An explainable, cost-aware hybrid framework for fraudulent online job posting detection

Online recruitment platforms are increasingly exploited by fraudulent job postings that harvest applicants’ personal data, extract upfront fees, or facilitate identity theft. Prior machine learning approaches report strong benchmark performance but are typically single-model classifiers that overlook the operational requirements of real deployment: cost-aware inference, calibrated probability output, human-in-the-loop routing, and structured explainability. This paper addresses these gaps with a two-stage, cost-aware fraud-screening framework evaluated on the Employment Scam Aegean Dataset (EMSCAD). A calibrated Hybrid Support Vector Machine (SVM) operating on TF-IDF and structured metadata features resolves the large majority of postings at negligible computational cost, escalating only the most uncertain cases to a DistilBERT-based hybrid classifier with a learned softmax attention gate for deeper semantic analysis. A seven-configuration ablation study shows free-text content is the dominant fraud signal, while structured metadata contributes a smaller but consistent precision gain. On a corrected, deduplicated evaluation split, the two-stage pipeline achieves fraud-class F1 of 0.906 (macro-F1 0.951; three-seed mean fraud-F1 0.899 ± 0.007) while reducing per-prediction inference cost by approximately 98.28% (dollar terms; three further measures – GPU-hours, FLOPs, and energy – are mathematically linked rescalings of the same escalation rate rather than independent evidence, while measured latency provides a genuinely distinct empirical confirmation). This advantage over the Stage-1 model alone is statistically robust across three independent training runs (McNemar’s exact test, p < 0.03 in every run), though a threshold-confound ablation shows that only about 40% of this advantage is attributable to Stage 2 specifically, with the remaining 60% attributable to re-thresholding Stage 1’s own probabilities using the same zone boundaries; a McNemar test isolating Stage 2’s marginal contribution specifically is significant in only 1 of 3 seeds ( p = 0.043 , 0.093, 0.210), so this marginal share is numerically positive but not robustly statistically significant on its own – Stage 2 still contributes a genuine, positive, but more modest and less statistically consistent share than the headline comparison alone suggests. An extended architecture search – comparing SVM, LightGBM, CatBoost, and RoBERTa as alternative components, and multi-task learning as an alternative training objective – confirms the adopted design remains the most cost-effective choice, with most architecture-selection decisions validated on held-out data rather than the test set. A manual review of every false negative, cross-dataset validation on the independently curated DIFrauD corpus, and token-level attribution via Integrated Gradients are reported, together with a corrected mechanistic-interpretability finding and a significant, previously unquantified operational limitation: the majority of residual false negatives (61.9%) are never seen by Stage 2 at all, since Stage 1 misclassifies them with enough confidence to auto-approve them directly – the paper’s largest unresolved operational risk, for which our exploratory mitigations remain inconclusive. The framework outputs calibrated risk scores, term-level explanations, and three-zone routing decisions designed for direct integration into human review workflows.