Scheme Detection Methodology

How precrime decides which EDGAR filings are diagnostic of each fraud scheme, and how those rules are validated against known cases rather than asserted.

Every scheme carries a row in scheme_edgar_rules (the EDGAR fingerprint) and one or more rows in scheme_edgar_rule_scores (its measured precision/recall). The same data drives the "EDGAR detection & validation" card on each /scheme/<slug> page and the detection strip on /anomalies.

Two levels of rule

Form-presence — does a company file the scheme's diagnostic forms at all? Scored from EDGAR metadata alone (1.2M accessions), with no filing text. Cheap and complete, but blunt: forms like Form 4, Form D, and 8-K are filed by almost every public company, so they have high recall and low precision.

Content — does the text of those filings carry the scheme's signature (e.g. an 8-K announcing a restatement)? Scored from fetched filing bodies (precrime.filing_text). Lower recall, much higher precision — it separates the fraud signal from ordinary filing activity.

How rules are validated

For each scheme we build a labeled set of company CIKs: positives are the companies behind that scheme's enforcement matters (precrime.cells + documents.cik); negatives are the CIKs of all other schemes. A rule "predicts" a CIK if that CIK satisfies the rule (files the forms / its filings match the content signal). We then measure:

• recall — share of known-positive CIKs the rule catches
• precision — share of rule-flagged CIKs that are truly that scheme
• F1 — harmonic mean of the two

What the numbers say

Only accounting-fraud is sharp at the form-presence level — and its content rule adds precision over the form net:

Most schemes are high-recall, low-precision at the form-presence level — the diagnostic forms (Form 4, Form D, 8-K) are filed by nearly every company:

A further set of schemes have no EDGAR fingerprint at all — prosecuted on the criminal/DOJ side and detected from case text, not filings: fcpa, public-corruption, health-care-fraud, cyber-fraud, racketeering, obstruction, advance-fee.

What multi-scheme content mining shows

Content rules were mined and scored for eight securities schemes (signal bank → fetch-filings.ts ingest → mine-content-rules.ts). The honest result: against a control set of other fraud schemes, keyword content signals separate one fraud type from another only weakly — best-case precision ≈ 0.50 (accounting non-reliance, unregistered Regulation D, pump-and-dump consultant-share issuance). The reason is structural: the schemes share vocabulary (a restatement appears in accounting and financial-fraud filings), and the EDGAR accessions universe we hold contains only fraud-linked companies — there is no clean non-fraud control to measure against.

The unlock is a random non-fraud EDGAR control set (a true negative), which requires ingesting filings for companies outside the fraud corpus. Until then, content rules are best read as confirmation within a fraud-suspected set, not standalone fraud detectors. Each scheme stores both a content score and a conjunction estimate (form-presence recall net × content gate) in scheme_edgar_rule_scores.

Honest reading

Form-presence is a recall net, not a verdict. "Insiders always file Form 4" makes that signal nearly universal — useful to narrow candidates, useless to confirm fraud. The content layer adds precision but, on fraud-vs-fraud negatives, only modestly; the pipeline (fetch-filings.ts → mine-content-rules.ts) generalizes across schemes as their diagnostic forms are ingested.