Graph Neural Network‑Based Payment Fraud Detection at eBay

With the global rollout of eBay's payment management system, a robust risk‑control architecture is essential for safeguarding user funds, preventing account and card theft, and reducing platform losses. Traditional algorithms struggle with graph‑structured transaction data, prompting the adoption of Graph Neural Networks (GNNs) for large‑scale fraud detection.

Payment Risk Overview

Pre‑transaction: detecting malicious registrations and account hijacking.

During transaction: identifying card‑theft, account‑theft, and other platform‑side risks.

Post‑transaction: evaluating account‑level risk scores.

E‑commerce Fraud Types

Buyer account/card theft.

Seller fraud and counterfeit goods.

Collusion between buyers and sellers.

Prohibited‑item sales, money laundering, and compliance risks.

eBay processes massive amounts of macro‑ and micro‑level data (historical transactions, user behavior, logs, third‑party blacklists, device fingerprints, LBS, etc.) using batch, stream, and graph‑computing frameworks to generate risk features for machine‑learning models and rule‑based decisions. The resulting risk scores trigger automated actions such as transaction approval or manual review.

User Account‑Theft Example

In a supervised modeling pipeline, features and labels are defined for the ATO scenario, followed by data sampling to address class imbalance, training a high‑performance boosting model (e.g., LightGBM), and deploying the model for real‑time risk evaluation.

While traditional models perform well on individual cases, they miss up to 30% of risk stemming from organized fraud groups. Conventional supervised learning treats samples independently and cannot capture relationships among IPs, payment tools, or device fingerprints.

Graph‑Based Risk Management

eBay builds a billion‑node relationship graph from transaction logs, seeds risk accounts, applies local community detection to extract dense sub‑graphs, and then uses GNNs to predict risk scores for unknown accounts. This approach amplifies risk density by orders of magnitude, enabling precise identification of high‑risk communities.

Limitations of Existing Models

Standard predictive models ignore transaction inter‑dependencies, while classic graph algorithms (e.g., PageRank, DeepWalk) only leverage topology without node attributes. Conventional deep learning (CNNs, RNNs) assumes regular grid or sequence data, making them unsuitable for irregular graph structures.

Why GNNs Work

GNNs aggregate neighbor information at each layer, updating node embeddings through learnable weight matrices and non‑linear activations, thereby capturing both feature and structural information and supporting inductive inference on unseen nodes.

Challenges of Deploying GNNs at Scale

Shallow architectures (2‑3 layers) suffer from over‑smoothing; deeper models increase capacity but are harder to train.

Full‑graph training is limited by batch learning, hardware constraints, and low efficiency.

Real‑world data are heterogeneous graphs, requiring support for multiple node and edge types.

Models must be interpretable for business decision‑making.

Fraud patterns evolve rapidly, necessitating dynamic graph handling.

xFraud Framework

The xFraud system consists of a Predictor and an Explainer. The Predictor builds an efficient heterogeneous‑graph model, while the Explainer generates human‑readable explanations of fraud patterns.

Predictor Components

Sampling Mechanism: GraphSAGE mini‑batch sampling is used for efficiency over HGSampling.

Node‑type Encoding: Learn embeddings for each node type and concatenate with feature embeddings.

Attention Mechanism: Multi‑head attention learns edge weights, inspired by Transformers.

Explainer

The Explainer identifies minimal sub‑graphs and feature sets whose removal causes large prediction score changes, using entropy regularization on nodes and edges to select concise explanations.

Dynamic Heterogeneous Graph Extension

Time information is modeled as temporal edges linking entities across time slices, forming a heterogeneous graph that captures dynamic risk evolution while remaining compatible with existing heterogeneous‑graph training pipelines.

Engineering Considerations

Deploying GNNs requires graph partitioning that preserves connectivity, efficient sub‑graph feature retrieval, and low‑latency inference (sub‑100 ms) in production, especially for payment scenarios where real‑time decisions are critical.

Overall, the presentation demonstrates how integrating GNNs with heterogeneous‑graph modeling, attention mechanisms, and dynamic temporal edges can significantly enhance eBay's payment fraud detection capabilities while addressing scalability, interpretability, and real‑time inference challenges.