Fraud graphs and fraud labels

These papers bear on two questions behind a production fraud stack. The first is whether a learned graph neural network (GNN) would beat the engineered graph features that an entity graph of devices, accounts, identities and sessions feeds into tree models. The second is what goes wrong with the labels that a pretrained fraud model is fine-tuned on per customer, and that an ACH return model learns from. They arrive late, earlier decisions select them, and some never arrive.

CARE-GNN (Dou et al., 2020). A GNN updates each node from its neighbors by message passing, so fraudsters camouflage by looking normal on features or by linking to many benign nodes so that averaging washes them out. CARE-GNN measures neighbor similarity by the gap between predicted fraud scores, a label-trained distance that feature camouflage does not fool, and keeps only the closest neighbors per relation. Yelp AUC was 75.70 against 62.07 for the best baseline GNN, with no feature-only baseline, and the same-user relation's 0.90 label homophily (share of edges joining same-label nodes) means random splits come close to leaking labels. In practice: measure label homophily per relation and aggregate only along the homophilous ones.

PC-GNN (Liu et al., Alibaba, 2021). Fraud graphs are badly imbalanced. PC-GNN's Pick step samples training nodes inversely to class frequency so minibatches balance, and its Choose step keeps the closer half of neighbors by score distance and adds similar-scoring known frauds even when unlinked. On Alibaba credit graphs with imbalance above 100, dropping Pick left the model predicting no positives, while dropping Choose cost under 0.02 AUC, and no tree baseline appears. In practice: balance classes from day one, and give the trees Choose as a feature, the distance to the nearest known fraud.

BWGNN (Tang et al., 2022). Averaging GNNs keep the low graph frequencies, the parts of a signal that vary smoothly across edges. BWGNN argues anomalies shift feature energy toward high frequencies, where a node differs from its neighbors, and reaches them with a bank of band-pass filters $(L/2)^p (I - L/2)^q$. YelpChi AUC was 90.54 against 79.87 for PC-GNN, though the supporting theory assumes features independent of the graph, splits are random, and no tree baseline appears. In practice: add each node's difference from its neighbors' mean, and its neighbors' spread, to the entity-graph features.

GADBench (Tang et al., 2023). Fraud GNN papers rarely faced a strong tree baseline. GADBench adds XGB-Graph, XGBoost on parameter-free neighbor aggregates (mean, max or sum, up to four hops), roughly what graph-database features feeding trees already give. It averages 58.95 AUPRC (area under the precision-recall curve, sensitive to the top of the ranking) against 49.57 for the best GNN, and on Elliptic's inductive split (test nodes unseen in training) it keeps 76.20 while GNNs fall to 15 to 25. GNNs win where features are text embeddings, whose dense correlated dimensions trees split poorly, and with 20 labels on Yelp CARE-GNN beat it 68.69 to 24.84. In practice: a GNN replacing graph features in trees will more likely lose, so test its score as one more tree feature.

GHRN (Gao et al., 2023). Heterophily, edges joining nodes with different labels, dilutes an anomaly when neighbors are averaged. For one-hot labels $Y$, $\mathrm{tr}(Y^\top L Y)$ is twice the number of inter-class edges, so heterophily is high-frequency label energy. GHRN takes a trained BWGNN's predicted one-hop label change $\hat Y - \hat A \hat Y$ at each node, deletes the 1.5% of edges whose endpoints' changes have the lowest inner product, and retrains. In GADBench it matches BWGNN (49.55 AUPRC); no open copy of the paper was found, so this rests on its code. In practice: prune edges whose endpoints disagree in model score before computing neighbor aggregates.

GEM (Liu et al., Alipay, 2018). Attackers open many accounts on few devices, because devices cost money, and work them in bursts. GEM scores new Alipay accounts on a 7-day graph of accounts and six device types and sums neighbor messages within each device type, so the representation counts co-registered accounts where a mean would not grow with the farm. Weekly AUC was about 0.93 against 0.88 for trees on component size and degree, a weak baseline, and labels exist only for accounts Alipay already suspected. In practice: give the trees per-device-type co-registration and co-burst counts before comparing against any GNN.

xFraud (Rao et al., eBay, 2022). eBay classifies transactions with a heterogeneous graph transformer and an explainer, on a 1.1B-node graph that also holds payment tokens, emails, addresses and buyers. For practice, the most useful part is the label pipeline. Rules filter a stream that is 0.016% fraud, and the training sample keeps every fraud and 1% of benign transactions, so a precision of 0.98 on that sample is 0.32 at 10% recall on the filtered stream. It beat GEM only narrowly, lost to it when split across 16 machines, and had no tree baseline, and eBay ships its scores as features for downstream models. In practice: test trees against trees plus a GNN score at a fixed decline rate, and correct any precision measured after filters or downsampling.

DGraph (Huang et al., Finvolution, 2022). Fraud datasets rarely keep the unlabeled users around the labeled ones. DGraph's lending graph links 3.70M users by emergency-contact edges, and 2.47M of them never borrowed and carry no label (background nodes). Removing them breaks the graph into 605,194 pieces and drops GCN's AUC from 0.76 to 0.72, while typing them as their own node type lifts RGCN to 0.784. Average precision near 0.04 on a 1.3% base rate shows a hard task, and only approved borrowers have labels. In practice: build each customer's graph from the whole network and type the entities with no label from that customer.

