transactions and fails on abnormal ones — scores every transaction by how unlike the rest it is. Most anomalies are benign oddities; some are a fraud pattern the supervised model was never trained on, because nobody had labelled it yet. Analysts review the top anomalies weekly, confirm the new pattern, and the confirmations become labels. That is the standard pairing: unsupervised methods find what is new, supervised ones learn to catch it at scale.

Clustering serves the commercial side. Grouping merchants by transaction behaviour — ticket size, hours, growth, refund rate, customer mix — without predefined segments produces clusters that a product team can name (late-night hospitality, subscription software, seasonal retail) and price, monitor and support differently; the clusters were in the data before anyone described them. Graph methods find fraud rings: accounts sharing devices, addresses, payees or timing form connected components nobody labelled. And the largest use of all is invisible: the pre-training of every foundation model is self-supervised learning on unlabelled text, which is why the models know so much without anyone annotating it.

For a fintech, unsupervised learning is how the unknown is found — new fraud, natural segments, hidden links — and its output is the start of an analyst's work, not the end of a model's.

## Example

A neobank's fraud team sees losses rising in a category its supervised model scores as low risk. An autoencoder trained on three months of normal account activity flags 0.4% of accounts as anomalous in the fourth month; clustering the flagged accounts by behaviour produces one tight group of 1,100 accounts: opened within six weeks of each other, funded by small transfers from many senders, drained by card at a handful of merchants abroad. No case had been labelled; the pattern was a mule network onboarded before the bank's detection rules existed. Analysts confirm 940 of the 1,100; the confirmations train a supervised model that catches the next wave at onboarding; and the cluster's shared features become three new rules. Losses in the category fall by 70% the following quarter.

## Common mistakes

- Treating an anomaly score as a fraud score; most anomalies are benign.
- Clusters nobody interprets, so the segmentation never reaches a decision.
- No loop from unsupervised discovery to supervised detection.
- Choosing the number of clusters for convenience and reading the result as truth.
- Using segmentation for customer decisions without the fairness review any profiling needs.

## Related terms

- [Supervised Learning](https://mahouse.world/glossary/supervised-learning.md)
- [Latent Space](https://mahouse.world/glossary/latent-space.md)
- [Training Data](https://mahouse.world/glossary/training-data.md)
- [Machine Learning](https://mahouse.world/glossary/machine-learning.md)
- [Pre-Training](https://mahouse.world/glossary/pre-training.md)
- [Transaction Monitoring](https://mahouse.world/glossary/transaction-monitoring.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov