Start with the population
An alert’s meaning depends partly on how common the target behaviour is in the population being screened. A detector’s catch rate and false-positive rate do not, by themselves, tell you the share of alerts that will be confirmed. Begin with counts, not impressive percentages.
Build a small world
In a fictional population of 10,000 transactions, 100 are fraudulent. A detector catches 90 of those and flags 1% of the 9,900 legitimate transactions. That produces 90 true alerts and 99 false alerts: fewer than half of the 189 alerts are confirmed fraud.
Explain the apparent surprise
The detector caught 90% of fraud, yet the review queue contains many legitimate customers because the legitimate population was much larger. There is no contradiction. Applying the same detector to a different population can change alert precision even when its class-specific rates remain unchanged.
Use the lesson carefully
Estimate prevalence with suitable outcome evidence and document uncertainty. Do not substitute the fraud share of an already filtered queue for the fraud share of all traffic. Capacity planning and customer-impact estimates should use the deployment population, not a conveniently balanced demonstration dataset built for a presentation.