FRAUDAR (Hooi et al., CMU, 2016). Accounts acting together form a dense block in a user-by-object graph, and camouflage edges to honest objects try to hide it. FRAUDAR greedily peels the least suspicious node in near-linear time, weighting each edge by $1/\log(d_j + 5)$ for object degree $d_j$, which camouflage leaves unchanged inside the block because its edges go to honest objects outside it. On a 1.47B-edge Twitter graph it found a 4,031 by 4,313 block at 68% density, and 41% of sampled followers advertised follower buying. Legitimate dense blocks (office devices, campus IPs) also score high. In practice: run it weekly on identity-by-device and identity-by-IP graphs and give the trees block membership and peel order.

Multigraph GNNs (Egressy et al., ETH and IBM, 2024). Transaction networks are directed multigraphs (many edges between two accounts), and plain message passing misses their patterns. Three changes each add a provable ability: reverse message passing (in- and out-neighbors aggregated apart) detects out-degree, port numbering (neighbors numbered by first timestamp) detects fan-in, and with reverse passing fan-out, and ego IDs (marking the scored node) complete the set for cycles and bicliques. On simulated laundering the adapted GNN scored 68.16 F1 against 63.23 for XGBoost on counts of the simulator's own patterns. In practice: most entity-graph patterns are counts a graph query already computes, and identity rings sharing several devices are the biclique case.

Synthetic AML data (Altman et al., IBM, 2023). Real anti-money-laundering labels are never complete. AMLworld simulates people, companies and banks and follows illicit money through every later transfer, so its labels are complete. Its evaluation protocol is a good template: split by time, and let validation and test graphs hold all earlier transactions so patterns can complete. XGBoost on graph features scored 63.23 F1 against 56.77 for a featureless GNN, and features from a graph shared across banks beat per-bank graphs. A GNN moved to low-illicit data beat XGBoost trained there but scored zero on the smallest set until fine-tuned. In practice: favor a network-level model with a per-customer head.

Realistic card fraud modeling (Dal Pozzolo et al., Worldline, 2018). Investigators check only 100 alerted cards a day, so labels come from feedback, recent and biased verdicts on what the current model alerted, and delayed labels for all transactions once the dispute window passes, unbiased but stale. Separate random forests on each source, with probabilities averaged, reach top-of-list precision 0.77, against 0.61 for one model on pooled labels and 0.73 for feedback alone. Reweighting feedback by inverse selection probability hurt, because selection tracks risk and the weights shrink the riskiest cases. In practice: keep a feedback model and an outcome model, combine their posteriors, and evaluate at the customer's review capacity.

Delayed feedback (Chapelle, Criteo, 2014). Ad conversions arrive up to 30 days after a click, so treating unconverted clicks as negatives underpredicts. Chapelle models eventual conversion $p(x)$ with an exponential delay of rate $\lambda(x)$, so an unconverted click observed for time $e$ contributes $1 - p + p e^{-\lambda e}$, and a recent click barely moves $p$ while an old one acts as a negative. The EM update for $p$ is a weighted classification any tree library can fit. Log loss fell from 0.4076 to 0.3960, against 0.3889 for an oracle. In practice: an unreturned recent ACH debit is unlabeled, and since unauthorized (fraud) returns can take weeks while insufficient-funds returns come within days, a short window mislabels exactly the fraud.

Bank Account Fraud suite (Jesus et al., Feedzai, 2022). Onboarding-fraud research lacked public data. BAF is six GAN-generated datasets (a GAN is a generator trained to mimic real data) of 1M account applications over 8 months, trained on months 1 to 6, tested on 7 and 8, and scored by true positive rate at 5% false positive rate, the point clients ask for. The best models flagged legitimate applicants over 50 more than three times as often as younger ones. The generated task is harder than the real one (about 49 to 56% against 75.4% there). In practice: a free testbed for time-split evaluation and false-positive parity checks.

Selective labels from declines. A selective label exists only where an earlier decision let the case through: a declined ACH debit never returns, and a rejected applicant never defaults. None of the fourteen papers corrects for it. Dal Pozzolo models investigator selection but not declines, xFraud trains only behind rule filters, GEM and DGraph label only suspected accounts or approved borrowers, and Chapelle handles only late labels. The remedies come from elsewhere: a small randomized slice passed regardless of score with propensities logged, counterfactual evaluation weighted by those propensities, and comparing policies only on cases the old one approved. In practice: the randomized slice makes every other offline comparison here trustworthy.

What the papers say together. Trees on neighbor aggregates are the baseline to beat. They beat specialized fraud GNNs in GADBench, more so at the top of the ranking and on unseen nodes, while the industrial GNN wins (GEM, xFraud) came against weak tree baselines or on filtered samples. Learned graph models won with dense embedding inputs, with very scarce labels on one homophilous relation, and on multi-hop money-flow patterns. Most GNN ideas have cheap tree-side versions, such as per-relation aggregates, node-minus-neighbor features, edge pruning, distance to the nearest known fraud and co-burst counts. On labels, pooling biased feedback with outcomes hurts, late labels must be modeled, and network-wide data beats per-institution data. Nobody has tested a GNN score beside strong graph features at billion-edge scale with labels corrected for declines.

Experiments to run first. (1) On production entity-graph data with a time split, compare current tree features, added per-relation and node-minus-mean aggregates, time-respecting label features, and a relation-aware GNN score as a tree feature, by recall at each customer's decline rate, sliced by node age and customer label count. (2) On backtest data old enough for full outcomes, compare a naive ACH return window, shifted labels and a delay model with return-code classes, and check whether naive windows undercount unauthorized returns. (3) Fine-tune per customer with separate feedback and outcome models against pooled labels, beside a small randomized pass-through slice. (4) Run weekly FRAUDAR on identity-by-device and identity-by-IP graphs, measuring block precision, lead time before the first return, and lift as tree features. (5) Only if a money-flow graph exists, test multigraph adaptations against enumerated fan and cycle counts.