Graph Neural Networks for Fraud Detection: Overview, Methods, and Resources

1. What is Fraud

According to U.S. law, fraud involves four aspects: false statements of fact, transactions between parties, the fraudster’s knowledge of falsity, and inducement of others to act based on the deception.

The article compares fraud with hackers, noting that most fraudsters exploit rule loopholes without breaking system security, while some hackers use system breaches to commit fraud.

It also distinguishes fraud from anomalies, explaining that fraudulent behavior may appear normal in data but still be fraudulent for a specific business context.

Background Introduction

Fraud detection spans social network fraud, financial risk control (loan default, insurance credit, money laundering, fake transactions, credit‑card fraud), and other domains such as ad traffic fraud, CTR manipulation, fake app retention, e‑commerce “sheep parties”, and game cheating.

With the rise of deep learning, fraud detection has become an interdisciplinary field involving data science, security, and machine learning.

2. Types of Fraud

Social network fraud includes bots, fake accounts, misinformation, and malicious links.

Financial fraud covers loan default prediction, insurance credit assessment, money‑laundering detection, fake transaction detection, credit‑card cash‑out detection, and blockchain‑based fraud detection.

Other fraud types include ad‑traffic fraud, CTR manipulation, fake app retention, e‑commerce “sheep parties”, crowdsourcing attacks, and game cheating.

3. GNN‑Based Fraud Detection

The typical GNN workflow for fraud detection consists of three steps:

Graph Construction : Extract user logs and other backend data to form nodes and edges representing relationships.

GNN Training : Learn node, edge, or graph embeddings from the constructed graph.

Classifier Training : Use the learned embeddings and known labels (e.g., red nodes = fraud) to train a classifier for predicting unknown nodes.

The core assumption is homophily: fraudulent users tend to connect with other fraudulent users, while normal users connect with normal users.

Research Timeline

Key milestones in GNN‑based fraud detection include:

2018: GraphRAD (MLG@KDD’18) – first GNN applied to fraud detection (Amazon).

2018: GEM (CIKM’18) – heterogeneous graph for Alipay fraud accounts.

2019: GeniePath (AAAI’19), InsurGNN (SIGIR’19) – basic GNN models for various fraud domains.

2019: BitGCN (ADF@KDD’19) – GCN for Bitcoin fraud, released a benchmark dataset.

2019: GAS (CIKM’19) – fake review detection on Xianyu platform.

2019: Player2Vec (CIKM’19) – heterogeneous GNN for underground forum fraud.

2020: CARE‑GNN (CIKM’20) – reinforcement‑learning‑based neighbor selection to combat fraudster camouflage.

2020: GAL (CIKM’20) – combines GNN with unsupervised learning for label‑scarce scenarios.

2021: MvMoE (WSDM’21) – multi‑task GNN for credit scoring and default prediction.

2021: APAN (SIGMOD’21) – streaming GNN learning for dynamic fraud data.

2021: DCI (SIGIR’21) – self‑supervised contrastive learning for fraud detection.

2021: IHGAT (KDD’21) – models user motivation for interpretable fraud detection.

2021: FD‑NAG (BigData’21) – graph‑based fraud detection for Grab ride‑hailing.

Practical Guidance for Applying GNNs

The article proposes five questions to decide how to apply GNNs:

Do you need a graph? Fraudsters often share IPs, devices, or other entities, making graph modeling beneficial.

Should you use GNNs? GNNs provide end‑to‑end learning without extensive feature engineering, especially when deep‑learning frameworks are available.

What task? Choose node classification, edge classification, graph classification, clustering, or anomaly detection based on the fraud scenario.

Graph structure design – decide node/edge types, heterogeneity, and sampling strategies; this step is critical for fraud detection.

GNN model selection – pick a mature model suited to the chosen task (e.g., GCN, GAT, heterogeneous GNN).

Key Challenges and Solutions

Camouflage : Use neighbor filtering, adversarial training, or Bayesian edge weighting to mitigate disguised fraudsters.

Scalability : Few works address industrial‑scale GNNs; non‑deep‑learning graph models may be more scalable.

Class imbalance : Apply undersampling, balanced neighbor selection, or data‑augmentation techniques.

Label scarcity : Employ active learning, semi‑supervised or self‑supervised learning, and meta‑learning.

Label noise : Use human‑in‑the‑loop or reinforcement‑learning‑based correction.

Data scarcity : Augment data by learning fraudster characteristics.

Emerging Directions

Graph pre‑training (contrastive learning), dynamic/streaming graphs, multi‑task learning, and interpretability (e.g., modeling user motivation) are active research areas.

Industrial Applications and Resources

Numerous industry papers from Alibaba, Ant Financial, Facebook, Amazon, and others are summarized, along with open‑source projects:

SafeGraph – a fraud‑detection toolkit implementing ten GNN models.

UGFraud – unsupervised graph‑based fraud detection package (pip install).

UPFD – graph‑based fake‑news detection with datasets integrated into DGL and PyG.

Curated lists of graph fraud detection and adversarial learning papers, datasets, and code.

Other anomaly‑detection libraries such as PyOD, PyODD, and DGL‑based fraud pipelines.

The article concludes by encouraging collaboration between academia and industry to advance graph‑based fraud detection.