A Dual-Module Framework for Graph-Based Fraud Detection

Unsupervised fraud detection has gained attention for its ability to operate without labeled data. However, it faces two main challenges: complex fraud tactics and concealed fraudulent behavior. To address the complexity of fraud patterns, this paper analyzes fraudulent behavior characteristics, categorizing them into two types: clustered fraud and sparse fraud. Clustered fraud typically exhibits characteristics of organized group activities, while sparse fraud is highly camouflaged, with anomalous nodes scattered and intermingled with normal nodes. To overcome the concealment of fraudulent behavior, we propose DCSF (Detecting Clustered and Sparse Frauds), a dual-module graph-based framework. The first module uses community detection and an encoder-decoder to model structural features and detect clustered fraud through reconstruction errors. The second module samples 1-ego networks and uses contrastive learning to compute distances between homogeneous and heterogeneous subgraphs, identifying sparse fraud. The final anomaly score combines outputs from both modules. Experiments on five real-world datasets show DCSF outperforms state-of-the-art methods.