Rules-based fraud detection in SQL
Seven SQL rules for account takeover, scams, card testing and money mules, scored against 585,000 labelled transactions. They catch 224 of 230 fraud cases at 41 alerts a day.
// detection · data · banking risk
I find how things get broken, then build what catches it.
I'm Shay Ramthol. I write SQL and Python detection rules, run security labs end to end, and spent years in bank lending and KYC/AML. That mix means I know how fraud and attacks get through, and how controls stop them.
224/230fraud cases caught by my SQL ruleset
22/22EC-Council CCT lab modules completed
3 yrsat BNZ, including home lending risk
Finalstage invite, NZ Cyber Security Challenge 2026
// selected work
Evidence, not adjectives
Each project shows the method and the numbers, including what didn't work.
Cyber Technician lab portfolio
All 22 EC-Council CCT lab modules completed. Ten exercises documented step by step and turned into a security and disaster recovery strategy for a research-vessel network.
Hacker101 CTF
Extracted admin credentials by hand with blind SQL injection, exploited stored XSS and IDOR flaws, and built an AES-CBC padding-oracle attack to crack the Encrypted Pastebin challenge. Earned private-program eligibility in September 2026.
Knowing exactly how these attacks work is what makes the defensive work above useful. A detection rule is only as good as your picture of what the attacker does next.
NZ business data toolkit
A Python toolkit that pulls NZBN and Companies Office data, from the API and bulk files, into a local database with scheduled jobs. I designed the loaders so a thinner source file can never overwrite a richer existing record, which fixed a data-integrity bug found during the build.
The same discipline applies to fraud data: a pipeline that silently drops fields produces rules that silently miss fraud.
// what I bring
Where security, data and finance overlap
Detection rules
Fraud rules in SQL, Suricata IDS and iptables rules, alert review in Splunk. Tuned against real alert volume, not just accuracy.
Data and code
SQL with window functions, Python pipelines and API integrations, RPA automation, and Excel models linking data across sheets and workbooks.
Fraud and risk
KYC/AML checks, credit assessment, loan validation and pre-funding verification at Bizcap; lending risk within delegated authority at BNZ.
Attacker mindset
Hack The Box CPTS path (in progress), Hacker101 CTF, NZ Cyber Security Challenge. Web, network and Active Directory testing.
Incident handling
Structured incident response, computer forensics, backup and restore, and continuity and disaster recovery planning.
Plain explanations
Nearly a decade customer-facing in banking and B2B sales. I explain technical findings to the people who have to act on them.
// get in touch
Hiring for fraud, SOC or security analysis?
I'm based in Auckland and open to roles in fraud detection, security operations and financial crime.