Risk detection requires multiple learning paradigms because threats range from well-defined fraud to emerging and adaptive abuse. This chapter introduces supervised, semi-supervised, unsupervised, and anomaly-detection approaches from a deployment perspective. It explains how delayed ground truth, extreme class imbalance, and intervention feedback loops shape model design and evaluation. In risk contexts, accuracy is rarely meaningful; metrics must reflect asymmetric costs, review capacity, and operational thresholds. The chapter discusses time-based validation to prevent leakage, probability calibration for decision stability, and the gap between offline performance and live outcomes. Particular attention is given to practical constraints: latency budgets, model update cadence, segmentation, and the need to balance loss prevention against customer friction. By grounding core concepts in platform realities, the chapter establishes a shared vocabulary that links modeling choices to measurable outcomes and sets the foundation for the algorithmic methods developed in later chapters. We also outline common failure modes-overfitting to narrow cues, ignoring temporal context, and misaligned objectives-that degrade live performance even when offline metrics look strong. Throughout, the emphasis is on choosing the simplest method that meets risk objectives while remaining measurable, auditable, and adaptable.